File system permissions (--allow-read, --allow-write) in Deno - Deep Dive

Overview - File system permissions (--allow-read, --allow-write)

What is it?

File system permissions in Deno control whether a program can read or write files on your computer. The flags --allow-read and --allow-write explicitly grant these permissions when running a Deno script. Without these flags, the program cannot access or change files, keeping your system safe from unwanted changes.

Why it matters

These permissions exist to protect your computer from harmful or accidental file changes by scripts. Without them, any program could read or modify your files without asking, which could lead to data loss or security breaches. By requiring explicit permission, Deno helps you stay in control and trust the code you run.

Where it fits

Before learning about these permissions, you should understand basic command-line usage and how Deno runs scripts. After this, you can explore more advanced Deno permissions like network access or environment variables, and how to combine them for secure applications.

Mental Model

Core Idea

Deno requires explicit permission flags to read or write files, ensuring scripts cannot access your file system without your clear approval.

Think of it like...

It's like giving a guest a key to only certain rooms in your house; without the key, they can't enter or change anything inside.

┌───────────────┐
│   Deno Run   │
├───────────────┤
│ --allow-read  │───▶ Allows reading files
│ --allow-write │───▶ Allows writing files
└───────────────┘
        │
        ▼
┌───────────────────────────┐
│ File System Access Control │
└───────────────────────────┘

Build-Up - 6 Steps

1

Foundation

What Are File System Permissions

Concept: Introduce the idea that programs need permission to access files.

When you run a program, it might want to open, read, or change files on your computer. File system permissions are rules that decide if the program can do these actions. In Deno, these permissions are not given by default to keep your files safe.

Result

You understand that programs need explicit permission to access files, and without it, they cannot read or write.

Knowing that file access is controlled by permissions helps you see why Deno asks for explicit flags before allowing file operations.

2

Foundation

Deno's Permission Flags Explained

Concept: Learn the specific flags --allow-read and --allow-write and what they do.

Deno uses two main flags for file access: --allow-read lets the program read files, and --allow-write lets it create or change files. You add these flags when running your script, like: deno run --allow-read script.ts. Without these, any file operation will fail.

Result

You can run Deno scripts with or without these flags and see how file access changes.

Understanding these flags is key to controlling what your Deno programs can do with your files.

3

Intermediate

Restricting Permissions to Specific Paths

🤔Before reading on: do you think --allow-read allows access to all files or only specified ones? Commit to your answer.

Concept: Learn how to limit permissions to certain files or folders for better security.

Instead of giving full access, you can specify paths with the flags, like --allow-read=/data or --allow-write=./logs. This means the program can only read or write files inside those folders, not anywhere else on your computer.

Result

You can run scripts that only access certain folders, reducing risk if the script is untrusted.

Knowing how to limit permissions to paths helps you keep your system safer by minimizing what scripts can touch.

4

Intermediate

Combining Read and Write Permissions

🤔Before reading on: if you want a script to read and then update a file, do you need one or both flags? Commit to your answer.

Concept: Understand that read and write permissions are separate and can be combined as needed.

If your script needs to read a file and then change it, you must provide both --allow-read and --allow-write flags. Giving only one will cause errors when the script tries the other action. You can combine them like: deno run --allow-read --allow-write script.ts.

Result

Scripts run smoothly with the correct combination of permissions, avoiding permission errors.

Recognizing that read and write are distinct permissions prevents common mistakes and runtime failures.

5

Advanced

Permission Prompts and Runtime Checks

🤔Before reading on: do you think Deno asks for permission during script execution or only at start? Commit to your answer.

Concept: Learn how Deno checks permissions at runtime and can prompt for them interactively.

Deno checks permissions when the script tries to access files. If you run with --allow-read or --allow-write without specifying paths, it grants full access immediately. But if you run without flags, Deno denies access. You can also run with --prompt to ask for permission during execution, making it interactive.

Result

You understand how Deno enforces permissions dynamically and how to use prompts for safer scripts.

Knowing runtime permission checks helps you debug permission errors and design scripts that ask for access only when needed.

6

Expert

Security Implications and Best Practices

🤔Before reading on: do you think granting full --allow-write is always safe? Commit to your answer.

Concept: Explore the security risks of broad permissions and how experts minimize them.

Granting full --allow-write lets scripts change any file, which can be dangerous if the script is malicious or buggy. Experts limit permissions to specific paths and avoid giving write access unless necessary. They also audit scripts and use sandboxing techniques to reduce risk.

Result

You learn how to balance functionality and security by carefully managing permissions.

Understanding the risks of broad permissions guides you to safer, professional use of Deno in real projects.

