Deno: Node.js alternative for running webR

[HenrikBengtsson]

Investigate whether we can run webR via Deno (https://deno.com/; https://github.com/denoland/deno) instead of Node.js. Words are that it has been shown it works.

Deno comes with sandboxing features, which is one of the objectives with the rw project.

/ht @jeroen @georgestagg

[HenrikBengtsson]

Got it to work, e.g.

$ deno run --quiet --allow-env --allow-read --allow-sys npm:@henrikbengtsson/rw --expr="1+2"
[1] 3

[HenrikBengtsson]

For the record, it's possible to lock down permissions further, e.g.

$ deno run --quiet --no-prompt \
    --allow-env="TEXT_ENCODING,TEXT_DECODER,WS_NO_BUFFER_UTIL" \
    --allow-sys="homedir" \
    --allow-read="$HOME/.cache/deno/npm/registry.npmjs.org/@henrikbengtsson/rw/0.0.111/package.json,$HOME/.cache/deno/npm/registry.npmjs.org/webr/0.5.8/dist/" \
    --allow-read=".rwconfig,../.rwconfig,$HOME/.rwconfig" \
    --allow-read="$HOME/R/wasm32-unknown-emscripten-library/4.5/" \
    --allow-read="bastion/" \
    npm:@henrikbengtsson/rw --persistent --expr="1+2"
[1] 3

Comment: The dynamic search for a .rconfig file up from $PWD complicates things. So do the r_libs_user and the bastion folders.

[HenrikBengtsson]

Using:

deno_rw() {
deno run --quiet --no-prompt \
    --allow-env="TEXT_ENCODING,TEXT_DECODER,WS_NO_BUFFER_UTIL" \
    --allow-sys="homedir" \
    --allow-read="$HOME/.cache/deno/npm/registry.npmjs.org/@henrikbengtsson/rw/0.0.111/package.json,$HOME/.cache/deno/npm/registry.npmjs.org/webr/0.5.8/dist/" \
    --allow-read=".rwconfig,../.rwconfig,$HOME/.rwconfig" \
    --allow-read="$HOME/R/wasm32-unknown-emscripten-library/4.5/" \
    --allow-read="bastion/" \
    npm:@henrikbengtsson/rw "$@"
}

escaping out from webR to host via webr::eval_js() is no longer possible. At least, the following basic attempts that work when using Node.js fail when using Deno:

$ deno_rw <<EOF
webr::eval_js('import("fs").then(m => 
  m.readFileSync("/home/alice/.ssh/id_ed25519", "utf8")
)', await = TRUE)
EOF

Error: An error occurred during JavaScript evaluation:
  Requires read access to "/home/alice/.ssh/id_ed25519", run again with the --allow-read flag

$ deno_rw <<EOF
webr::eval_js('import("fs").then(m => { 
  m.writeFileSync("/tmp/escape-test.txt", "written from webR"); 
  return "ok"; 
})', await = TRUE)
EOF

Error: An error occurred during JavaScript evaluation:
  Requires write access to "/tmp/escape-test.txt", run again with the --allow-write flag

$ deno_rw <<EOF
webr::eval_js('import("child_process").then(m => 
  m.execSync("id --user --name").toString()
)', await = TRUE)
EOF

Error: An error occurred during JavaScript evaluation:
  Requires env access, run again with the --allow-env flag

Nice!