feat: Deno.execPath() no longer requires --allow-read permission (#29620)

This commit changes `Deno.execPath()` API to no longer require
read permission.

This change is dictated by the fact that in common scenarios, requiring
read permission is less secure than not requiring permissions - if
a user wants to spawn a Deno subprocess using the current executable,
they would do something like:

```
new Deno.Command(Deno.execPath(), { args: ["eval", "1+1"] }).outputSync();
```

To run this program, currently one needs to pass `--allow-read
--allow-run=deno` flags.
It's possible to limit scope of `--allow-read` flag, but it's really
cumbersome to do,
so most users will opt to give a blanket `--allow-read` permission.

Not requiring read permissions allows the above program to be run with
just `--allow-run=deno` flag.

This change is in similar to relaxing of permissions in `Deno.cwd()` API
done in https://github.com/denoland/deno/pull/27192.

Ref
https://github.com/denoland/deno/issues/20061#issuecomment-2942497783
This commit is contained in:
Bartek Iwańczuk 2025-06-25 20:57:35 +02:00 committed by GitHub
parent d4b02455df
commit f781796402
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 3 additions and 19 deletions

View file

@ -1591,9 +1591,6 @@ declare namespace Deno {
* console.log(Deno.execPath()); // e.g. "/home/alice/.local/bin/deno"
* ```
*
* Requires `allow-read` permission.
*
* @tags allow-read
* @category Runtime
*/
export function execPath(): string;