Granular permission scoping in Deno - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output when running this Deno script with limited permissions?

Consider this Deno script that tries to read a file and access the network. What will it output if run with --allow-read=./data but without network permissions?

Deno

import { readTextFile } from "https://deno.land/std/fs/mod.ts";

async function main() {
  try {
    const content = await readTextFile("./data/info.txt");
    console.log("File content:", content);
  } catch (e) {
    console.log("Read error:", e.message);
  }

  try {
    const response = await fetch("https://example.com");
    console.log("Network response status:", response.status);
  } catch (e) {
    console.log("Fetch error:", e.message);
  }
}

main();

A Read error: Permission denied\nNetwork response status: 200

B Read error: Permission denied\nFetch error: network access to "https://example.com" is not allowed

C File content: (file content here)\nFetch error: network access to "https://example.com" is not allowed

D File content: (file content here)\nNetwork response status: 200

💡 Hint

Think about which permissions are granted and which are missing.

The script has permission to read files in ./data, so reading info.txt succeeds. But it lacks network permission, so fetch throws a permission error.

📝 Syntax

intermediate

Which Deno permission flag syntax correctly grants read access only to the 'logs' directory?

Select the correct command line flag to run a Deno script with read permission limited to the 'logs' directory.

A --allow-read logs

B --allow-read=logs/*

C --allow-read=./logs/*

D --allow-read=logs

💡 Hint

Deno uses glob patterns for directory permission scoping.

The correct syntax uses a glob pattern with a wildcard to specify all files inside the 'logs' directory: --allow-read=logs/*

🔧 Debug

advanced

Why does this Deno script fail to write a file despite using --allow-write?

This script tries to write to './output/result.txt' but fails with a permission error. The script is run with deno run --allow-write=./output/data. Why?

Deno

import { writeTextFile } from "https://deno.land/std/fs/mod.ts";

await writeTextFile("./output/result.txt", "Hello World");

A The --allow-write flag only allows writing inside './output/data', not './output/result.txt'

B The script needs --allow-read permission to write files

C The path './output/result.txt' is invalid syntax for writeTextFile

D The script must be run with --unstable flag to write files

💡 Hint

Check the exact path allowed by the permission flag.

The permission flag limits write access to './output/data' directory only. Writing to './output/result.txt' is outside that scope, causing a permission error.

❓ state_output

advanced

What is the output of this Deno script with combined scoped permissions?

Given this script and running with --allow-read=./config --allow-net=example.com, what will it output?

Deno

async function main() {
  try {
    const data = await Deno.readTextFile("./config/settings.json");
    console.log("Config loaded");
  } catch {
    console.log("Failed to load config");
  }

  try {
    const res = await fetch("https://example.com/api");
    console.log("API status", res.status);
  } catch {
    console.log("API fetch failed");
  }

  try {
    const res2 = await fetch("https://deno.land/std");
    console.log("Deno.land status", res2.status);
  } catch {
    console.log("Deno.land fetch failed");
  }
}

main();

A Config loaded\nAPI fetch failed\nDeno.land fetch failed

B Failed to load config\nAPI status 200\nDeno.land fetch failed

C Config loaded\nAPI status 200\nDeno.land status 200

D Config loaded\nAPI status 200\nDeno.land fetch failed

💡 Hint

Check which URLs and files are allowed by the scoped permissions.

The script can read './config/settings.json' and fetch from 'example.com' but not from 'deno.land'. So the first two try blocks succeed, the last fails.

🧠 Conceptual

expert

Which statement best describes Deno's granular permission scoping behavior?

Select the most accurate description of how Deno handles granular permission scoping.

A Deno requires explicit permission flags for each resource type and supports path or host scoping to limit access precisely.

B Deno grants permissions globally by default, and scoped flags only restrict some APIs.

C Deno automatically grants all permissions for local files but restricts network access unless flagged.

D Deno permissions are only checked at runtime, so scripts can request permissions dynamically during execution.

💡 Hint

Think about how Deno controls access to files and network resources.

Deno enforces security by requiring explicit permission flags for file, network, environment, and other resources. These flags can be scoped to specific paths or hosts to limit access.

Practice

1. What does the --allow-read=./data flag do when running a Deno script?

easy

A. Allows the script to read any file on the system

B. Allows the script to read files only inside the ./data directory

C. Blocks all file reading operations

D. Allows the script to write files inside the ./data directory

Solution

1. Step 1: Understand the --allow-read flag

   The --allow-read flag grants permission to read files. When given a path, it limits reading to that path.

2. Step 2: Analyze the given path ./data

   Since the flag is --allow-read=./data, the script can only read files inside the ./data directory, not outside.

