-
-
Notifications
You must be signed in to change notification settings - Fork 33k
Description
What is the problem this feature will solve?
When using (for example) --allow-child-process
, NodeJS (correctly) warns that this can allow bypassing the --permission
protection:
(node:16778) SecurityWarning: The flag --allow-child-process must be used with extreme caution. It could invalidate the permission model.
(Usenode --trace-warnings ...
to show where the warning was created)
This warning is good, but if the developer is still confident in their setup, it would be useful to be able to suppress it without suppressing other warnings. Currently the only way to suppress this warning is with --disable-warning=SecurityWarning
, which is far too broad.
What is the feature you are proposing to solve the problem?
--disable-warning
already accepts code
s as well as types, but this particular warning has no code
set:
node/lib/internal/process/pre_execution.js
Lines 588 to 590 in 96a749b
process.emitWarning( | |
`The flag ${flag} must be used with extreme caution. ` + | |
'It could invalidate the permission model.', 'SecurityWarning'); |
I'm suggesting picking a suitable code for this warning and adding it as the third argument to that call, perhaps something like PERM0001
(though I don't know the naming convention for these codes).
What alternatives have you considered?
No response
Metadata
Metadata
Assignees
Labels
Type
Projects
Status