--experimental-permission breaks REPL

Version

20.5.0

Platform

any

Subsystem

permission model

What steps will reproduce the bug?

Open a REPL and start typing:

$ node --experimental-permission --allow-fs-read=/
> f

How often does it reproduce? Is there a required condition?

Always.

What is the expected behavior? Why is that the expected behavior?

No error.

What do you see instead?

Fatal error:

node:internal/readline/emitKeypressEvents:74
            throw err;
            ^

Error: Access to this API has been restricted
    at Session.connect (node:inspector:68:7)
    at sendInspectorCommand (node:internal/util/inspector:52:11)
    at getGlobalLexicalScopeNames (node:repl:1262:10)
    at REPLServer.complete (node:repl:1493:26)
    at REPLServer.completer (node:repl:783:5)
    at showCompletionPreview (node:internal/repl/utils:230:10)
    at showPreview (node:internal/repl/utils:384:7)
    at REPLServer.self._ttyWrite (node:repl:1020:9)
    at ReadStream.onkeypress (node:internal/readline/interface:264:20)
    at ReadStream.emit (node:events:514:28) {
  code: 'ERR_ACCESS_DENIED',
  permission: 'Inspector',
  resource: 'Connect'
}

Node.js v20.5.0

Additional information

Likely side effect of 34d92ed.

Hi, thanks for reporting it. I'm aware of this behaviour.

Question is: should we make the internal calls to the inspector possible/privileged, or do like when the inspector is unavailable (this would just be a new condition in

node/lib/internal/util/inspector.js

Lines 48 to 49 in a0f3ed8

    
           const { hasInspector } = internalBinding('config'); 
        
           if (!hasInspector) return onError();

)

I believe REPL shouldn't be available when the permission model is enabled. Please let me know if I'm wrong, but the REPL can create a new V8 isolate and bypass any permission in several ways. If we start supporting REPL, it would mean that we need to cover all those cases.

the REPL can create a new V8 isolate and bypass any permission in several ways

Can you elaborate?

the REPL can create a new V8 isolate and bypass any permission in several ways

Can you elaborate?

Basically, the same as 34d92ed fixes. I don't have a reproducible example because I'm not sure if that's possible. I'm just wondering if REPL can create a new V8 isolate, it means it could create without the experimental permission rules, right?

Anyway, I created the #48920.

lib,permission: drop repl autocomplete when pm enabled

Navigation Menu

Repository navigation

`--experimental-permission` breaks REPL #48884

Version

Platform

Subsystem

What steps will reproduce the bug?

How often does it reproduce? Is there a required condition?

What is the expected behavior? Why is that the expected behavior?

What do you see instead?

Additional information

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	const { hasInspector } = internalBinding('config');
	if (!hasInspector) return onError();

--experimental-permission breaks REPL #48884

Description

Version

Platform

Subsystem

What steps will reproduce the bug?

How often does it reproduce? Is there a required condition?

What is the expected behavior? Why is that the expected behavior?

What do you see instead?

Additional information

Activity

RafaelGSS commented on Jul 24, 2023

targos commented on Jul 24, 2023

RafaelGSS commented on Jul 24, 2023

targos commented on Jul 25, 2023

RafaelGSS commented on Jul 25, 2023

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

`--experimental-permission` breaks REPL #48884