Deno permission prompts and --allow-run criticized as insecure
Original title: I’m not a fan of Deno’s security model (2024)
The author argues Deno's terminal-based permission prompts and PATH-based --allow-run can be abused by malicious code.
The blog post critiques Deno's permission system for using stdout/stdin to display prompts, which malicious code can manipulate via terminal colors or pre-fed input to bypass approvals. It also shows how --allow-run allows arbitrary executables by setting PATH to a malicious binary in the environment. The issues stem from attacker-controlled channels for security decisions.
- Terminal prompts can be hidden with non-standard escape codes.
- --allow-run bypasses via PATH manipulation to malicious binaries.
- Deno's prompt relies on in-band terminal API without filtering.
- Security-sensitive prompts should not use attacker-controlled stdout.
- No specific versions or CVEs mentioned.
Impact: Bypassing permission prompts and executing arbitrary commands
| Product | Affected |
|---|---|
| Deno | — |
- Vendors
- Deno
From the original article
8 min read at goldstein.lolthis has been bothering me for a while now, so I want to write down my thoughts so I can get it out of my head and move on. we’re gonna talk about how Deno approaches security, specifically with its permissions system, and why I think this approach
By goldstein.lol via ThinkChaos · goldstein.lol
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.