src: apply multiple permissions improvements

node.gyp

@@ -178,16 +178,8 @@
       'src/node_worker.cc',
       'src/node_zlib.cc',
       'src/path.cc',
-      'src/permission/child_process_permission.cc',
-      'src/permission/openssl_store_permission.cc',
-      'src/permission/ffi_permission.cc',
       'src/permission/fs_permission.cc',
-      'src/permission/inspector_permission.cc',
       'src/permission/permission.cc',
-      'src/permission/wasi_permission.cc',
-      'src/permission/worker_permission.cc',
-      'src/permission/net_permission.cc',
-      'src/permission/addon_permission.cc',
       'src/pipe_wrap.cc',
       'src/process_wrap.cc',
       'src/signal_wrap.cc',
@@ -314,16 +306,10 @@
       'src/node_watchdog.h',
       'src/node_worker.h',
       'src/path.h',
-      'src/permission/child_process_permission.h',
-      'src/permission/openssl_store_permission.h',
-      'src/permission/ffi_permission.h',
+      'src/permission/boolean_permission.h',
       'src/permission/fs_permission.h',
-      'src/permission/inspector_permission.h',
       'src/permission/permission.h',
-      'src/permission/wasi_permission.h',
-      'src/permission/worker_permission.h',
-      'src/permission/net_permission.h',
-      'src/permission/addon_permission.h',
+      'src/permission/permission_base.h',
       'src/pipe_wrap.h',
       'src/req_wrap.h',
       'src/req_wrap-inl.h',

src/env-inl.h

@@ -841,6 +841,13 @@ void Environment::set_process_exit_handler(
 #undef VY
 #undef VP
 
+#define V(Name, label, _, __)                                                  \
+  inline v8::Local<v8::String> IsolateData::Name##_permission_string() const { \
+    return Name##_permission_string##_.Get(isolate_);                          \
+  }
+  PERMISSIONS(V)
+#undef V
+
 #define VM(PropertyName) V(PropertyName##_binding_template, v8::ObjectTemplate)
 #define V(PropertyName, TypeName)                                              \
   inline v8::Local<TypeName> IsolateData::PropertyName() const {               \
@@ -870,6 +877,13 @@ void Environment::set_process_exit_handler(
 #undef VY
 #undef VP
 
+#define V(Name, label, _, __)                                                  \
+  inline v8::Local<v8::String> Environment::Name##_permission_string() const { \
+    return isolate_data()->Name##_permission_string();                         \
+  }
+  PERMISSIONS(V)
+#undef V
+
 #define V(PropertyName, TypeName)                                              \
   inline v8::Local<TypeName> Environment::PropertyName() const {               \
     return isolate_data()->PropertyName();                                     \

src/env.cc

@@ -360,6 +360,12 @@ IsolateDataSerializeInfo IsolateData::Serialize(SnapshotCreator* creator) {
 #undef VS
 #undef VP
 
+#define V(Name, label, _, __)                                                  \
+  info.primitive_values.push_back(                                             \
+      creator->AddData(Name##_permission_string##_.Get(isolate)));
+  PERMISSIONS(V)
+#undef V
+
   info.primitive_values.reserve(info.primitive_values.size() +
                                 AsyncWrap::PROVIDERS_LENGTH);
   for (size_t i = 0; i < AsyncWrap::PROVIDERS_LENGTH; i++) {
@@ -419,6 +425,20 @@ void IsolateData::DeserializeProperties(const IsolateDataSerializeInfo* info) {
 #undef VS
 #undef VP
 
+#define V(Name, label, _, __)                                                  \
+  do {                                                                         \
+    MaybeLocal<String> maybe_field =                                           \
+        isolate_->GetDataFromSnapshotOnce<String>(                             \
+            info->primitive_values[i++]);                                      \
+    Local<String> field;                                                       \
+    if (!maybe_field.ToLocal(&field)) {                                        \
+      fprintf(stderr, "Failed to deserialize " #Name "_permission_string\n");  \
+    }                                                                          \
+    Name##_permission_string##_.Set(isolate_, field);                          \
+  } while (0);
+  PERMISSIONS(V)
+#undef V
+
   for (size_t j = 0; j < AsyncWrap::PROVIDERS_LENGTH; j++) {
     MaybeLocal<String> maybe_field =
         isolate_->GetDataFromSnapshotOnce<String>(info->primitive_values[i++]);
@@ -520,6 +540,17 @@ void IsolateData::CreateProperties() {
   PER_ISOLATE_STRING_PROPERTIES(V)
 #undef V
 
