File system permissions (--allow-read, --allow-write) in Deno

Introduction

Deno restricts file access by default to keep your computer safe. You use --allow-read and --allow-write to let your program read or write files.

When your program needs to read a configuration file from disk.

When you want to save user data or logs to a file.

When you want to load images or other resources from your computer.

When you want to create or update files during program execution.

When testing file operations and you want to allow access temporarily.

Syntax

Deno

deno run --allow-read=path/to/file_or_dir --allow-write=path/to/file_or_dir your_script.ts

You can specify exact files or directories after --allow-read or --allow-write.

Omitting the path after the flag allows access to all files for that permission.

Examples

This lets the program read files only inside the data folder.

Deno

deno run --allow-read=./data config_reader.ts

This lets the program write files only inside the logs folder.

Deno

deno run --allow-write=./logs logger.ts

This lets the program read and write any file on your computer (use carefully).

Deno

deno run --allow-read --allow-write app.ts

Sample Program

This program writes a message to example.txt and then reads it back to print on the console.

You must run it with --allow-read=./example.txt and --allow-write=./example.txt to allow file access.

Deno

import { readTextFile, writeTextFile } from "https://deno.land/std@0.203.0/fs/mod.ts";

async function main() {
  const filePath = "./example.txt";

  // Write text to a file
  await writeTextFile(filePath, "Hello from Deno!\n");

  // Read the text back
  const content = await readTextFile(filePath);
  console.log(content);
}

main();

Important Notes

Always limit permissions to only what your program needs to keep your system safe.

If you forget to add these flags, Deno will show an error when trying to access files.

You can combine multiple paths separated by commas, like --allow-read=./data,./config.

Summary

--allow-read lets your program read files or folders you specify.

--allow-write lets your program create or change files or folders you specify.

Use these flags carefully to keep your computer safe while running Deno programs.

Practice

1. What does the --allow-read flag do when running a Deno program?

easy

A. Allows the program to read files or folders specified.

B. Allows the program to write or modify files.

C. Blocks the program from accessing the network.

D. Runs the program without any permissions.

Solution

1. Step 1: Understand the purpose of --allow-read

   This flag grants permission to read files or folders.

2. Step 2: Compare with other flags

   --allow-write is for writing, not reading. Network access is unrelated.

3. Final Answer:

   Allows the program to read files or folders specified. -> Option A

4. Quick Check:

   --allow-read = read permission [OK]

Hint: Read permission means accessing files, not changing them [OK]

Common Mistakes:

• Confusing read permission with write permission
• Thinking it controls network access
• Assuming it grants all permissions

2. Which of the following is the correct way to run a Deno script app.ts with permission to write files?

easy

A. deno run app.ts --allow-write

B. deno run app.ts --allow-read

C. deno --allow-write run app.ts

D. deno run --allow-write app.ts

Solution

1. Step 1: Recall Deno command syntax

   The flags come immediately after deno run and before the script name.

2. Step 2: Identify correct flag placement

   deno run --allow-write app.ts is correct; options A and C have wrong order, D uses wrong flag.

3. Final Answer:

   deno run --allow-write app.ts -> Option D

4. Quick Check:

   Flags go after deno run [OK]

Hint: Flags come right after 'deno run', before script name [OK]

Common Mistakes:

• Placing flags after the script name
• Mixing up --allow-read and --allow-write
• Putting flags before 'run'

3. Consider this Deno script readfile.ts that reads data.txt and prints its content. What happens if you run deno run readfile.ts without any flags?

medium

A. The script creates data.txt if missing.

B. The script runs and prints the file content.

C. The script throws a permission error.

D. The script runs but prints nothing.

Solution

1. Step 1: Understand default permissions

   Without --allow-read, Deno denies file reading for safety.

2. Step 2: Predict script behavior

   Trying to read data.txt without permission causes a runtime error.

3. Final Answer:

   The script throws a permission error. -> Option C

4. Quick Check:

   No --allow-read means no file reading [OK]

Hint: No read flag means reading files causes error [OK]

Common Mistakes:

• Assuming Deno allows reading by default
• Thinking the file is created automatically
• Believing the script prints empty content silently

4. You have a Deno script that writes to log.txt. Running deno run --allow-read write.ts causes a permission error when writing. What is the fix?

medium

A. Add --allow-write flag when running the script.

B. Remove --allow-read flag and run without flags.

C. Change the script to read instead of write.

D. Run the script with --allow-net flag.

Solution

1. Step 1: Identify the permission needed

   Writing files requires --allow-write, not just --allow-read.

2. Step 2: Apply correct flag

   Run the script with --allow-write to allow file writing.

3. Final Answer:

   Add --allow-write flag when running the script. -> Option A

4. Quick Check:

   Write permission needs --allow-write [OK]

Hint: Write needs --allow-write, not --allow-read [OK]

Common Mistakes:

• Using only --allow-read for writing
• Removing flags thinking it grants all permissions
• Confusing network permission with file permission

5. You want to run a Deno script that reads from input.txt and writes to output.txt. Which command correctly grants the minimum permissions needed?

hard

A. deno run --allow-net script.ts

B. deno run --allow-read=./input.txt --allow-write=./output.txt script.ts

C. deno run --allow-write=./input.txt --allow-read=./output.txt script.ts

D. deno run --allow-read --allow-write script.ts

Solution

1. Step 1: Understand fine-grained permissions

   Using --allow-read=path and --allow-write=path limits access to specific files.

2. Step 2: Match permissions to files

   Read permission for input.txt and write permission for output.txt is needed.

3. Step 3: Check options

   deno run --allow-read=./input.txt --allow-write=./output.txt script.ts correctly assigns read to input and write to output. deno run --allow-read --allow-write script.ts grants full access, which is more than needed. deno run --allow-write=./input.txt --allow-read=./output.txt script.ts swaps permissions. deno run --allow-net script.ts is unrelated.

4. Final Answer:

   deno run --allow-read=./input.txt --allow-write=./output.txt script.ts -> Option B

5. Quick Check:

   Grant only needed file permissions [OK]

Hint: Use path-limited flags to grant minimal permissions [OK]

Common Mistakes:

• Granting full read/write when only specific files needed
• Swapping read and write paths
• Using unrelated flags like --allow-net