Why Deno is secure by default - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

What does Deno block by default?

Deno is designed to be secure by default. Which of the following resources does Deno block access to unless explicitly allowed?

A Network, file system, environment variables, and subprocesses

B Only network access

C Only file system access

D No restrictions by default

💡 Hint

Think about what could cause security risks if accessed without permission.

Deno blocks network, file system, environment variables, and subprocess access by default to prevent unauthorized operations. You must explicitly grant permissions to allow these.

❓ component_behavior

intermediate

What happens if you run a Deno script without permissions?

Consider running a Deno script that tries to read a file without any permission flags. What will happen?

Deno

console.log(await Deno.readTextFile("secret.txt"));

A The script will throw a permission error and stop.

B The script will read and print the file content.

C The script will ignore the read and continue silently.

D The script will prompt the user to allow permission at runtime.

💡 Hint

Deno does not ask for permissions interactively by default.

Deno throws a permission error if a script tries to access resources without the required permissions. It does not prompt or silently ignore.

📝 Syntax

advanced

Which command grants network and file system access in Deno?

You want to run a Deno script with permission to access the network and read files. Which command is correct?

A deno run --allow-write script.ts

B deno run --allow-all script.ts

C deno run --allow-env script.ts

D deno run --allow-net --allow-read script.ts

💡 Hint

Check which flags correspond to network and file read permissions.

--allow-net grants network access, --allow-read grants file read access. --allow-all grants all permissions but is not minimal. --allow-env and --allow-write do not grant network or read permissions.

🔧 Debug

advanced

Why does this Deno script fail with a permission error?

This script tries to fetch data from the internet but fails with a permission error. What is the cause?

Deno

const response = await fetch('https://example.com');
const text = await response.text();
console.log(text);

A The script needs --allow-read permission to fetch data.

B The fetch API is not supported in Deno.

C The script lacks the --allow-net permission flag when run.

D The URL is invalid and causes a runtime error.

💡 Hint

Think about what permission is needed to access the network.

Deno requires the --allow-net flag to allow network requests. Without it, fetch calls cause a permission error.

❓ state_output

expert

What is the output of this Deno script with partial permissions?

Given this script and running it with only --allow-read, what will be the output?

Deno

try {
  const env = Deno.env.get('HOME');
  console.log('Home:', env);
} catch (e) {
  console.log('Env error:', e.name);
}

try {
  const data = await Deno.readTextFile('file.txt');
  console.log('File:', data);
} catch (e) {
  console.log('File error:', e.name);
}

A

Home: undefined
File: (contents of file.txt)

B

Env error: PermissionDenied
File: (contents of file.txt)

C

Env error: PermissionDenied
File error: PermissionDenied

D

Home: (value of HOME)
File error: PermissionDenied

💡 Hint

Which permissions does --allow-read grant? Does it include environment variables?

--allow-read grants file read access but not environment variable access. Accessing env variables without --allow-env causes PermissionDenied error.

Practice

1. Why does Deno block file and network access by default?

easy

A. To protect your computer from harmful or unknown code

B. Because it does not support file or network operations

C. To make programs run faster

D. Because it only runs in offline mode

Solution

1. Step 1: Understand Deno's security design

   Deno is designed to be secure by default to protect users from running unsafe code.

2. Step 2: Reason about default blocking

   Blocking file and network access prevents malicious code from harming your system without permission.

3. Final Answer:

   To protect your computer from harmful or unknown code -> Option A

4. Quick Check:

   Security by default = Protect computer [OK]

Hint: Deno blocks risky actions to keep your system safe [OK]

Common Mistakes:

• Thinking Deno lacks file/network features
• Assuming blocking improves speed
• Believing Deno runs only offline

2. Which command correctly runs a Deno script with permission to read files?

easy

A. deno run --allow-file script.ts

B. deno run --allow-read script.ts

C. deno run --read script.ts

D. deno run --file-access script.ts

Solution

1. Step 1: Recall Deno permission flags

   Deno uses flags like --allow-read to grant file read access explicitly.

2. Step 2: Identify correct syntax

   Only --allow-read is the valid flag to allow reading files in Deno.

3. Final Answer:

   deno run --allow-read script.ts -> Option B

4. Quick Check:

   File read permission flag = --allow-read [OK]

Hint: Use --allow-read to permit file reading in Deno [OK]

Common Mistakes:

• Using incorrect flags like --read or --allow-file
• Forgetting to add permission flags
• Confusing permission flag names

3. What will happen if you run this Deno script without any permission flags?

console.log(Deno.readTextFileSync("data.txt"));

medium

A. It prints the contents of data.txt

B. It runs without any output

C. It creates data.txt if missing

D. It throws a permission error

Solution

1. Step 1: Understand default permissions

   Deno blocks file reading unless --allow-read is given.

2. Step 2: Predict script behavior without permissions

   Trying to read a file without permission causes a runtime permission error.

3. Final Answer:

   It throws a permission error -> Option D

4. Quick Check:

   No permission = permission error [OK]

Hint: No --allow-read means file read causes error [OK]

Common Mistakes:

• Assuming file reads succeed without permission
• Thinking file is created automatically
• Expecting silent failure without error

4. You run this command but get a permission error:
deno run script.ts
How do you fix it to allow network access?

medium

A. No fix needed, network is allowed by default

B. Add --allow-network flag to the command

C. Add --allow-net flag to the command

D. Add --net-access flag to the command

Solution

1. Step 1: Identify correct network permission flag

   Deno requires --allow-net to permit network access explicitly.

2. Step 2: Correct the command

   Adding --allow-net fixes the permission error for network operations.

3. Final Answer:

   Add --allow-net flag to the command -> Option C

4. Quick Check:

   Network permission flag = --allow-net [OK]

Hint: Use --allow-net to enable network access in Deno [OK]

Common Mistakes:

• Using wrong flag like --allow-network or --net-access
• Assuming network is allowed by default
• Not adding any permission flag

5. You want to run a Deno script that reads a file and makes a network request. Which command grants the minimum permissions needed?

hard

A. deno run --allow-read --allow-net script.ts

B. deno run --allow-all script.ts

C. deno run --allow-write --allow-net script.ts

D. deno run --allow-read script.ts

Solution

1. Step 1: Identify required permissions

   Reading a file needs --allow-read; network requests need --allow-net.

2. Step 2: Choose minimal permissions

   --allow-read and --allow-net together grant only needed access, no extras.

3. Step 3: Eliminate incorrect options

   --allow-all grants too much; --allow-write is unnecessary; --allow-read alone misses network.

4. Final Answer:

   deno run --allow-read --allow-net script.ts -> Option A

5. Quick Check:

   Minimal needed permissions = --allow-read + --allow-net [OK]

Hint: Grant only needed permissions: read + net for this script [OK]

Common Mistakes:

• Using --allow-all when minimal is better
• Confusing --allow-write with --allow-read
• Forgetting network permission