3. Final Answer:

   Allows the script to read files only inside the ./data directory -> Option B

4. Quick Check:

   --allow-read=path limits read to that path [OK]

Hint: Remember: --allow-read=path restricts reading to that path only [OK]

Common Mistakes:

• Thinking it allows reading all files
• Confusing read permission with write permission
• Assuming it blocks all reading

2. Which of the following is the correct syntax to allow network access only to example.com in Deno?

easy

A. deno run --allow-net=example.com script.ts

B. deno run --allow-net example.com script.ts

C. deno run --allow-net:example.com script.ts

D. deno run --allow-net[example.com] script.ts

Solution

1. Step 1: Recall the correct flag format for network permission

   The correct syntax to allow network access to a specific host is --allow-net=host.

2. Step 2: Match the options with the correct syntax

   deno run --allow-net=example.com script.ts uses --allow-net=example.com, which is correct. Other options use incorrect separators or missing equals sign.

3. Final Answer:

   deno run --allow-net=example.com script.ts -> Option A

4. Quick Check:

   Use --allow-net=host for specific network access [OK]

Hint: Use equals sign (=) to specify hosts in --allow-net flag [OK]

Common Mistakes:

• Using space instead of equals sign
• Using colon or brackets instead of equals
• Omitting the host after --allow-net

3. Consider this command: deno run --allow-read=./files --allow-net=api.example.com script.ts. What will happen if script.ts tries to read ./files/data.txt and fetch from api.example.com?

medium

A. Both reading the file and fetching will fail

B. Reading the file will fail, fetching will succeed

C. Reading the file will succeed, fetching will fail

D. Both reading the file and fetching from the API will succeed

Solution

1. Step 1: Check read permission for ./files/data.txt

   The flag --allow-read=./files allows reading any file inside ./files, so reading data.txt is allowed.

2. Step 2: Check network permission for api.example.com

   The flag --allow-net=api.example.com allows network requests only to api.example.com, so fetching from that API is allowed.

3. Final Answer:

   Both reading the file and fetching from the API will succeed -> Option D

4. Quick Check:

   Permissions match actions, so both succeed [OK]

Hint: Match file path and host exactly with permission flags [OK]

Common Mistakes:

• Assuming read permission covers all files
• Assuming --allow-net allows all hosts
• Confusing read and write permissions

4. You run deno run --allow-read=./data script.ts but your script tries to read ./config/settings.json and fails. What is the most likely cause?

medium

A. The script has no network permission

B. The script has no permission to write to ./config

C. The script has no permission to read outside the ./data directory

D. The script has a syntax error in reading files

Solution

1. Step 1: Understand the --allow-read=./data scope

   This flag only allows reading files inside the ./data directory, not outside.

2. Step 2: Analyze the attempted file path ./config/settings.json

   The script tries to read a file outside the allowed ./data directory, so permission is denied.

3. Final Answer:

   The script has no permission to read outside the ./data directory -> Option C

4. Quick Check:

   Permission scope limits file access [OK]

Hint: Check if file path is inside allowed read directory [OK]

Common Mistakes:

• Confusing read and write permissions
• Assuming network permission affects file reading
• Blaming syntax errors for permission issues

5. You want to run a Deno script that reads files only from ./logs and ./configs directories and fetches data only from api.service.com and cdn.service.com. Which command correctly grants these permissions?

hard

A. deno run --allow-read=./logs,./configs --allow-net=api.service.com,cdn.service.com script.ts

B. deno run --allow-read=./logs --allow-read ./configs --allow-net=api.service.com --allow-net=cdn.service.com script.ts

C. deno run --allow-read=./logs ./configs --allow-net=api.service.com cdn.service.com script.ts

D. deno run --allow-read=./logs --allow-net=api.service.com,cdn.service.com script.ts

Solution

1. Step 1: Understand how to specify multiple paths or hosts

   Deno allows multiple paths or hosts in a single flag separated by commas, e.g., --allow-read=path1,path2.

2. Step 2: Analyze each option for correct syntax

   deno run --allow-read=./logs,./configs --allow-net=api.service.com,cdn.service.com script.ts correctly uses commas to list multiple directories and hosts in one flag. deno run --allow-read=./logs --allow-read ./configs --allow-net=api.service.com --allow-net=cdn.service.com script.ts has incorrect syntax (missing = after second --allow-read). Options C and D have incorrect syntax or missing permissions.

3. Final Answer:

   deno run --allow-read=./logs,./configs --allow-net=api.service.com,cdn.service.com script.ts -> Option A

4. Quick Check:

   Use commas to list multiple paths or hosts in one flag [OK]

Hint: Use commas to separate multiple paths or hosts in permission flags [OK]

Common Mistakes:

• Missing the equals sign (=) in permission flags
• Using spaces instead of commas to separate paths
• Omitting one of the required permissions