File system permissions (--allow-read, --allow-write) in Deno - Performance & Optimization

Performance: File system permissions (--allow-read, --allow-write)

MEDIUM IMPACT

This concept affects the security and startup time of Deno scripts by controlling file system access permissions.

Running a Deno script that reads and writes files securely and efficiently

Deno

deno run --allow-read=./data --allow-write=./output script.ts

Restricts file system access to only needed directories, reducing security risks and minimizing permission checks at startup.

📈 Performance GainReduces startup overhead by limiting permission scope; improves security and maintainability.

Running a Deno script that reads and writes files securely and efficiently

Deno

deno run --allow-read --allow-write script.ts

This grants full read and write access to the entire file system, increasing security risks and potentially slowing startup due to broad permission checks.

📉 Performance CostIncreases startup time slightly due to broad permission scope; higher security risk can lead to costly debugging or breaches.

Performance Comparison

Pattern	Permission Scope	Startup Delay	Security Risk	Verdict
Full --allow-read and --allow-write	Entire file system	Medium delay due to broad checks	High risk	[X] Bad
Scoped --allow-read and --allow-write	Specific directories only	Minimal delay	Low risk	[OK] Good

Rendering Pipeline

File system permissions in Deno affect the runtime environment setup before script execution, influencing startup performance and security checks.

→Startup Initialization

→Permission Check

⚠️ BottleneckPermission Check stage can delay startup if permissions are too broad or complex.

Optimization Tips

1Grant only the minimum necessary file system permissions to your Deno scripts.

2Use scoped permissions (e.g., --allow-read=./folder) to reduce startup overhead.

3Avoid broad permissions to improve security and reduce debugging complexity.

Performance Quiz - 3 Questions

What is the main performance impact of granting broad file system permissions in Deno?

A Increased startup time due to extensive permission checks

B Faster script execution due to no restrictions

C No impact on performance

D Improved security

DevTools: Terminal / Deno CLI

How to check: Run the script with --unstable --log-level=debug flags to see permission checks and startup timing in the console output.

What to look for: Look for permission validation logs and startup time metrics to confirm minimal overhead and scoped access.

Practice

1. What does the --allow-read flag do when running a Deno program?

easy

A. Allows the program to read files or folders specified.

B. Allows the program to write or modify files.

C. Blocks the program from accessing the network.

D. Runs the program without any permissions.

Solution

1. Step 1: Understand the purpose of --allow-read

   This flag grants permission to read files or folders.

2. Step 2: Compare with other flags

   --allow-write is for writing, not reading. Network access is unrelated.

3. Final Answer:

   Allows the program to read files or folders specified. -> Option A

4. Quick Check:

   --allow-read = read permission [OK]

Hint: Read permission means accessing files, not changing them [OK]

Common Mistakes:

• Confusing read permission with write permission
• Thinking it controls network access
• Assuming it grants all permissions

2. Which of the following is the correct way to run a Deno script app.ts with permission to write files?

easy

A. deno run app.ts --allow-write

B. deno run app.ts --allow-read

C. deno --allow-write run app.ts

D. deno run --allow-write app.ts

Solution

1. Step 1: Recall Deno command syntax

   The flags come immediately after deno run and before the script name.

2. Step 2: Identify correct flag placement

   deno run --allow-write app.ts is correct; options A and C have wrong order, D uses wrong flag.

3. Final Answer:

   deno run --allow-write app.ts -> Option D

4. Quick Check:

   Flags go after deno run [OK]

Hint: Flags come right after 'deno run', before script name [OK]

Common Mistakes:

• Placing flags after the script name
• Mixing up --allow-read and --allow-write
• Putting flags before 'run'

3. Consider this Deno script readfile.ts that reads data.txt and prints its content. What happens if you run deno run readfile.ts without any flags?

medium

A. The script creates data.txt if missing.

B. The script runs and prints the file content.

C. The script throws a permission error.

D. The script runs but prints nothing.

Solution

1. Step 1: Understand default permissions

   Without --allow-read, Deno denies file reading for safety.

2. Step 2: Predict script behavior

   Trying to read data.txt without permission causes a runtime error.

3. Final Answer:

   The script throws a permission error. -> Option C

4. Quick Check:

   No --allow-read means no file reading [OK]

Hint: No read flag means reading files causes error [OK]

Common Mistakes:

• Assuming Deno allows reading by default
• Thinking the file is created automatically
• Believing the script prints empty content silently

4. You have a Deno script that writes to log.txt. Running deno run --allow-read write.ts causes a permission error when writing. What is the fix?

medium

A. Add --allow-write flag when running the script.

B. Remove --allow-read flag and run without flags.

C. Change the script to read instead of write.

D. Run the script with --allow-net flag.

Solution

1. Step 1: Identify the permission needed

   Writing files requires --allow-write, not just --allow-read.

2. Step 2: Apply correct flag

   Run the script with --allow-write to allow file writing.

3. Final Answer:

   Add --allow-write flag when running the script. -> Option A

4. Quick Check:

   Write permission needs --allow-write [OK]

Hint: Write needs --allow-write, not --allow-read [OK]

Common Mistakes:

• Using only --allow-read for writing
• Removing flags thinking it grants all permissions
• Confusing network permission with file permission

5. You want to run a Deno script that reads from input.txt and writes to output.txt. Which command correctly grants the minimum permissions needed?

hard

A. deno run --allow-net script.ts

B. deno run --allow-read=./input.txt --allow-write=./output.txt script.ts

C. deno run --allow-write=./input.txt --allow-read=./output.txt script.ts

D. deno run --allow-read --allow-write script.ts

Solution

1. Step 1: Understand fine-grained permissions

   Using --allow-read=path and --allow-write=path limits access to specific files.

2. Step 2: Match permissions to files

   Read permission for input.txt and write permission for output.txt is needed.

3. Step 3: Check options

   deno run --allow-read=./input.txt --allow-write=./output.txt script.ts correctly assigns read to input and write to output. deno run --allow-read --allow-write script.ts grants full access, which is more than needed. deno run --allow-write=./input.txt --allow-read=./output.txt script.ts swaps permissions. deno run --allow-net script.ts is unrelated.

4. Final Answer:

   deno run --allow-read=./input.txt --allow-write=./output.txt script.ts -> Option B

5. Quick Check:

   Grant only needed file permissions [OK]

Hint: Use path-limited flags to grant minimal permissions [OK]

Common Mistakes:

• Granting full read/write when only specific files needed
• Swapping read and write paths
• Using unrelated flags like --allow-net