Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Installed scripts can't know their own name #5725

Open
umbopepato opened this issue May 21, 2020 · 12 comments
Open

Installed scripts can't know their own name #5725

umbopepato opened this issue May 21, 2020 · 12 comments
Labels
cli related to cli/ dir suggestion suggestions for new features (yet to be agreed)

Comments

@umbopepato
Copy link

umbopepato commented May 21, 2020

There's no way for a deno installed script to know its own name.

$ deno install -n cmdname https://url.to/script.ts
                  ^^^^^^^

This has a significant impact on CLI modules, that may need it for various reasons such as showing help messages and usage examples, registering shell completions etc.

Are there any plans to introduce this functionality somehow?

@nayeemrmn

This comment has been minimized.

@umbopepato
Copy link
Author

That's right @nayeemrmn, I updated the issue.

@nayeemrmn
Copy link
Collaborator

nayeemrmn commented May 21, 2020

Well if the use case is okay with everyone then a solution would be to inject it into the runtime via a hidden command line flag set by the auto-generated script:

#!/bin/sh
# generated by deno install
deno "run" "--installed-path" "$0" "https://url.to/script.ts" "$@"
// namespace Deno {
//   installedPath: string | null;
// }
console.log(Deno.installedPath); // "/home/nayeem/.deno/bin/cmdname"

EDIT:
We can't leak the whole path of the script without a permission wall... I guess we should limit it to the name:

// namespace Deno {
//   installedName: string | null;
// }
console.log(Deno.installedName); // "cmdname"

@c4spar
Copy link

c4spar commented May 22, 2020

It would be also nice, if there is a way to get the file name from a script which isn't installed with deno install but executed with deno run, without the need to set an environment variable or a cli flag.

@nayeemrmn

This comment has been minimized.

@c4spar

This comment has been minimized.

@nayeemrmn

This comment has been minimized.

@sholladay
Copy link

I think it would be nice if the script name were available via Deno.scriptName or similar. Would also be useful to have Deno.rawArgs which would include the full command used to execute the script.

@bartlomieju bartlomieju added cli related to cli/ dir suggestion suggestions for new features (yet to be agreed) labels May 26, 2020
@jsejcksn
Copy link
Contributor

Consideration: What are the security and privacy implications of these kinds of introspection?

@umbopepato
Copy link
Author

@jsejcksn one could be that if a script knows the location of its launcher it can grant itself more permissions by rewriting it (only requires --allow-write). And guessing the full path of the launcher from the script name, if installed in the default --root, is not that difficult knowing some env variables like DENO_INSTALL or HOME.

Don't know how viable it is, but maybe a possible security measure could be to exclude bin folders/files from write permissions unless explicitly listed in the flag?

# Can write everywhere except to path/to/.deno/bin/
$ deno run --allow-write myscript.ts

# Can write to path/to/.deno/bin/
$ deno run --allow-write=path/to/.deno/bin/ myscript.ts

Or maybe a file system permission wall?

Also, this may already be a concern since many cli script authors recommend an install name on their documentation so in most cases they already have all the info to infer the installation path.

@noahbrenner
Copy link

Of course, if a script can read the filesystem, it can probably find the script location (even if inefficiently) by greping for a unique string the script contains.

For the CLI use case, the most valuable information would just be the installed executable name itself. I don't imagine the full path to the script would be needed most of the time.

@rivy
Copy link
Contributor

rivy commented Jan 19, 2021

For the CLI use case, the most valuable information would just be the installed executable name itself. I don't imagine the full path to the script would be needed most of the time.

Actually the full path is used quite frequently for associated CLI/executable data such as config files, etc.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
cli related to cli/ dir suggestion suggestions for new features (yet to be agreed)
Projects
None yet
Development

No branches or pull requests

8 participants