cdxgen secure image - WIP

[prabhu]

Beginning of a cdxgen image flavor with built-in support for node.js permissions api.

[prabhu]

Node.js permissions api is quite basic.

process.permission.has("fs.read", "*") is always true even if the argument passed was not "*"

Consider the below code snippet for index.js

console.log("Read *", process.permission.has("fs.read", "*"));
console.log("Write *", process.permission.has("fs.write", "*"));

Correct output:

node --permission --allow-fs-read=index.js index.js
Read * false
Write * false

Incorrect output:

Passing * as references is interpreted as any.

node --permission --allow-fs-read="*.js" index.js
Read * true
Write * false

Recommendation to Node.js devs

Support glob patterns in both cli args and for references argument in the has api call.

scope attributes is limited.

There is no process.permission.has("addons") yet.

Recommendation to Node.js devs

All permission-related cli args should have an api for checking.

[prabhu]

Todo:

Need to experiment with a cdxgen-runner script, that invokes cdxgen.js with a dynamically generated NODE_OPTIONS value.

Example:

node bin/cdxgen-secure.js could do spawnSync with the environment variable NODE_OPTIONS=--permission --allow-fs-read=<input dir> --allow-fs-write=<path to bom>. Presence of sdkman, nvm, etc would make the logic a bit complex but not impossible.

[prabhu]

This was a mistake. This made fail-on-error the default for everyone. Apologies.