@@ -15,8 +15,8 @@ safe practices for the policy files such as ensuring that policy
15
15
files cannot be overwritten by the Node.js application by using
16
16
file permissions.
17
17
18
- A best practice would be to ensure that the policy manifest is read only for
19
- the running Node.js application, and that the file cannot be changed
18
+ A best practice would be to ensure that the policy manifest is read- only for
19
+ the running Node.js application and that the file cannot be changed
20
20
by the running Node.js application in any way. A typical setup would be to
21
21
create the policy file as a different user id than the one running Node.js
22
22
and granting read permissions to the user id running Node.js.
@@ -99,8 +99,8 @@ An example policy file that would allow loading a file `checked.js`:
99
99
Each resource listed in the policy manifest can be of one the following
100
100
formats to determine its location:
101
101
102
- 1 . A [ relative url string] [ ] to a resource from the manifest such as ` ./resource.js ` , ` ../resource.js ` , or ` /resource.js ` .
103
- 2 . A complete url string to a resource such as ` file:///resource.js ` .
102
+ 1 . A [ relative-URL string] [ ] to a resource from the manifest such as ` ./resource.js ` , ` ../resource.js ` , or ` /resource.js ` .
103
+ 2 . A complete URL string to a resource such as ` file:///resource.js ` .
104
104
105
105
When loading resources the entire URL must match including search parameters
106
106
and hash fragment. ` ./a.js?b ` will not be used when attempting to load
@@ -151,12 +151,12 @@ be used to find the module.
151
151
If the value of the redirection is a string, it will be resolved relative to
152
152
the manifest and then immediately be used without searching.
153
153
154
- Any specifier string that is attempted to resolved and not listed in the
154
+ Any specifier string that is attempted to resolve and not listed in the
155
155
dependencies will result in an error according to the policy.
156
156
157
157
Redirection will not prevent access to APIs through means such as direct access
158
158
to ` require.cache ` and/or through ` module.constructor ` which allow access to
159
- loading modules. Policy redirection only affect specifiers to ` require() ` and
159
+ loading modules. Policy redirection only affects specifiers to ` require() ` and
160
160
` import ` . Other means such as to prevent undesired access to APIs through
161
161
variables are necessary to lock down that path of loading modules.
162
162
@@ -165,15 +165,15 @@ module to load any specifier without redirection. This can be useful for local
165
165
development and may have some valid usage in production, but should be used
166
166
only with care after auditing a module to ensure its behavior is valid.
167
167
168
- Similar to ` "exports" ` in ` package.json ` dependencies can also be specified to
168
+ Similar to ` "exports" ` in ` package.json ` , dependencies can also be specified to
169
169
be objects containing conditions which branch how dependencies are loaded. In
170
- the above example ` "http" ` will be allowed when the ` "import" ` condition is
170
+ the preceding example, ` "http" ` will be allowed when the ` "import" ` condition is
171
171
part of loading it.
172
172
173
- A value of ` null ` for the resolved value will cause the resolution to fail.
174
- This can be used to ensure some kinds dynamic access are explicitly prevented.
173
+ A value of ` null ` for the resolved value will cause the resolution to fail. This
174
+ can be used to ensure some kinds of dynamic access are explicitly prevented.
175
175
176
- Unknown values for the resolved module location will cause failure, but are
176
+ Unknown values for the resolved module location will cause failure but are
177
177
not guaranteed to be forwards compatible.
178
178
179
179
#### Example: Patched dependency
@@ -200,10 +200,10 @@ module.exports = function fn(...args) {
200
200
201
201
Use the ` "scopes" ` field of a manifest to set configuration for many resources
202
202
at once. The ` "scopes" ` field works by matching resources by their segments.
203
- If a scope or resource includes ` "cascade": true ` unknown specifiers will
203
+ If a scope or resource includes ` "cascade": true ` , unknown specifiers will
204
204
be searched for in their containing scope. The containing scope for cascading
205
205
is found by recursively reducing the resource URL by removing segments for
206
- [ special schemes] [ ] , keeping trailing ` "/" ` suffixes and removing the query and
206
+ [ special schemes] [ ] , keeping trailing ` "/" ` suffixes, and removing the query and
207
207
hash fragment. This leads to the eventual reduction of the URL to its origin.
208
208
If the URL is non-special the scope will be located by the URL's origin. If no
209
209
scope is found for the origin or in the case of opaque origins, a protocol
@@ -216,7 +216,7 @@ origin of `blob:https://nodejs.org`; URLs starting with
216
216
thus ` https: ` for its protocol scope. For opaque origin ` blob: ` URLs they will
217
217
have ` blob: ` for their protocol scope since they do not adopt origins.
218
218
219
- #### Integrity Using Scopes
219
+ #### Integrity using scopes
220
220
221
221
Setting an integrity to ` true ` on a scope will set the integrity for any
222
222
resource not found in the manifest to ` true ` .
@@ -241,7 +241,7 @@ The following example allows loading any file:
241
241
}
242
242
```
243
243
244
- #### Dependency Redirection Using Scopes
244
+ #### Dependency redirection using scopes
245
245
246
246
The following example, would allow access to ` fs ` for all resources within
247
247
` ./app/ ` :
@@ -284,5 +284,5 @@ The following example, would allow access to `fs` for all `data:` resources:
284
284
}
285
285
```
286
286
287
- [ relative url string ] : https://url.spec.whatwg.org/#relative-url-with-fragment-string
287
+ [ relative-URL string ] : https://url.spec.whatwg.org/#relative-url-with-fragment-string
288
288
[ special schemes ] : https://url.spec.whatwg.org/#special-scheme
0 commit comments