4 ms·
This article made me wonder about packages calling user code. Using express' example, what if I don't want to give it filesystem access but need it in one of my
by Kaze404 5y ago
This article made me wonder about packages calling user code. Using express' example, what if I don't want to give it filesystem access but need it in one of my callbacks? Is the engine capable of distinguishing my (privileged) code from express' (unprivileged) code?
- kilovoltaire 5y agoYour callback would have your capabilities in scope, so your user code would still be able to do whatever you want, even when called by an untrusted library. I.e. something like: import capabilities; import fs; import someLibrary; const root = capabilities.claimRootToken(); someLibrary.onEvent(() => { fs.writeSync(root, ...); });
- Kaze404 5y agoMakes sense, thank you