Skip to content

src,permission: do not grant cwd read access without entrypoint - #66645

Merged
nodejs-github-bot merged 2 commits into
nodejs:mainfrom
RafaelGSS:src-permission-do-not-grant-cwd-read-access-withou
Oct 20, 2026
Merged

src,permission: do not grant cwd read access without entrypoint#66645
nodejs-github-bot merged 2 commits into
nodejs:mainfrom
RafaelGSS:src-permission-do-not-grant-cwd-read-access-withou

Conversation

@RafaelGSS

@RafaelGSS RafaelGSS commented Oct 10, 2026

Copy link
Copy Markdown
Member

src,permission: do not grant cwd read access without entrypoint

@RafaelGSS
src,permission: do not grant cwd read access without entrypoint
77600e4 
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
@nodejs-github-bot

nodejs-github-bot commented Oct 10, 2026

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/security-wg

@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. labels Oct 10, 2026
@codecov

codecov Bot commented Oct 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 0% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 90.48%. Comparing base (dd9777b) to head (f18fd0a).
⚠️ Report is 163 commits behind head on main.

Files with missing lines Patch % Lines
src/env.cc 0.00% 0 Missing and 1 partial ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##             main   #66645      +/-   ##
==========================================
- Coverage   92.78%   90.48%   -2.31%     
==========================================
  Files         422      791     +369     
  Lines      193692   277097   +83405     
  Branches    29881    53274   +23393     
==========================================
+ Hits       179714   250721   +71007     
- Misses      13650    16775    +3125     
- Partials      328     9601    +9273
Files with missing lines Coverage Δ
src/env.cc 84.16% <0.00%> (ø)

... and 509 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@RafaelGSS
src: format permission entrypoint check
f18fd0a 
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
@RafaelGSS RafaelGSS added author ready PRs with CI started, the required approvals, and no outstanding review comments. permission Issues and PRs related to the Permission Model. request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. labels Oct 11, 2026
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Oct 11, 2026
@nodejs-github-bot

nodejs-github-bot commented Oct 11, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/78309/

@nodejs-github-bot

nodejs-github-bot commented Oct 11, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/78314/

@RafaelGSS RafaelGSS added the commit-queue PRs queued for automated landing through the Commit Queue. label Oct 19, 2026
@nodejs-github-bot nodejs-github-bot added commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. and removed commit-queue PRs queued for automated landing through the Commit Queue. labels Oct 19, 2026
@nodejs-github-bot

nodejs-github-bot commented Oct 19, 2026

Copy link
Copy Markdown
Collaborator

Commit Queue failed

This pull request has multiple commits, but no landing policy was selected.

Add commit-queue-squash PRs the Commit Queue should land as one squashed commit. to land it as one commit, or commit-queue-rebase PRs the Commit Queue should land as multiple self-contained commits. to land the commits separately.

The pull request was removed from the Commit Queue and labeled commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. . After resolving the failure, remove that label and add commit-queue PRs queued for automated landing through the Commit Queue. to retry.

