Deno Permissions Model: Secure by Default Quiz Quiz

Discover how the Deno permissions model enforces secure-by-default scripting by requiring explicit access grants to sensitive resources. This quiz covers key permission flags, default restrictions, and practical scenarios in using Deno for robust application security.

1. Default Network Access Behavior

   When running a script without any permission flags, what is Deno's default behavior regarding network access (for example, making HTTP requests)?

   1. Network access is denied by default
   2. Network access is allowed with a warning
   3. Network access is temporarily allowed
   4. Network access is fully allowed

   Explanation: Deno denies network access by default unless you explicitly provide permission using the appropriate flag. Allowing network access with a warning is not Deno's approach; warnings are not used as a permission mechanism. Full or temporary allowances go against the secure-by-default model that Deno follows. Only explicitly granted permissions activate access to network resources.

2. Flag for Reading Local Files

   Which permission flag must be used to allow a Deno script to read files from the local filesystem, such as reading a configuration file?

   1. --file-access
   2. --permit-file
   3. --allow-read
   4. --enable-read

   Explanation: The --allow-read flag is required for enabling read access to the local filesystem in Deno. The other options, such as --permit-file, --enable-read, and --file-access, are incorrect; they may sound plausible but do not exist in Deno's permission system. Only the --allow-read flag activates file reading capability.

3. Permissions Request Example

   If a script tries to write to a local file without any permission flags, what will happen according to Deno's permission model?

   1. The operation is ignored without any notification
   2. A prompt asks the user to allow writing, but the operation succeeds
   3. The file is created silently
   4. The operation fails and an error message is shown

   Explanation: Without the appropriate write permission, Deno blocks file write attempts and displays an error. Silent file creation or ignoring the operation would undermine security, while prompting and automatically continuing is not Deno's approach by default. Explicit permission must be provided for writing.

4. Granular Resource Access

   How can you restrict Deno's --allow-read permission to only allow access to a specific folder, such as './data'?

   1. --allow-folder=./data
   2. --allow-read=./data
   3. --allow-read-limited ./data
   4. --read-folder=./data

   Explanation: By specifying --allow-read=./data, you restrict read permissions to the given directory. The other choices are not valid Deno syntax; --allow-read-limited, --read-folder, and --allow-folder are not recognized flags or are formatted incorrectly. Deno supports fine-grained permissions via equals syntax.

5. Flag for Accessing Environment Variables

   Which flag must be explicitly granted to enable a Deno script to access operating system environment variables, like reading a password from 'process.env'?

   1. --enable-env
   2. --allow-env
   3. --env-access
   4. --allow-vars

   Explanation: --allow-env is the correct and only flag for granting access to environment variables in Deno. The other options may sound plausible but are not supported by Deno's permission system. Accessing environment variables without permission is denied by default.

6. Running Subprocesses

   If your Deno script needs to execute a system command (such as starting another process), which permission must be given?

   1. --allow-cmd
   2. --enable-exec
   3. --permit-process
   4. --allow-run

   Explanation: Deno requires --allow-run to execute subprocesses. The other suggestions, like --allow-cmd, --enable-exec, and --permit-process, are not part of Deno's actual flag set and would result in errors if used. Without --allow-run, Deno will block any subprocess launches.

7. Using All Permissions

   What does the --allow-all flag do when running a Deno script?

   1. Enables only network permissions
   2. Grants all available permissions without restriction
   3. Allows only read and write access
   4. Revokes all permissions explicitly

   Explanation: --allow-all provides the script with unrestricted access to all controlled resource types such as file system, network, and environment. The other options are either incomplete or incorrect—restricting to just read/write or network would not fully allow all. Revoking permissions is the opposite of what the flag does.

8. Temporary Permission Prompts

   Can Deno prompt the user to allow a permission at runtime if it is not provided at launch by default?

   1. Only for file access, not other resources
   2. No, permissions must be granted explicitly at launch
   3. Yes, it always prompts when needed
   4. Always, but only if run with debug mode

   Explanation: Deno does not prompt for permissions at runtime by default; permissions must be provided using flags when the script is launched. Automatic prompts would not align with non-interactive or production environments. Options suggesting runtime prompts are not accurate for Deno's out-of-the-box behavior.

9. Inspecting Current Permissions

   Which Deno API can a script use within its code to check whether it currently has network access permission?

   1. Deno.permissionStatus('network')
   2. Deno.checkNet()
   3. Deno.allowNetStatus()
   4. Deno.permissions.query({ name: 'net' })

   Explanation: Deno.permissions.query allows you to programmatically check the status of a specific permission, such as 'net' for network. The distractors are not valid Deno APIs; allowNetStatus, checkNet, and permissionStatus do not exist in the permissions API. Only the query method serves this purpose.

10. Default Behavior Summary

    Which statement best summarizes Deno's default permissions when no flags are used at script launch?

    1. Environment variable access is always allowed
    2. All permissions are denied unless explicitly allowed
    3. Scripts can access only files in the current working directory
    4. File system and network access are enabled by default

    Explanation: Deno is secure by default, meaning that no sensitive permissions are granted unless specified via flags. The other options incorrectly suggest default access to certain resources, which would violate Deno's secure principles. Only explicit permissions activate resource access.