Sandboxing JK about jk HOT 4 CLOSED

You can write outside your own tree:

$ cat main.js 


const alice = {
  name: 'Alice',
  beverage: 'Club-Mate',
  monitors: 2,
  languages: [
    'python',
    'haskell',
    'c++',
    '68k assembly', // Alice is cool like that!
  ],
};

// Instruct to write the alice object as a YAML file.
export default [
  { value: alice, file: `../developers/${alice.name.toLowerCase()}.yaml` },
./jk generate main.js
# could be /etc/passwd!
 ls ../developers

from jk.

See #159

from jk.

Ulp yes, I noticed that reads are sandboxed but writes not yet, the other day while doing something tangential. They should get the same treatment (you can write under the output directory, but not outside it). I've filed #345 for this.

Re disallowing writes at all, what's the use case you have in mind, @alexec?

from jk.

I think sandboxing to the root would meet safety requirements.

from jk.