3 ms·

But couldn’t the code you download easily just execute `rm -rf / --no-preserve-root`? The problem isn’t executing code from a random URL (which NPM still has);

But couldn’t the code you download easily just execute `rm -rf / --no-preserve-root`? The problem isn’t executing code from a random URL (which NPM still has); it’s that even though there’s a sandbox, there’s still ways out of it.

earthboundkid 6y ago
Not in Deno. To run that, you’d need to shell out, which Deno won’t let you do without explicitly granted permission at the CLI.
- tptacek 6y ago
  You can in Node, because Node bridges the whole platform standard library by default. Deno does the opposite: you have to opt programs into the platform capabilities you want to give them.
- gfxgirl 6y ago
  Which you will nearly always give permission to do anything useful.
jdminhbg 6y ago
Others have noted Deno has good protections around this, but I would add that it has those because running a package from NPM is in and of itself just executing code from a random URL, and that has caused plenty of problems in the past.