Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit d65af84

Browse files
bepbep
committed
config/security: Add AllowChildProcess to security.node.permissions
Some Linux setups trigger detect-libc's spawnSync('getconf') fallback when process.report does not expose glibcVersionRuntime, breaking tailwindcss under the Node permission model. Add AllowChildProcess mirroring AllowAddons/AllowWorker, default to ["tailwindcss"], and emit --allow-child-process accordingly. Fixes #14824
1 parent 454450a commit d65af84

4 files changed

Lines changed: 23 additions & 11 deletions

File tree

‎common/hexec/exec.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -285,6 +285,11 @@ func (e *Exec) nodePermissionArgs(name, scriptPath string) []string {
285285
args = append(args, "--allow-worker")
286286
}
287287

288+
if slices.Contains(perms.AllowChildProcess, name) {
289+
silenceSecurityWarnings = true
290+
args = append(args, "--allow-child-process")
291+
}
292+
288293
if silenceSecurityWarnings {
289294
// There are no more fine grained way to do this, see https://github.com/nodejs/node/issues/59818
290295
// If the process is configured to allow either workers or addons, Node will print warnings that's not very helpful.

‎common/hexec/exec_test.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ func TestNodePermissionArgs(t *testing.T) {
4343
"--allow-fs-read=" + site,
4444
"--allow-addons",
4545
"--allow-worker",
46+
"--allow-child-process",
4647
"--disable-warning=SecurityWarning",
4748
})
4849
})
@@ -75,6 +76,7 @@ func TestNodePermissionArgs(t *testing.T) {
7576
"--allow-fs-write=" + site,
7677
"--allow-addons",
7778
"--allow-worker",
79+
"--allow-child-process",
7880
"--disable-warning=SecurityWarning",
7981
})
8082
})
@@ -94,6 +96,7 @@ func TestNodePermissionArgs(t *testing.T) {
9496
"--allow-fs-write=*",
9597
"--allow-addons",
9698
"--allow-worker",
99+
"--allow-child-process",
97100
"--disable-warning=SecurityWarning",
98101
})
99102
})
@@ -114,6 +117,7 @@ func TestNodePermissionArgs(t *testing.T) {
114117
cfg.Node.Permissions.AllowRead = nil
115118
cfg.Node.Permissions.AllowAddons = nil
116119
cfg.Node.Permissions.AllowWorker = nil
120+
cfg.Node.Permissions.AllowChildProcess = nil
117121
e := &Exec{
118122
sc: cfg,
119123
workingDir: site,

‎config/security/securityConfig.go‎

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -65,11 +65,12 @@ var DefaultConfig = Config{
6565
},
6666
Node: Node{
6767
Permissions: NodePermissions{
68-
Disable: false,
69-
AllowRead: []string{"."},
70-
AllowWrite: []string{}, // No write access by default.
71-
AllowAddons: []string{"tailwindcss"}, // tailwindcss does not work without addon permissions.
72-
AllowWorker: []string{"tailwindcss"}, // tailwindcss needs worker access.
68+
Disable: false,
69+
AllowRead: []string{"."},
70+
AllowWrite: []string{}, // No write access by default.
71+
AllowAddons: []string{"tailwindcss"}, // tailwindcss does not work without addon permissions.
72+
AllowWorker: []string{"tailwindcss"}, // tailwindcss needs worker access.
73+
AllowChildProcess: []string{"tailwindcss"}, // detect-libc spawns getconf on some Linux setups.
7374
},
7475
},
7576
}
@@ -128,11 +129,12 @@ type Node struct {
128129
// Use "*" to allow all paths.
129130
type NodePermissions struct {
130131
// Disable turns off the Node.js permission model entirely.
131-
Disable bool `json:"disable"`
132-
AllowRead []string `json:"allowRead"`
133-
AllowWrite []string `json:"allowWrite"`
134-
AllowAddons []string `json:"allowAddons"`
135-
AllowWorker []string `json:"allowWorker"`
132+
Disable bool `json:"disable"`
133+
AllowRead []string `json:"allowRead"`
134+
AllowWrite []string `json:"allowWrite"`
135+
AllowAddons []string `json:"allowAddons"`
136+
AllowWorker []string `json:"allowWorker"`
137+
AllowChildProcess []string `json:"allowChildProcess"`
136138
}
137139

138140
// IsEnabled reports whether the Node.js permission model is active.
@@ -220,6 +222,7 @@ func DecodeConfig(cfg config.Provider) (Config, error) {
220222
sc.Node.Permissions.AllowWrite = slices.Clone(sc.Node.Permissions.AllowWrite)
221223
sc.Node.Permissions.AllowAddons = slices.Clone(sc.Node.Permissions.AllowAddons)
222224
sc.Node.Permissions.AllowWorker = slices.Clone(sc.Node.Permissions.AllowWorker)
225+
sc.Node.Permissions.AllowChildProcess = slices.Clone(sc.Node.Permissions.AllowChildProcess)
223226
if cfg.IsSet(securityConfigKey) {
224227
m := cfg.GetStringMap(securityConfigKey)
225228
dec, err := mapstructure.NewDecoder(

‎config/security/securityConfig_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ func TestToTOML(t *testing.T) {
135135
got := DefaultConfig.ToTOML()
136136

137137
c.Assert(got, qt.Equals,
138-
"[security]\n enableInlineShortcodes = false\n\n [security.exec]\n allow = ['^(dart-)?sass(-embedded)?$', '^go$', '^git$', '^node$', '^postcss$', '^tailwindcss$']\n osEnv = ['(?i)^((HTTPS?|NO)_PROXY|PATH(EXT)?|APPDATA|TE?MP|TERM|GO\\w+|(XDG_CONFIG_)?HOME|USERPROFILE|SSH_AUTH_SOCK|DISPLAY|LANG|SYSTEMDRIVE|PROGRAMDATA)$']\n\n [security.funcs]\n getenv = ['^HUGO_', '^CI$']\n\n [security.http]\n methods = ['(?i)GET|POST']\n urls = ['(?i)^https?://[a-z]', '! (?i)localhost', '! (?i)^https?://[^/?#]*@']\n\n [security.node]\n [security.node.permissions]\n allowAddons = ['tailwindcss']\n allowRead = ['.']\n allowWorker = ['tailwindcss']\n allowWrite = []\n disable = false",
138+
"[security]\n enableInlineShortcodes = false\n\n [security.exec]\n allow = ['^(dart-)?sass(-embedded)?$', '^go$', '^git$', '^node$', '^postcss$', '^tailwindcss$']\n osEnv = ['(?i)^((HTTPS?|NO)_PROXY|PATH(EXT)?|APPDATA|TE?MP|TERM|GO\\w+|(XDG_CONFIG_)?HOME|USERPROFILE|SSH_AUTH_SOCK|DISPLAY|LANG|SYSTEMDRIVE|PROGRAMDATA)$']\n\n [security.funcs]\n getenv = ['^HUGO_', '^CI$']\n\n [security.http]\n methods = ['(?i)GET|POST']\n urls = ['(?i)^https?://[a-z]', '! (?i)localhost', '! (?i)^https?://[^/?#]*@']\n\n [security.node]\n [security.node.permissions]\n allowAddons = ['tailwindcss']\n allowChildProcess = ['tailwindcss']\n allowRead = ['.']\n allowWorker = ['tailwindcss']\n allowWrite = []\n disable = false",
139139
)
140140
}
141141

0 commit comments

Comments
 (0)