Full Commit Queue output 
�[36m⠋�[39m Loading data for nodejs/node/pull/66645
�[36m⠋�[39m Loading data for nodejs/node/pull/66645
�[36m⠋�[39m Getting collaborator contacts from README of nodejs/node
�[36m⠋�[39m Getting PR from nodejs/node/pull/66645
�[36m⠋�[39m Getting reviews from nodejs/node/pull/66645
�[36m⠋�[39m Getting comments from nodejs/node/pull/66645
�[36m⠋�[39m Getting commits from nodejs/node/pull/66645
✔  Done loading data for nodejs/node/pull/66645
----------------------------------- PR info ------------------------------------
Title      src,permission: do not grant cwd read access without entrypoint (#66645)
Author     Rafael Gonzaga <rafael.nunu@hotmail.com> (@RafaelGSS)
Branch     RafaelGSS:src-permission-do-not-grant-cwd-read-access-withou -> nodejs:main
Labels     c++, author ready, needs-ci, commit-queue, permission
Commits    2
 - src,permission: do not grant cwd read access without entrypoint
 - src: format permission entrypoint check
Committers 1
 - RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/66645
Reviewed-By: James M Snell <jasnell@gmail.com>
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/66645
Reviewed-By: James M Snell <jasnell@gmail.com>
--------------------------------------------------------------------------------
   ℹ  This PR was created on Sat, 10 Oct 2026 16:21:15 GMT
   ✔  Approvals: 1
   ✔  - James M Snell (@jasnell) (TSC): https://github.com/nodejs/node/pull/66645#pullrequestreview-5481684902
   ✔  Last GitHub CI successful
   ℹ  Last Full PR CI on 2026-10-11T14:38:26Z: https://ci.nodejs.org/job/node-test-pull-request/78314/
�[36m⠙�[39m Querying data for job/node-test-pull-request/78314/
�[36m⠙�[39m Querying data for job/node-test-pull-request/78314/
�[36m⠙�[39m Querying API for job/node-test-pull-request/78314/
   ✔  Last Jenkins CI successful
--------------------------------------------------------------------------------
�[36m⠹�[39m Querying API for job/node-test-pull-request/78314/
   ✔  No git cherry-pick in progress
   ✔  No git am in progress
   ✔  No git rebase in progress
--------------------------------------------------------------------------------
�[36m⠹�[39m Querying API for job/node-test-pull-request/78314/
�[36m⠹�[39m Bringing origin/main up to date...
From https://github.com/nodejs/node
 * branch                  main       -> FETCH_HEAD
✔  origin/main is now up-to-date
�[36m⠸�[39m Downloading patch for 66645
�[36m⠸�[39m Downloading patch for 66645
From https://github.com/nodejs/node
 * branch                  refs/pull/66645/merge -> FETCH_HEAD
✔  Fetched commits as 06c0e46c814d..f18fd0aeb7ee
--------------------------------------------------------------------------------
[main 14aaac18e1] src,permission: do not grant cwd read access without entrypoint
 Author: RafaelGSS <rafael.nunu@hotmail.com>
 Date: Fri Oct 9 08:25:24 2026 -0300
 2 files changed, 19 insertions(+), 1 deletion(-)
[main d02d5ed83f] src: format permission entrypoint check
 Author: RafaelGSS <rafael.nunu@hotmail.com>
 Date: Sat Oct 10 18:23:11 2026 -0300
 1 file changed, 1 insertion(+), 2 deletions(-)
   ✔  Patches applied
There are 2 commits in the PR. Attempting autorebase.
(node:466) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.
(Use `node --trace-deprecation ...` to show where the warning was created)
Rebasing (2/4)
Executing: git node land --amend --yes
--------------------------------- New Message ----------------------------------
src,permission: do not grant cwd read access without entrypoint

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/66645
Reviewed-By: James M Snell <jasnell@gmail.com>
--------------------------------------------------------------------------------
[detached HEAD 00e828e229] src,permission: do not grant cwd read access without entrypoint
 Author: RafaelGSS <rafael.nunu@hotmail.com>
 Date: Fri Oct 9 08:25:24 2026 -0300
 2 files changed, 19 insertions(+), 1 deletion(-)
Rebasing (3/4)
Rebasing (4/4)
Executing: git node land --amend --yes
--------------------------------- New Message ----------------------------------
src: format permission entrypoint check

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/66645
Reviewed-By: James M Snell <jasnell@gmail.com>
--------------------------------------------------------------------------------
[detached HEAD fa2c51bba7] src: format permission entrypoint check
 Author: RafaelGSS <rafael.nunu@hotmail.com>
 Date: Sat Oct 10 18:23:11 2026 -0300
 1 file changed, 1 insertion(+), 2 deletions(-)
Successfully rebased and updated refs/heads/main.
--------------------------------------------------------------------------------
   ℹ  Add `commit-queue-squash` label to land the PR as one commit, or `commit-queue-rebase` to land as separate commits.

