Skip to content

Commit

Permalink
fix(runtime): mitigate permission prompt stuffing
Browse files Browse the repository at this point in the history
Flush the tty's input buffer before reading to avoid already typed
characters from being treated as the answer to the permissions prompt.

Fixes denoland#9750.
  • Loading branch information
bnoordhuis committed Mar 17, 2021
1 parent bd961c3 commit bb8ab8d
Showing 1 changed file with 6 additions and 0 deletions.
6 changes: 6 additions & 0 deletions runtime/permissions.rs
Original file line number Diff line number Diff line change
Expand Up @@ -641,6 +641,12 @@ fn permission_prompt(message: &str) -> bool {
if !atty::is(atty::Stream::Stdin) || !atty::is(atty::Stream::Stderr) {
return false;
};
#[cfg(unix)]
unsafe {
if -1 == libc::tcflush(libc::STDIN_FILENO, libc::TCIFLUSH) {
return false;
}
}
let msg = format!(
"️{} {}. Grant? [g/d (g = grant, d = deny)] ",
PERMISSION_EMOJI, message
Expand Down

0 comments on commit bb8ab8d

Please sign in to comment.