give additional rights to the run method
+23
-5
+23
-5
worker/worker.go
+23
-5
worker/worker.go
···
83
83
84
84
var upgrader = websocket.Upgrader{} // use default options
85
85
86
-
func (me *Worker) DenoArgs(deno string) []string {
86
+
type SandboxMethod string
87
+
88
+
var (
89
+
SandboxMethodFetch SandboxMethod = "fetch"
90
+
SandboxMethodRun SandboxMethod = "run"
91
+
)
92
+
93
+
func (me *Worker) DenoArgs(deno string, method SandboxMethod) []string {
87
94
args := []string{
88
95
"--allow-net",
89
96
"--allow-import",
···
115
122
args = append(
116
123
args,
117
124
fmt.Sprintf("--allow-read=%s,%s,%s", appDir, deno, npmCache),
118
-
fmt.Sprintf("--allow-write=%s", me.App.DataDir()),
119
125
)
120
126
127
+
if method == SandboxMethodRun {
128
+
args = append(args, fmt.Sprintf("--allow-write=%s", me.App.Dir()))
129
+
} else {
130
+
args = append(args, fmt.Sprintf("--allow-write=%s", me.App.DataDir()))
131
+
}
132
+
121
133
return args
122
134
}
123
135
···
133
145
args = append(
134
146
args,
135
147
fmt.Sprintf("--allow-read=%s,%s,%s,%s", appDir, target, deno, npmCache),
136
-
fmt.Sprintf("--allow-write=%s,%s", me.App.DataDir(), filepath.Join(target, "data")),
137
148
)
149
+
150
+
if method == SandboxMethodRun {
151
+
args = append(args, fmt.Sprintf("--allow-write=%s,%s", me.App.Dir(), target))
152
+
} else {
153
+
args = append(args, fmt.Sprintf("--allow-write=%s,%s", me.App.DataDir(), filepath.Join(target, "data")))
154
+
}
155
+
138
156
return args
139
157
}
140
158
···
151
169
}
152
170
153
171
args := []string{"run"}
154
-
args = append(args, me.DenoArgs(deno)...)
172
+
args = append(args, me.DenoArgs(deno, SandboxMethodFetch)...)
155
173
input := strings.Builder{}
156
174
encoder := json.NewEncoder(&input)
157
175
encoder.SetEscapeHTML(false)
···
462
480
}
463
481
464
482
denoArgs := []string{"run"}
465
-
denoArgs = append(denoArgs, me.DenoArgs(deno)...)
483
+
denoArgs = append(denoArgs, me.DenoArgs(deno, SandboxMethodRun)...)
466
484
467
485
payload := strings.Builder{}
468
486
encoder := json.NewEncoder(&payload)