"deno repl" has permissions by default?

[jaredkrinke]

I just tried and it seems like deno repl can write to the local file system by default. I was actually expecting the REPL to be constrained by the same "no permissions" default as running a script.

Am I the only one who expected the REPL to not have permissions by default?

In my case, I was testing out a random third party module (that seemed legit... but you never know) and thought that I could use the REPL to safely play with the module, prior to vetting the source code. I thought this would be one of the main uses of the REPL.

I'm curious to hear what others think, thanks!

[GJZwiers]

Maybe deno repl should implement a --prompt flag just like deno run and run with it by default? That way the REPL can still be used for quick prototyping, but also asks the user before granting for example net access to shady.site.

[twome]

Fully agree, this seems like a huge hazard for people that have come to assume safety by default. Also fully agree that an interactive prompt is the best way of going about granting permissions, with the caveat that there should definitely be some filtering step to make sure the user didn't hit "confirm" through a faulty keyboard double-send, or while mentally on autopilot (e.g. typing "y/yes" or "n/no" instead of a key already under-finger, or a debounce timer of 1-3 seconds, Firefox download -style) -- either that, or a highly visible warning at the start of the REPL session that all permissions are granted.

[rivy]

If there's no enthusiasm for changing current default behavior, how about a --default-deny (or -D) option that specifically limits permissions, by default, setting the default permission state to 'denied' (instead of 'granted' or 'prompt')?

It could be used for deno eval as well as deno repl to allow experimentation in limited permission environments.

[bartlomieju]

This problem will be addressed by #16795

[dsherret]

This has been fixed for some time now since 1.29. See https://deno.com/blog/v1.29#deno-repl-runs-with-no-permissions-by-default