feat(permission): support suffix wildcards in --allow-env flag

cli/args/flags.rs

@@ -1,5 +1,7 @@
 // Copyright 2018-2024 the Deno authors. All rights reserved. MIT license.
-
+use super::flags_net;
+use crate::args::resolve_no_prompt;
+use crate::util::fs::canonicalize_path;
 use std::collections::HashSet;
 use std::env;
 use std::ffi::OsString;
@@ -36,15 +38,11 @@ use deno_runtime::colors;
 use deno_runtime::deno_permissions::parse_sys_kind;
 use deno_runtime::deno_permissions::PermissionsOptions;
 use log::debug;
+use log::error;
 use log::Level;
 use serde::Deserialize;
 use serde::Serialize;
 
-use crate::args::resolve_no_prompt;
-use crate::util::fs::canonicalize_path;
-
-use super::flags_net;
-
 #[derive(Clone, Debug, Default, Eq, PartialEq)]
 pub enum ConfigFlag {
   #[default]
@@ -4956,7 +4954,18 @@ fn permission_args_parse(flags: &mut Flags, matches: &mut ArgMatches) {
   }
 
   if let Some(env_wl) = matches.remove_many::<String>("allow-env") {
-    flags.permissions.allow_env = Some(env_wl.collect());
+    let env_permissions: Vec<String> = env_wl.collect();
+    for env_var in &env_permissions {
+      if env_var.contains('*') {
+        if let Err(e) =
+          deno_runtime::deno_permissions::add_wildcard_permission(env_var)
+        {
+          error!("Failed to add wildcard permission: {}", e);
+        }
+      }
+    }
+
+    flags.permissions.allow_env = Some(env_permissions);
     debug!("env allowlist: {:#?}", &flags.permissions.allow_env);
   }
 

cli/main.rs

@@ -395,8 +395,14 @@ pub fn main() {
   };
 
   match create_and_run_current_thread_with_maybe_metrics(future) {
-    Ok(exit_code) => std::process::exit(exit_code),
-    Err(err) => exit_for_error(err),
+    Ok(exit_code) => {
+      let _ = deno_runtime::deno_permissions::clear_wildcard_permissions();
+      std::process::exit(exit_code)
+    }
+    Err(err) => {
+      let _ = deno_runtime::deno_permissions::clear_wildcard_permissions();
+      exit_for_error(err)
+    }
   }
 }
 

runtime/permissions/lib.rs

@@ -18,6 +18,7 @@ use deno_core::url::Url;
 use deno_core::ModuleSpecifier;
 use deno_terminal::colors;
 use fqdn::FQDN;
+use log::error;
 use once_cell::sync::Lazy;
 use std::borrow::Cow;
 use std::collections::HashSet;
@@ -32,6 +33,7 @@ use std::path::PathBuf;
 use std::str::FromStr;
 use std::string::ToString;
 use std::sync::Arc;
+use std::sync::RwLock;
 
 pub mod prompter;
 use prompter::permission_prompt;
@@ -181,6 +183,29 @@ impl PermissionState {
             .map(|info| { format!(" to {info}") })
             .unwrap_or_default(),
         );
+
+        if name == "env" {
+          let env_var_name = info()
+            .map(|info| {
+              let info_str = info.trim_start_matches('"').trim_end_matches('"');
+              info_str.to_string()
+            })
+            .unwrap_or_default();
+          for env_var in crate::get_wildcard_permissions() {
+            if let Some(suffix) = env_var.strip_prefix('*') {
+              if env_var_name.ends_with(suffix) {
+                return (Ok(()), true, false);
+              }
+            } else if let Some(prefix) = env_var.strip_suffix('*') {
+              if env_var_name.starts_with(prefix) {
+                return (Ok(()), true, false);
+              }
+            } else if env_var.contains('*') {
+              return (Ok(()), true, false);
+            }
+          }
+        }
+
         match permission_prompt(&msg, name, api_name, true) {
           PromptResponse::Allow => {
             Self::log_perm_access(name, info);
@@ -2317,6 +2342,36 @@ pub fn is_standalone() -> bool {
   IS_STANDALONE.is_raised()
 }
 
+static WILDCARD_PERMISSIONS: Lazy<RwLock<Vec<String>>> =
+  Lazy::new(|| RwLock::new(Vec::new()));
+
+pub fn add_wildcard_permission(permission: &str) -> Result<(), String> {
+  let mut permissions = WILDCARD_PERMISSIONS.write().map_err(|e| {
+    error!("Failed to acquire write lock: {}", e);
+    "Failed to add wildcard permission".to_string()
+  })?;
+  if !permissions.contains(&permission.to_string()) {
+    permissions.push(permission.to_string());
+  }
+  Ok(())
+}
+
+pub fn get_wildcard_permissions() -> Vec<String> {
+  let permissions = WILDCARD_PERMISSIONS
+    .read()
+    .expect("Failed to acquire read lock");
+  permissions.clone()
+}
+
+pub fn clear_wildcard_permissions() -> Result<(), String> {
+  let mut permissions = WILDCARD_PERMISSIONS.write().map_err(|e| {
+    error!("Failed to acquire write lock: {}", e);
+    "Failed to clear wildcard permissions".to_string()
+  })?;
+  permissions.clear();
+  Ok(())
+}
+
 #[cfg(test)]
 mod tests {
   use super::*;

tests/specs/permission/process_env_permissions/__test__.jsonc

@@ -0,0 +1,34 @@
+{
+  "tempDir": true,
+  "tests": {
+    "deno_env_wildcard_tests": {
+      "envs": {
+        "MYAPP_HELLO": "Hello\tworld,",
+        "MYAPP_GOODBYE": "farewell",
+        "OTHER_VAR": "ignore"
+      },
+      "steps": [
+        {
+          "args": "run --allow-env=MYAPP_* main.js",
+          "output": "Hello\tworld,\nfarewell\ndone\n"
+        },
+        {
+          "args": "run --allow-env=*_HELLO,*_GOODBYE,*_DONE,*_TEST main.js",
+          "output": "Hello\tworld,\nfarewell\ndone\n"
+        },
+        {
+          "args": "run --allow-env=* main.js",
+          "output": "Hello\tworld,\nfarewell\ndone\n"
+        },
+        {
+          "args": "run --allow-env main.js",
+          "output": "Hello\tworld,\nfarewell\ndone\n"
+        },
+        {
+          "args": "run --allow-env=MYAPP_HELLO,MYAPP_GOODBYE,MYAPP_TEST,MYAPP_DONE main.js",
+          "output": "Hello\tworld,\nfarewell\ndone\n"
+        }
+      ]
+    }
+  }
+}

tests/specs/permission/process_env_permissions/main.js

@@ -0,0 +1,5 @@
+console.log(Deno.env.get("MYAPP_HELLO"));
+console.log(Deno.env.get("MYAPP_GOODBYE"));
+Deno.env.set("MYAPP_TEST", "done");
+Deno.env.set("MYAPP_DONE", "done");
+console.log(Deno.env.get("MYAPP_DONE"));