Socket
Socket
Sign inDemoInstall

fs-lock

Package Overview
Dependencies
0
Maintainers
1
Versions
4
Alerts
File Explorer

Advanced tools

Install Socket

Detect and block malicious and high-risk dependencies

Install

fs-lock

open_basedir and file_accessdir for Node


Version published
Maintainers
1
Weekly downloads
36
decreased by-72.93%

Weekly downloads

Readme

Source

fs-lock - open_basedir and file_accessdir support

This module implements open_basedir and file_accessdir inside of Node.js.

  • open_basedir: Validates that all require's are inside these directories.
  • file_accessdir: fs module methods are verified against these directories.

If a path is not validated, it will throw an error (either throw or err out the callback).

Usage

The goal for this module is to help when you are loading 3rd party modules and you need to restrict their access. A few examples of this come to mind:

  • CLI apps that work only in a certain dir and load 3rd party add-ons.
  • Running a Node.js server process and you rely on 3rd party code to read things from the fs
  • You are paranoid and want to make sure someone doesn't touch what they shouldn't

When you use this module, you require it and configure it in your controlled script. Then any call/require after that will be forced to use these predefined scoped directories.

Notes

Since this is written purely in Javascript, there are likely places that a user could override other methods to gain access. I have tried to prevent this with Object.freeze on the two Object's that are modified so that they can't be modified again.

Overrides

The constructor to fs-lock can not be called more than once, this means that once the settings are in place, they can not be overrided (except for testing, view code to see that).

The only overrides available for this are a set of Environment variables that are read at init time. Environment vars where chosen because if you have access to them you probably have access to the script too.

  • NODEJS_FILE_ACCESSDIR
  • NODEJS_OPEN_BASEDIR

Both of these support the standard : separator and will be auto processed when the module is loaded.

Example

//Do your startup code here, then lock it down with:
require('fs-lock')({
    'file_accessdir': [ __dirname, '/tmp' ],
    'open_basedir': [ '/usr/local/share/node_modules', __dirname ]
});


var fs = require('fs');

fs.readFile('/etc/passwd', function(err, data) {
    //this will throw an Access Denied error
});

Build Status

Build Status

Node Badge

NPM

Keywords

FAQs

Last updated on 12 Sep 2016

Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc