Skip to content

permission: enforce addon permission in GetLinkedBinding - #65432

Merged
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
RafaelGSS:permission-linked-binding-addon
Aug 24, 2026
Merged

permission: enforce addon permission in GetLinkedBinding#65432
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
RafaelGSS:permission-linked-binding-addon

Conversation

@RafaelGSS

@RafaelGSS RafaelGSS commented Aug 20, 2026

Copy link
Copy Markdown
Member

process._linkedBinding() did not enforce the Addon permission check used by process.dlopen(). Apply the same permission check before resolving a linked binding, including after process.permission.drop('addon').

@RafaelGSS
permission: enforce addon permission in GetLinkedBinding
3d2d0fa 
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
@nodejs-github-bot

nodejs-github-bot commented Aug 20, 2026

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/security-wg

@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. labels Aug 20, 2026
@codecov

codecov Bot commented Aug 20, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 0% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 90.12%. Comparing base (e7904d4) to head (3d2d0fa).
⚠️ Report is 446 commits behind head on main.

Files with missing lines Patch % Lines
src/node_binding.cc 0.00% 0 Missing and 1 partial ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##             main   #65432      +/-   ##
==========================================
- Coverage   90.14%   90.12%   -0.03%     
==========================================
  Files         746      752       +6     
  Lines      242764   252322    +9558     
  Branches    45739    47449    +1710     
==========================================
+ Hits       218848   227407    +8559     
- Misses      15426    16217     +791     
- Partials     8490     8698     +208
Files with missing lines Coverage Δ
src/node_binding.cc 82.10% <0.00%> (-0.33%) ⬇️

... and 250 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@RafaelGSS RafaelGSS added author ready PRs with CI started, the required approvals, and no outstanding review comments. request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. permission Issues and PRs related to the Permission Model. labels Aug 20, 2026
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Aug 20, 2026
@nodejs-github-bot

nodejs-github-bot commented Aug 20, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/76067/

@nodejs-github-bot

nodejs-github-bot commented Aug 23, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/76268/

@RafaelGSS RafaelGSS added the commit-queue PRs queued for automated landing through the Commit Queue. label Aug 24, 2026
@nodejs-github-bot
nodejs-github-bot merged commit 46a7dbd into nodejs:main Aug 24, 2026
87 checks passed
@nodejs-github-bot

nodejs-github-bot commented Aug 24, 2026

Copy link
Copy Markdown
Collaborator

Landed in 46a7dbd

@nodejs-github-bot nodejs-github-bot removed the commit-queue PRs queued for automated landing through the Commit Queue. label Aug 24, 2026
aduh95 pushed a commit that referenced this pull request Aug 25, 2026
@RafaelGSS @aduh95
permission: enforce addon permission in GetLinkedBinding
f8831fc 
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: #65432
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Beth Griggs <bethanyngriggs@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
aduh95 pushed a commit that referenced this pull request Aug 25, 2026
@RafaelGSS @aduh95
permission: enforce addon permission in GetLinkedBinding
ac3c412 
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: #65432
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Beth Griggs <bethanyngriggs@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
@github-actions github-actions Bot mentioned this pull request Aug 25, 2026
Merged
aduh95 pushed a commit that referenced this pull request Aug 27, 2026
@RafaelGSS @aduh95
permission: enforce addon permission in GetLinkedBinding
b85ff96 
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: #65432
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Beth Griggs <bethanyngriggs@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
@github-actions github-actions Bot mentioned this pull request Sep 7, 2026
Merged
aduh95 pushed a commit that referenced this pull request Sep 7, 2026
@RafaelGSS @aduh95
permission: enforce addon permission in GetLinkedBinding
2cfc441 
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: #65432
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Beth Griggs <bethanyngriggs@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
aduh95 pushed a commit that referenced this pull request Sep 7, 2026
@RafaelGSS @aduh95
permission: enforce addon permission in GetLinkedBinding
1722dda 
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: #65432
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Beth Griggs <bethanyngriggs@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
MarshallOfSound added a commit to electron/electron that referenced this pull request Sep 9, 2026
@MarshallOfSound @claude
fix(patch): permission: enforce addon permission in GetLinkedBinding
3f0a098 
Upstream now throws ERR_ACCESS_DENIED from process._linkedBinding() when
the permission model is enabled without --allow-addons. Electron's own
bootstrap reaches all of its built-in modules through linked bindings,
so `electron --permission` under ELECTRON_RUN_AS_NODE could no longer
initialise Electron's Node.js integration. Add a patch exempting the
electron_* bindings from the addon check; process.dlopen() and any
other linked-binding name keep the upstream behaviour.

Ref: nodejs/node#65432

Co-Authored-By: Claude <noreply@anthropic.com>
MarshallOfSound added a commit to electron/electron that referenced this pull request Sep 9, 2026
@MarshallOfSound @claude
fix(patch): permission: enforce addon permission in GetLinkedBinding
f2a548f 
Upstream now throws ERR_ACCESS_DENIED from process._linkedBinding() when
the permission model is enabled without --allow-addons. Electron's own
bootstrap reaches all of its built-in modules through linked bindings,
so `electron --permission` under ELECTRON_RUN_AS_NODE could no longer
initialise Electron's Node.js integration. Add a patch exempting the
electron_* bindings from the addon check; process.dlopen() and any
other linked-binding name keep the upstream behaviour.

Ref: nodejs/node#65432

Co-Authored-By: Claude <noreply@anthropic.com>
MarshallOfSound added a commit to electron/electron that referenced this pull request Sep 9, 2026
@MarshallOfSound @claude
fix(patch): permission: enforce addon permission in GetLinkedBinding
6c6e93a 
Upstream now throws ERR_ACCESS_DENIED from process._linkedBinding() when
the permission model is enabled without --allow-addons. Electron's own
bootstrap reaches all of its built-in modules through linked bindings,
so `electron --permission` under ELECTRON_RUN_AS_NODE could no longer
initialise Electron's Node.js integration. Add a patch exempting the
electron_* bindings from the addon check; process.dlopen() and any
other linked-binding name keep the upstream behaviour.

Ref: nodejs/node#65432

Co-Authored-By: Claude <noreply@anthropic.com>
MarshallOfSound added a commit to electron/electron that referenced this pull request Sep 9, 2026
@MarshallOfSound @claude
fix(patch): permission: enforce addon permission in GetLinkedBinding
30658c9 
Upstream now throws ERR_ACCESS_DENIED from process._linkedBinding() when
the permission model is enabled without --allow-addons. Electron's own
bootstrap reaches all of its built-in modules through linked bindings,
so `electron --permission` under ELECTRON_RUN_AS_NODE could no longer
initialise Electron's Node.js integration. Add a patch exempting the
electron_* bindings from the addon check; process.dlopen() and any
other linked-binding name keep the upstream behaviour.

Ref: nodejs/node#65432

Co-Authored-By: Claude <noreply@anthropic.com>
ckerr pushed a commit to electron/electron that referenced this pull request Sep 9, 2026
@electron-roller @MarshallOfSound @claude
chore: bump node to v24.21.0 (45-x-y) (#53780)
d6c54a1 
* chore: bump node in DEPS to v24.21.0

* fix(patch): module: report unreadable package.json

Upstream now keeps the ReadFileSync error code and throws
ERR_INVALID_PACKAGE_CONFIG for anything other than ENOENT/ENOTDIR/EISDIR.
Route the ASAR override through the same read_error path and report a
missing archive entry as UV_ENOENT so it is still negatively cached
rather than surfaced as a read failure.

Ref: nodejs/node#65223

Co-Authored-By: Claude <noreply@anthropic.com>

* chore: remove upstreamed patch

* chore: update patches (trivial only)

* fix(patch): skip OpenSSL default-config test with BoringSSL

Ref: nodejs/node#64949

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(patch): permission: enforce addon permission in GetLinkedBinding

Upstream now throws ERR_ACCESS_DENIED from process._linkedBinding() when
the permission model is enabled without --allow-addons. Electron's own
bootstrap reaches all of its built-in modules through linked bindings,
so `electron --permission` under ELECTRON_RUN_AS_NODE could no longer
initialise Electron's Node.js integration. Add a patch exempting the
electron_* bindings from the addon check; process.dlopen() and any
other linked-binding name keep the upstream behaviour.

Ref: nodejs/node#65432

Co-Authored-By: Claude <noreply@anthropic.com>

* chore: update filenames.auto.gni

---------

Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>
Co-authored-by: Sam Attard <sattard@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
ckerr pushed a commit to electron/electron that referenced this pull request Sep 9, 2026
@electron-roller @MarshallOfSound @claude
chore: bump node to v24.21.0 (43-x-y) (#53777)
39c5ed0 
* chore: bump node in DEPS to v24.21.0

* fix(patch): module: report unreadable package.json

Upstream now keeps the ReadFileSync error code and throws
ERR_INVALID_PACKAGE_CONFIG for anything other than ENOENT/ENOTDIR/EISDIR.
Route the ASAR override through the same read_error path and report a
missing archive entry as UV_ENOENT so it is still negatively cached
rather than surfaced as a read failure.

Ref: nodejs/node#65223

Co-Authored-By: Claude <noreply@anthropic.com>

* chore: update patches (trivial only)

* fix(patch): skip OpenSSL default-config test with BoringSSL

Ref: nodejs/node#64949

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(patch): permission: enforce addon permission in GetLinkedBinding

Upstream now throws ERR_ACCESS_DENIED from process._linkedBinding() when
the permission model is enabled without --allow-addons. Electron's own
bootstrap reaches all of its built-in modules through linked bindings,
so `electron --permission` under ELECTRON_RUN_AS_NODE could no longer
initialise Electron's Node.js integration. Add a patch exempting the
electron_* bindings from the addon check; process.dlopen() and any
other linked-binding name keep the upstream behaviour.

Ref: nodejs/node#65432

Co-Authored-By: Claude <noreply@anthropic.com>

* chore: update filenames.auto.gni

---------

Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>
Co-authored-by: Sam Attard <sattard@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
ckerr pushed a commit to electron/electron that referenced this pull request Sep 9, 2026
@electron-roller @MarshallOfSound @claude
chore: bump node to v24.21.0 (44-x-y) (#53779)
effe589 
* chore: bump node in DEPS to v24.21.0

* fix(patch): module: report unreadable package.json

Upstream now keeps the ReadFileSync error code and throws
ERR_INVALID_PACKAGE_CONFIG for anything other than ENOENT/ENOTDIR/EISDIR.
Route the ASAR override through the same read_error path and report a
missing archive entry as UV_ENOENT so it is still negatively cached
rather than surfaced as a read failure.

Ref: nodejs/node#65223

Co-Authored-By: Claude <noreply@anthropic.com>

* chore: update patches (trivial only)

* fix(patch): skip OpenSSL default-config test with BoringSSL

Ref: nodejs/node#64949

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(patch): permission: enforce addon permission in GetLinkedBinding

Upstream now throws ERR_ACCESS_DENIED from process._linkedBinding() when
the permission model is enabled without --allow-addons. Electron's own
bootstrap reaches all of its built-in modules through linked bindings,
so `electron --permission` under ELECTRON_RUN_AS_NODE could no longer
initialise Electron's Node.js integration. Add a patch exempting the
electron_* bindings from the addon check; process.dlopen() and any
other linked-binding name keep the upstream behaviour.

Ref: nodejs/node#65432

Co-Authored-By: Claude <noreply@anthropic.com>

* chore: update filenames.auto.gni

---------

Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>
Co-authored-by: Sam Attard <sattard@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
dsanders11 pushed a commit to electron/electron that referenced this pull request Sep 9, 2026
@electron-roller @MarshallOfSound @claude
chore: bump node to v24.21.0 (main) (#53782)
7ae6e6a 
* chore: bump node in DEPS to v24.21.0

* fix(patch): module: report unreadable package.json

Upstream now keeps the ReadFileSync error code and throws
ERR_INVALID_PACKAGE_CONFIG for anything other than ENOENT/ENOTDIR/EISDIR.
Route the ASAR override through the same read_error path and report a
missing archive entry as UV_ENOENT so it is still negatively cached
rather than surfaced as a read failure.

Ref: nodejs/node#65223

Co-Authored-By: Claude <noreply@anthropic.com>

* chore: remove upstreamed patch

* chore: update patches (trivial only)

* fix(patch): skip OpenSSL default-config test with BoringSSL

Ref: nodejs/node#64949

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(patch): permission: enforce addon permission in GetLinkedBinding

Upstream now throws ERR_ACCESS_DENIED from process._linkedBinding() when
the permission model is enabled without --allow-addons. Electron's own
bootstrap reaches all of its built-in modules through linked bindings,
so `electron --permission` under ELECTRON_RUN_AS_NODE could no longer
initialise Electron's Node.js integration. Add a patch exempting the
electron_* bindings from the addon check; process.dlopen() and any
other linked-binding name keep the upstream behaviour.

Ref: nodejs/node#65432

Co-Authored-By: Claude <noreply@anthropic.com>

* chore: update filenames.auto.gni

---------

Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>
Co-authored-by: Sam Attard <sattard@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jasnell jasnell jasnell approved these changes
@BethGriggs BethGriggs BethGriggs approved these changes
@legendecas legendecas legendecas approved these changes

Assignees

No one assigned

Labels

author ready PRs with CI started, the required approvals, and no outstanding review comments. c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. permission Issues and PRs related to the Permission Model.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@RafaelGSS @nodejs-github-bot @jasnell @BethGriggs @legendecas