1
0
silverbullet/plugos/sandboxes/deno_worker_sandbox.ts

27 lines
886 B
TypeScript
Raw Normal View History

2024-01-14 12:38:39 +00:00
import { WorkerSandbox } from "./worker_sandbox.ts";
import type { SandboxFactory } from "./sandbox.ts";
2022-10-12 09:47:13 +00:00
// Uses Deno's permissions to lock the worker down significantly
export function createSandbox<HookT>(workerUrl: URL): SandboxFactory<HookT> {
return (plug) =>
new WorkerSandbox(plug, workerUrl, {
deno: {
permissions: {
// Allow network access
net: true,
// This is required for console logging to work, apparently?
env: true,
// No talking to native code
ffi: false,
// No invocation of shell commands
run: false,
// No read access to the file system
read: false,
// No write access to the file system
write: false,
},
2022-10-17 13:56:47 +00:00
},
// Have to do this because the "deno" option is not standard and doesn't typecheck yet
});
}