<p dir="auto">Deno is marketed as “A secure JavaScript and TypeScript runtime” and the philosophy behind the flags disabling syscalls seems to be “Deno default behavior prevents you from shooting yourself in the foot security wise”.</p>
<p dir="auto">However, by default, Deno accepts to download libraries using http only. In other words, https is not enforced. There are two issues about this (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="372630088" data-permission-text="Title is private" data-url="https://github.com/denoland/deno/issues/1063" data-hovercard-type="issue" data-hovercard-url="/denoland/deno/issues/1063/hovercard" href="https://github.com/denoland/deno/issues/1063">#1063</a> and <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="372681712" data-permission-text="Title is private" data-url="https://github.com/denoland/deno/issues/1064" data-hovercard-type="issue" data-hovercard-url="/denoland/deno/issues/1064/hovercard" href="https://github.com/denoland/deno/issues/1064">#1064</a>).<br>
The first one, has been dismissed with the argument that: [Deno] “should follow the browser conventions here - using a script tag to import http is allowed.” The other one is still open but has not had any activity in a couple months.</p>
<p dir="auto">As long as a Deno process instantiates a module with an http import, a “man in the middle attack” is possible:</p>
<p dir="auto">It means it is possible to tamper with the code of the module that is downloaded. Even if Deno has implemented integrity checks for modules, there are still some key attack vectors.</p>
<p dir="auto">As I understand, there are still two cases when integrity checks are not enforced: The first download of a lib and the update of a lib. Moreover, even in the cases where integrity checks are enforced, someone could just prevent you from downloading this module, or do something even nastier: send garbage for an infinite time.<br>
In this last case (according to a test I ran on 1.0.0-rc3), Deno will just be stuck forever downloading the module while seeing its RSS increase until something stops it (user or OS). In this case, any dependency (or sub dependency) could selectively prevent Deno apps from installing , reaching actually a Denial of Service case. (Service being, having Deno running the code).</p>
<p dir="auto">Another attack: someone could eavesdrop on the module that is being downloaded. Eventually, Deno users will use authentication to download certain modules. Over http, the credentials will be transmitted in clear. It is noticeable that the popular (and very cool) package manager <a class="user-mention notranslate" data-hovercard-type="organization" data-hovercard-url="/orgs/yarnpkg/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/yarnpkg">@yarnpkg</a> has been having an issue with this (see <a title="CVE-2019-5448" data-hovercard-type="advisory" data-hovercard-url="/advisories/GHSA-wqfc-cr59-h64p/hovercard" href="https://github.com/advisories/GHSA-wqfc-cr59-h64p">CVE-2019-5448</a>). It is very possible that someone will actually fill a CVE against Deno on that exact topic at one point.</p>
<p dir="auto">All of that can be introduced by importing a library in https that would actually import another one using http only.</p>
<p dir="auto">Overall, It’s pretty easy to fix. It should just “by default, disallow http for module resolution”. Maybe a flag could be used to re-enable it, following what I understand is the philosophy of the project regarding security flags. This would be a breaking change however.</p>
<p dir="auto">I saw that following the prototype pollution events in the JavaScript world, it was decided to remove <code class="notranslate">Object.prototype.__proto__</code> (see <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="580331580" data-permission-text="Title is private" data-url="https://github.com/denoland/deno/issues/4341" data-hovercard-type="pull_request" data-hovercard-url="/denoland/deno/pull/4341/hovercard" href="https://github.com/denoland/deno/pull/4341">#4341</a>). Actually, most browsers still support <code class="notranslate">__proto__</code> (<a href="https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/proto" rel="nofollow">https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/proto</a>).</p>
<p dir="auto">Here, the Deno team did the right thing, giving up browser compatibility to increase the default security level of the runtime. This is exactly the opposite of the decision taken regarding downloading modules using http only.</p>
<p dir="auto">IMO, this defeats Deno being “Secure” if browser compatibility is more important than security. Deno is not a web browser. Also, web browsers have benefited from a lot of features regarding security hardening. For instance, security headers <a href="https://owasp.org/www-project-secure-headers/" rel="nofollow">https://owasp.org/www-project-secure-headers/</a>. Most of this would not make sense in Deno but they are here to update these behaviors.</p>
<p dir="auto">(edit) Summary for ease of archieving:</p>
<ul dir="auto">
<li>current version of the project might be holding an instance of CWE-310 and/or CWE-311 out of similarity with <a title="CVE-2019-5448" data-hovercard-type="advisory" data-hovercard-url="/advisories/GHSA-wqfc-cr59-h64p/hovercard" href="https://github.com/advisories/GHSA-wqfc-cr59-h64p">CVE-2019-5448</a></li>
<li>current version of the project might be holding an instance of CWE-770</li>
</ul>
<p dir="auto">For security reasons? (I believe for script tags in browsers would show warnings on loading an http resource while the page is loaded under https)</p>