gen-policy

PoC of Node.js Policies generator

Disclaimer:
This repository was created as a Proof of Concept(PoC). It's not recommended to use it in a production.

What is Policies?

Policies are a security feature intended to allow guarantees about what code Node.js is able to load. The use of policies assumes safe practices for the policy files such as ensuring that policy files cannot be overwritten by the Node.js application by using file permissions.

— Policies | Node.js v13.5.0 Documentation

Install

npm install gen-policy

Usage

To get help, run the following command: gen-policy --help

gen-policy <entry>

Generate policy

Positionals:
  entry                                                                 [string]

Options:
  --help       Show help                                               [boolean]
  --version    Show version number                                     [boolean]
  --out-file   Output file name                [string] [default: "policy.json"]
  --out-dir    Output directory
               [string] [default: "/Users/leko/.ghq/github.com/Leko/gen-policy"]
  --onerror    Output path            [string] [choices: "exit", "throw", "log"]
  --force, -f  Always override even if output file already exists      [boolean]

Example

$ gen-policy fixtures/simple/entry.js
The policy file was saved to policy.json.
To run Node.js with this policy, run the following command:

  $ node --experimental-policy=policy.json --policy-integrity=sha384-7/6sD6FFTZwLUVDFjvmLmnZAGhogAgjd/yVoH4F12zEoNaqDxKiJEErcVmSPNIET fixtures/simple/entry.js

$ node --experimental-policy=policy.json --policy-integrity=sha384-7/6sD6FFTZwLUVDFjvmLmnZAGhogAgjd/yVoH4F12zEoNaqDxKiJEErcVmSPNIET fixtures/simple/entry.js
(node:17686) ExperimentalWarning: Policies are experimental.

Contribution

1. Fork this repository
2. Write your code
3. Run tests
4. Create pull request to master branch

Development

git clone [email protected]:Leko/gen-policy.git
cd gen-policy
npm i

Run tests

npm test

Run gen-policy locally

npx ts-node src/cli/index.ts ...

License

This package under MIT license.