Under the Hood

Deno runs scripts inside a secure sandbox that blocks file system calls unless permissions are granted. When a script tries to read or write a file, Deno intercepts the call and checks if the corresponding flag (--allow-read or --allow-write) was given and if the file path matches allowed patterns. If not, it throws a permission error, preventing the operation.

Why designed this way?

Deno was designed to be secure by default, unlike many older runtimes that allow full file access. This design prevents accidental or malicious damage to the user's system. The explicit permission flags give users control and transparency over what scripts can do, balancing security and usability.

┌───────────────┐
│   Deno CLI    │
└──────┬────────┘
       │ run script with flags
       ▼
┌───────────────┐
│ Deno Runtime  │
│  Sandbox     │
└──────┬────────┘
       │ intercepts file calls
       ▼
┌───────────────┐
│ Permission    │
│ Checker       │
├───────────────┤
│ Checks flags  │
│ and paths    │
└──────┬────────┘
       │ allow or deny
       ▼
┌───────────────┐
│ File System   │
└───────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Does --allow-read let a script write files too? Commit to yes or no.

Common Belief: If a script has --allow-read, it can also write files because reading implies writing.

Reality: Read and write permissions are separate; --allow-read only allows reading files, not writing or changing them.

Why it matters: Assuming read permission includes write can lead to security holes or unexpected permission errors when scripts try to write.

Quick: Does running a script without any flags allow it to read or write files? Commit to yes or no.

Common Belief: Without any permission flags, the script can still read or write files because the OS allows it.

Reality: Deno blocks all file system access by default unless explicit flags are given, so no file reading or writing is possible without permissions.

Why it matters: Thinking scripts have default access can cause confusion when file operations fail unexpectedly.

Quick: Does specifying --allow-read=/folder allow access to files outside that folder? Commit to yes or no.

Common Belief: Specifying a folder in --allow-read means the script can read any file on the system.

Reality: The permission is limited strictly to the specified folder and its subfolders; files outside are blocked.

Why it matters: Misunderstanding this can lead to over-permissioning or false confidence in script security.

Quick: Can Deno prompt for file permissions during script execution by default? Commit to yes or no.

Common Belief: Deno always asks for permission interactively when a script tries to access files.

Reality: Deno only prompts if run with the --prompt flag; otherwise, permissions must be granted upfront via flags.

Why it matters: Expecting interactive prompts without --prompt can cause confusion and failed scripts.

Expert Zone

1

Permissions can be granted multiple times with different paths, and Deno merges them to create a combined allowed set.

2

Deno's permission system integrates with its async runtime, so permission checks happen asynchronously, affecting performance and error handling.

3

Scripts can revoke permissions at runtime using Deno.permissions.revoke(), allowing dynamic control over file access.

When NOT to use

Avoid using broad --allow-read or --allow-write flags in production or with untrusted code. Instead, use specific path restrictions or sandboxing tools like containers or virtual machines for stronger isolation.

Production Patterns

In real projects, developers use minimal permissions, often specifying exact folders needed. CI/CD pipelines run tests with no permissions or limited ones to catch permission issues early. Some use permission prompts during development but lock down permissions in production.

Connections

Operating System File Permissions

Builds-on

Understanding OS-level file permissions helps grasp why Deno adds its own layer to control script access securely.

Browser Security Sandbox

Similar pattern

Like browsers restrict web pages from accessing your files, Deno restricts scripts to protect your system, showing a shared security approach.

Access Control in Physical Security

Analogous concept

Just as physical locks control who can enter rooms, Deno's permission flags control script access, illustrating universal principles of access control.

Common Pitfalls

#1 Granting full --allow-write permission unnecessarily.

Wrong approach:

deno run --allow-write script.ts

Correct approach:

deno run --allow-write=./data script.ts

Root cause:

Not understanding the risk of broad write access leads to over-permissioning and potential security issues.

#2 Running scripts without any permission flags expecting file access.

Wrong approach:

deno run script.ts

Correct approach:

deno run --allow-read script.ts

Root cause:

Assuming default permissions exist causes confusion when file operations fail.

#3 Combining --allow-read and --allow-write incorrectly by specifying only one.

Wrong approach:

deno run --allow-read script.ts (script tries to write)

Correct approach:

deno run --allow-read --allow-write script.ts

Root cause:

Not realizing read and write are separate permissions causes runtime errors.

Key Takeaways

Deno requires explicit permission flags to read or write files, protecting your system by default.

The --allow-read and --allow-write flags control file access separately and can be limited to specific paths for security.

Without these flags, Deno blocks all file system access, preventing accidental or malicious file changes.