+#define V(Name, label, _, __)                                                  \
+  Name##_permission_string##_.Set(                                             \
+      isolate_,                                                                \
+      String::NewFromOneByte(isolate_,                                         \
+                             reinterpret_cast<const uint8_t*>(#Name),          \
+                             NewStringType::kInternalized,                     \
+                             sizeof(#Name) - 1)                                \
+          .ToLocalChecked());
+  PERMISSIONS(V)
+#undef V
+
   // Create all the provider strings that will be passed to JS. Place them in
   // an array so the array index matches the PROVIDER id offset. This way the
   // strings can be retrieved quickly.
@@ -630,6 +661,11 @@ void IsolateData::MemoryInfo(MemoryTracker* tracker) const {
   PER_ISOLATE_STRING_PROPERTIES(V)
 #undef V
 
+#define V(Name, label, _, __)                                                  \
+  tracker->TrackField(#Name "_permission_string", Name##_permission_string());
+  PERMISSIONS(V)
+#undef V
+
   tracker->TrackField("async_wrap_providers", async_wrap_providers_);
 
   if (node_allocator_ != nullptr) {
@@ -918,6 +954,7 @@ Environment::Environment(IsolateData* isolate_data,
 
   if (options_->permission || options_->permission_audit) {
     permission()->EnablePermissions();
+    static const std::array args = {std::string("*")};
     if (options_->permission_audit) {
       permission()->EnableWarningOnly();
     }
@@ -926,29 +963,29 @@ Environment::Environment(IsolateData* isolate_data,
     // unless explicitly allowed by the user
     if (!options_->allow_addons) {
       options_->allow_native_addons = false;
-      permission()->Apply(this, {"*"}, permission::PermissionScope::kAddon);
+      permission()->Apply(this, args, permission::PermissionScope::kAddon);
     }
     if (!options_->allow_inspector) {
       flags_ = flags_ | EnvironmentFlags::kNoCreateInspector;
-      permission()->Apply(this, {"*"}, permission::PermissionScope::kInspector);
+      permission()->Apply(this, args, permission::PermissionScope::kInspector);
     }
     if (!options_->allow_child_process) {
       permission()->Apply(
-          this, {"*"}, permission::PermissionScope::kChildProcess);
+          this, args, permission::PermissionScope::kChildProcess);
     }
     if (!options_->allow_ffi) {
-      permission()->Apply(this, {"*"}, permission::PermissionScope::kFFI);
+      permission()->Apply(this, args, permission::PermissionScope::kFFI);
     }
     if (!options_->allow_openssl_store) {
       permission()->Apply(
-          this, {"*"}, permission::PermissionScope::kOpenSSLStore);
+          this, args, permission::PermissionScope::kOpenSSLStore);
     }
     if (!options_->allow_worker_threads) {
       permission()->Apply(
-          this, {"*"}, permission::PermissionScope::kWorkerThreads);
+          this, args, permission::PermissionScope::kWorkerThreads);
     }
     if (!options_->allow_wasi) {
-      permission()->Apply(this, {"*"}, permission::PermissionScope::kWASI);
+      permission()->Apply(this, args, permission::PermissionScope::kWASI);
     }
 
     // Implicit allow entrypoint to kFileSystemRead
@@ -983,7 +1020,7 @@ Environment::Environment(IsolateData* isolate_data,
     }
 
     if (options_->allow_net) {
-      permission()->Apply(this, {"*"}, permission::PermissionScope::kNet);
+      permission()->Apply(this, args, permission::PermissionScope::kNet);
     }
   }
 }

src/env.h

@@ -189,6 +189,11 @@ class NODE_EXTERN_PRIVATE IsolateData : public MemoryRetainer {
 #undef VS
 #undef VP
 
+#define V(Name, label, _, __)                                                  \
+  inline v8::Local<v8::String> Name##_permission_string() const;
+  PERMISSIONS(V)
+#undef V
+
 #define VM(PropertyName) V(PropertyName##_binding_template, v8::ObjectTemplate)
 #define V(PropertyName, TypeName)                                              \
   inline v8::Local<TypeName> PropertyName() const;                             \
@@ -234,6 +239,12 @@ class NODE_EXTERN_PRIVATE IsolateData : public MemoryRetainer {
 #undef VS
 #undef VY
 #undef VP
+
+#define V(Name, label, _, __)                                                  \
+  v8::Eternal<v8::String> Name##_permission_string##_;
+  PERMISSIONS(V)
+#undef V
+
   // Keep a list of all Persistent strings used for AsyncWrap Provider types.
   std::array<v8::Eternal<v8::String>, AsyncWrap::PROVIDERS_LENGTH>
       async_wrap_providers_;
@@ -875,6 +886,11 @@ class Environment final : public MemoryRetainer {
 #undef VY
 #undef VP
 
