Why Deno is secure by default - Visual Breakdown

Concept Flow - Why Deno is secure by default

Start Deno Script

↓

Check Permissions

↓

Has Permission?

No→Block Access & Show Error

Yes↓

Allow Script to Access Resource

↓

Execute Script with Granted Permissions

↓

End

Deno first checks if the script has permission to access resources. If not, it blocks access and shows an error. If yes, it allows access and runs the script.

Execution Sample

Deno

console.log("Reading file...");
const data = await Deno.readTextFile("secret.txt");
console.log(data);

This code tries to read a file. Deno checks if permission is granted before reading.

Execution Table

Step	Action	Permission Check	Result	Output
1	Start script	N/A	N/A	No output yet
2	Attempt to read 'secret.txt'	Check read permission	Permission denied	Error: PermissionDenied: read access to 'secret.txt' is not allowed
3	Script stops due to error	N/A	N/A	Script terminated
4	Run script with --allow-read flag	Check read permission	Permission granted	Reads file content
5	Print file content	N/A	N/A	File content displayed

💡 Script stops if permission is denied; runs normally if permission is granted.

Variable Tracker

Variable	Start	After Step 2	After Step 4	After Step 5
data	undefined	undefined (error)	file content string	file content string

Key Moments - 2 Insights

Why does the script stop with a permission error at step 2?

Because Deno checks permissions before accessing resources. Without explicit permission, it blocks access as shown in step 2 of the execution table.

What changes when running the script with the --allow-read flag?

The permission check passes, allowing the script to read the file and continue execution, as seen in steps 4 and 5.

Visual Quiz - 3 Questions

Look at the execution table, what is the output at step 2 when no permission is given?

A File content displayed

B No output yet

C Error: PermissionDenied: read access to 'secret.txt' is not allowed

D Script runs normally

💡 Hint

Check the 'Output' column at step 2 in the execution table.

At which step does the script successfully read the file content?

A Step 4

B Step 3

C Step 2

D Step 1

💡 Hint

Look for 'Permission granted' and 'Reads file content' in the execution table.

If you remove the --allow-read flag, how does the variable 'data' change after step 2?

A It contains the file content string

B It remains undefined due to error

C It becomes null

D It is set to an empty string

💡 Hint

Refer to the variable_tracker for 'data' after step 2.

Concept Snapshot

Deno is secure by default.
It blocks access to files, network, and environment unless permissions are explicitly granted.
Use flags like --allow-read to grant access.
If permission is missing, Deno stops the script with an error.
This protects your system from unsafe code.

Full Transcript

When you run a Deno script, it first checks if the script has permission to access resources like files or network. If the script tries to read a file without permission, Deno blocks the access and shows an error, stopping the script. To allow access, you must run the script with flags like --allow-read. Then, Deno grants permission and the script can read the file and continue. This security model helps protect your computer by default.

Practice

1. Why does Deno block file and network access by default?

easy

A. To protect your computer from harmful or unknown code

B. Because it does not support file or network operations

C. To make programs run faster

D. Because it only runs in offline mode

Solution

1. Step 1: Understand Deno's security design

   Deno is designed to be secure by default to protect users from running unsafe code.

2. Step 2: Reason about default blocking

   Blocking file and network access prevents malicious code from harming your system without permission.

3. Final Answer:

   To protect your computer from harmful or unknown code -> Option A

4. Quick Check:

   Security by default = Protect computer [OK]

Hint: Deno blocks risky actions to keep your system safe [OK]

Common Mistakes:

• Thinking Deno lacks file/network features
• Assuming blocking improves speed
• Believing Deno runs only offline

2. Which command correctly runs a Deno script with permission to read files?

easy

A. deno run --allow-file script.ts

B. deno run --allow-read script.ts

C. deno run --read script.ts

D. deno run --file-access script.ts

Solution

1. Step 1: Recall Deno permission flags

   Deno uses flags like --allow-read to grant file read access explicitly.

2. Step 2: Identify correct syntax

   Only --allow-read is the valid flag to allow reading files in Deno.

3. Final Answer:

   deno run --allow-read script.ts -> Option B

4. Quick Check:

   File read permission flag = --allow-read [OK]

Hint: Use --allow-read to permit file reading in Deno [OK]

Common Mistakes:

• Using incorrect flags like --read or --allow-file
• Forgetting to add permission flags
• Confusing permission flag names

3. What will happen if you run this Deno script without any permission flags?

console.log(Deno.readTextFileSync("data.txt"));

medium

A. It prints the contents of data.txt

B. It runs without any output

C. It creates data.txt if missing

D. It throws a permission error

Solution

1. Step 1: Understand default permissions

   Deno blocks file reading unless --allow-read is given.

2. Step 2: Predict script behavior without permissions

   Trying to read a file without permission causes a runtime permission error.

3. Final Answer:

   It throws a permission error -> Option D

4. Quick Check:

   No permission = permission error [OK]

Hint: No --allow-read means file read causes error [OK]

Common Mistakes:

• Assuming file reads succeed without permission
• Thinking file is created automatically
• Expecting silent failure without error

4. You run this command but get a permission error:
deno run script.ts
How do you fix it to allow network access?

medium

A. No fix needed, network is allowed by default

B. Add --allow-network flag to the command

C. Add --allow-net flag to the command

D. Add --net-access flag to the command

Solution

1. Step 1: Identify correct network permission flag

   Deno requires --allow-net to permit network access explicitly.

2. Step 2: Correct the command

   Adding --allow-net fixes the permission error for network operations.

3. Final Answer:

   Add --allow-net flag to the command -> Option C

4. Quick Check:

   Network permission flag = --allow-net [OK]

Hint: Use --allow-net to enable network access in Deno [OK]

Common Mistakes:

• Using wrong flag like --allow-network or --net-access
• Assuming network is allowed by default
• Not adding any permission flag

5. You want to run a Deno script that reads a file and makes a network request. Which command grants the minimum permissions needed?

hard

A. deno run --allow-read --allow-net script.ts

B. deno run --allow-all script.ts

C. deno run --allow-write --allow-net script.ts

D. deno run --allow-read script.ts

Solution

1. Step 1: Identify required permissions

   Reading a file needs --allow-read; network requests need --allow-net.

2. Step 2: Choose minimal permissions

   --allow-read and --allow-net together grant only needed access, no extras.

3. Step 3: Eliminate incorrect options

   --allow-all grants too much; --allow-write is unnecessary; --allow-read alone misses network.

4. Final Answer:

   deno run --allow-read --allow-net script.ts -> Option A

5. Quick Check:

   Minimal needed permissions = --allow-read + --allow-net [OK]

Hint: Grant only needed permissions: read + net for this script [OK]

Common Mistakes:

• Using --allow-all when minimal is better
• Confusing --allow-write with --allow-read
• Forgetting network permission