View workflow run

@RafaelGSS RafaelGSS added commit-queue PRs queued for automated landing through the Commit Queue. commit-queue-squash PRs the Commit Queue should land as one squashed commit. and removed commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. labels Oct 19, 2026
@nodejs-github-bot nodejs-github-bot added commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. and removed commit-queue PRs queued for automated landing through the Commit Queue. labels Oct 19, 2026
@nodejs-github-bot

nodejs-github-bot commented Oct 19, 2026

Copy link
Copy Markdown
Collaborator

Commit Queue failed

✖ GitHub CI is still running

The pull request was removed from the Commit Queue and labeled commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. . After resolving the failure, remove that label and add commit-queue PRs queued for automated landing through the Commit Queue. to retry.

Full Commit Queue output 
�[36m⠋�[39m Loading data for nodejs/node/pull/66645
�[36m⠋�[39m Loading data for nodejs/node/pull/66645
�[36m⠋�[39m Getting collaborator contacts from README of nodejs/node
�[36m⠋�[39m Getting PR from nodejs/node/pull/66645
�[36m⠋�[39m Getting reviews from nodejs/node/pull/66645
�[36m⠋�[39m Getting comments from nodejs/node/pull/66645
�[36m⠋�[39m Getting commits from nodejs/node/pull/66645
✔  Done loading data for nodejs/node/pull/66645
----------------------------------- PR info ------------------------------------
Title      src,permission: do not grant cwd read access without entrypoint (#66645)
Author     Rafael Gonzaga <rafael.nunu@hotmail.com> (@RafaelGSS)
Branch     RafaelGSS:src-permission-do-not-grant-cwd-read-access-withou -> nodejs:main
Labels     c++, author ready, needs-ci, commit-queue, commit-queue-squash, permission
Commits    2
 - src,permission: do not grant cwd read access without entrypoint
 - src: format permission entrypoint check
Committers 1
 - RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/66645
Reviewed-By: James M Snell <jasnell@gmail.com>
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/66645
Reviewed-By: James M Snell <jasnell@gmail.com>
--------------------------------------------------------------------------------
   ℹ  This PR was created on Sat, 10 Oct 2026 16:21:15 GMT
   ✔  Approvals: 1
   ✔  - James M Snell (@jasnell) (TSC): https://github.com/nodejs/node/pull/66645#pullrequestreview-5481684902
   ✖  GitHub CI is still running
   ℹ  Last Full PR CI on 2026-10-19T13:03:34Z: https://ci.nodejs.org/job/node-test-pull-request/78314/
�[36m⠙�[39m Querying data for job/node-test-pull-request/78314/
�[36m⠙�[39m Querying data for job/node-test-pull-request/78314/
�[36m⠙�[39m Querying API for job/node-test-pull-request/78314/
   ✔  Last Jenkins CI successful
--------------------------------------------------------------------------------
�[36m⠹�[39m Querying API for job/node-test-pull-request/78314/
   ✔  Aborted `git node land` session in /home/runner/work/node/node/.ncu

View workflow run

@RafaelGSS RafaelGSS added commit-queue PRs queued for automated landing through the Commit Queue. and removed commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. labels Oct 20, 2026
@nodejs-github-bot
nodejs-github-bot merged commit 967f0a7 into nodejs:main Oct 20, 2026
105 of 106 checks passed
@nodejs-github-bot

nodejs-github-bot commented Oct 20, 2026

Copy link
Copy Markdown
Collaborator

Landed in 967f0a7

@nodejs-github-bot nodejs-github-bot removed the commit-queue PRs queued for automated landing through the Commit Queue. label Oct 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jasnell jasnell jasnell approved these changes

Assignees

No one assigned

Labels

author ready PRs with CI started, the required approvals, and no outstanding review comments. c++ Issues and PRs that require attention from people who are familiar with C++. commit-queue-squash PRs the Commit Queue should land as one squashed commit. needs-ci PRs that need a full CI run. permission Issues and PRs related to the Permission Model.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@RafaelGSS @nodejs-github-bot @jasnell