Experts minimize risk by granting only necessary permissions and using path restrictions or sandboxing.

Understanding Deno's permission system helps you write safer scripts and avoid common permission errors.

Practice

1. What does the --allow-read flag do when running a Deno program?

easy

A. Allows the program to read files or folders specified.

B. Allows the program to write or modify files.

C. Blocks the program from accessing the network.

D. Runs the program without any permissions.

Solution

1. Step 1: Understand the purpose of --allow-read

   This flag grants permission to read files or folders.

2. Step 2: Compare with other flags

   --allow-write is for writing, not reading. Network access is unrelated.

3. Final Answer:

   Allows the program to read files or folders specified. -> Option A

4. Quick Check:

   --allow-read = read permission [OK]

Hint: Read permission means accessing files, not changing them [OK]

Common Mistakes:

• Confusing read permission with write permission
• Thinking it controls network access
• Assuming it grants all permissions

2. Which of the following is the correct way to run a Deno script app.ts with permission to write files?

easy

A. deno run app.ts --allow-write

B. deno run app.ts --allow-read

C. deno --allow-write run app.ts

D. deno run --allow-write app.ts

Solution

1. Step 1: Recall Deno command syntax

   The flags come immediately after deno run and before the script name.

2. Step 2: Identify correct flag placement

   deno run --allow-write app.ts is correct; options A and C have wrong order, D uses wrong flag.

3. Final Answer:

   deno run --allow-write app.ts -> Option D

4. Quick Check:

   Flags go after deno run [OK]

Hint: Flags come right after 'deno run', before script name [OK]

Common Mistakes:

• Placing flags after the script name
• Mixing up --allow-read and --allow-write
• Putting flags before 'run'

3. Consider this Deno script readfile.ts that reads data.txt and prints its content. What happens if you run deno run readfile.ts without any flags?

medium

A. The script creates data.txt if missing.

B. The script runs and prints the file content.

C. The script throws a permission error.

D. The script runs but prints nothing.

Solution

1. Step 1: Understand default permissions

   Without --allow-read, Deno denies file reading for safety.

2. Step 2: Predict script behavior

   Trying to read data.txt without permission causes a runtime error.

3. Final Answer:

   The script throws a permission error. -> Option C

4. Quick Check:

   No --allow-read means no file reading [OK]

Hint: No read flag means reading files causes error [OK]

Common Mistakes:

• Assuming Deno allows reading by default
• Thinking the file is created automatically
• Believing the script prints empty content silently

4. You have a Deno script that writes to log.txt. Running deno run --allow-read write.ts causes a permission error when writing. What is the fix?

medium

A. Add --allow-write flag when running the script.

B. Remove --allow-read flag and run without flags.

C. Change the script to read instead of write.

D. Run the script with --allow-net flag.

Solution

1. Step 1: Identify the permission needed

   Writing files requires --allow-write, not just --allow-read.

2. Step 2: Apply correct flag

   Run the script with --allow-write to allow file writing.

3. Final Answer:

   Add --allow-write flag when running the script. -> Option A

4. Quick Check:

   Write permission needs --allow-write [OK]

Hint: Write needs --allow-write, not --allow-read [OK]

Common Mistakes:

• Using only --allow-read for writing
• Removing flags thinking it grants all permissions
• Confusing network permission with file permission

5. You want to run a Deno script that reads from input.txt and writes to output.txt. Which command correctly grants the minimum permissions needed?

hard

A. deno run --allow-net script.ts

B. deno run --allow-read=./input.txt --allow-write=./output.txt script.ts

C. deno run --allow-write=./input.txt --allow-read=./output.txt script.ts

D. deno run --allow-read --allow-write script.ts

Solution

1. Step 1: Understand fine-grained permissions

   Using --allow-read=path and --allow-write=path limits access to specific files.

2. Step 2: Match permissions to files

   Read permission for input.txt and write permission for output.txt is needed.

3. Step 3: Check options

   deno run --allow-read=./input.txt --allow-write=./output.txt script.ts correctly assigns read to input and write to output. deno run --allow-read --allow-write script.ts grants full access, which is more than needed. deno run --allow-write=./input.txt --allow-read=./output.txt script.ts swaps permissions. deno run --allow-net script.ts is unrelated.

4. Final Answer:

   deno run --allow-read=./input.txt --allow-write=./output.txt script.ts -> Option B

5. Quick Check:

   Grant only needed file permissions [OK]

Hint: Use path-limited flags to grant minimal permissions [OK]

Common Mistakes:

• Granting full read/write when only specific files needed
• Swapping read and write paths
• Using unrelated flags like --allow-net