+#define V(Name, label, _, __)                                                  \
+  inline v8::Local<v8::String> Name##_permission_string() const;
+  PERMISSIONS(V)
+#undef V
+
 #define V(PropertyName, TypeName)                                             \
   inline v8::Local<TypeName> PropertyName() const;                            \
   inline void set_ ## PropertyName(v8::Local<TypeName> value);

src/env_properties.h

@@ -463,6 +463,7 @@
   V(naptr_record_template, v8::DictionaryTemplate)                             \
   V(object_stats_template, v8::DictionaryTemplate)                             \
   V(page_stats_template, v8::DictionaryTemplate)                               \
+  V(permission_diagnostic_channel_message, v8::DictionaryTemplate)             \
   V(pipe_constructor_template, v8::FunctionTemplate)                           \
   V(script_context_constructor_template, v8::FunctionTemplate)                 \
   V(secure_context_constructor_template, v8::FunctionTemplate)                 \

src/node_diagnostics_channel.cc

@@ -178,11 +178,11 @@ void Channel::Unlink() {
   publish_fn_.Reset();
 }
 
-Channel* Channel::Get(Environment* env, const char* name) {
+BaseObjectPtr<Channel> Channel::Get(Environment* env, std::string_view name) {
   Realm* realm = env->principal_realm();
   BindingData* binding = realm->GetBindingData<BindingData>();
   if (binding == nullptr) {
-    return nullptr;
+    return {};
   }
   uint32_t index = binding->GetOrCreateChannelIndex(std::string(name));
 
@@ -208,22 +208,24 @@ Channel* Channel::Get(Environment* env, const char* name) {
              .ToLocalChecked()
              ->NewInstance(context)
              .ToLocal(&wrap)) {
-      return nullptr;
+      return {};
     }
 
     binding->channels_[index] = MakeDetachedBaseObject<Channel>(
         env, wrap, binding, index, std::string(name));
   }
 
-  Channel* channel = binding->channels_[index].get();
+  auto& channel = binding->channels_[index];
 
   // Late-bind: link to the JS channel when the callback is available.
   if (!binding->link_callback_.IsEmpty() && !channel->IsLinked()) {
     Isolate* isolate = env->isolate();
     HandleScope handle_scope(isolate);
     Local<Context> context = env->context();
-    Local<String> js_name = String::NewFromUtf8(isolate, name).ToLocalChecked();
-    Local<Value> argv[] = {js_name, Integer::NewFromUnsigned(isolate, index)};
+    Local<Value> argv[] = {
+        ToV8Value(context, name).ToLocalChecked(),
+        Integer::NewFromUnsigned(isolate, index),
+    };
     Local<Value> result;
     if (binding->link_callback_.Get(isolate)
             ->Call(context, v8::Undefined(isolate), arraysize(argv), argv)

src/node_diagnostics_channel.h

@@ -73,8 +73,7 @@ class Channel : public BaseObject {
           uint32_t index,
           std::string name);
 
-  // Returns a non-owning pointer. Lifetime is managed by BindingData.
-  static Channel* Get(Environment* env, const char* name);
+  static BaseObjectPtr<Channel> Get(Environment* env, std::string_view name);
 
   inline bool HasSubscribers() const {
     return binding_data_ != nullptr && binding_data_->subscribers_[index_] > 0;

src/permission/boolean_permission.h

@@ -0,0 +1,50 @@
+#ifndef SRC_PERMISSION_BOOLEAN_PERMISSION_H_
+#define SRC_PERMISSION_BOOLEAN_PERMISSION_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include "permission/permission_base.h"
+
+namespace node::permission {
+
+// A simple boolean permission that either denies or allows access.
+// Used for permission scopes that don't need per-resource granularity.
+template <bool deny_only>
+class BooleanPermission final : public PermissionBase {
+ public:
+  void Apply(Environment* env,
+             std::span<const std::string> allow,
+             PermissionScope scope) override {
+    flag_ = true;
+  }
+
+  void Drop(Environment* env,
+            PermissionScope scope,
+            std::string_view param) override {
+    flag_ = deny_only;
+  }
+
+  bool is_granted(Environment* env,
+                  PermissionScope perm,
+                  std::string_view param) const override {
+    if constexpr (deny_only) {
+      return !flag_;
+    } else {
+      return flag_;
+    }
+  }
+
+ private:
+  bool flag_ = false;
+};
+
+// Once denied, the permission cannot be re-granted.
+using DenyOnlyPermission = BooleanPermission<true>;
+
+// Apply grants access, Drop revokes.
+using AllowRevokePermission = BooleanPermission<false>;
+
+}  // namespace node::permission
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_BOOLEAN_PERMISSION_H_