check net permission with hostname parameter

Author: kt3k

ext/node/lib.rs

@@ -312,7 +312,7 @@ deno_core::extension!(deno_node,
     ops::crypto::x509::op_node_x509_get_serial_number,
     ops::crypto::x509::op_node_x509_key_usage,
     ops::crypto::x509::op_node_x509_public_key,
-    ops::dns::op_getaddrinfo,
+    ops::dns::op_getaddrinfo<P>,
     ops::fs::op_node_fs_exists_sync<P>,
     ops::fs::op_node_fs_exists<P>,
     ops::fs::op_node_cp_sync<P>,

ext/node/ops/dns.rs

@@ -1,8 +1,13 @@
 // Copyright 2018-2025 the Deno authors. MIT license.
 
+use std::cell::RefCell;
+use std::rc::Rc;
 use std::str::FromStr;
 
 use deno_core::op2;
+use deno_core::OpState;
+use deno_error::JsError;
+use deno_permissions::PermissionCheckError;
 use hyper_util::client::legacy::connect::dns::GaiResolver;
 use hyper_util::client::legacy::connect::dns::Name;
 use serde::Serialize;
@@ -15,26 +20,37 @@ struct GetAddrInfoResult {
   address: String,
 }
 
-#[derive(Debug, thiserror::Error, deno_error::JsError)]
-#[class(generic)]
-#[error("Could not resolve the hostname '{hostname}'")]
-pub struct GetAddrInfoError {
-  hostname: String,
+#[derive(Debug, thiserror::Error, JsError)]
+pub enum GetAddrInfoError {
+  #[class(inherit)]
+  #[error(transparent)]
+  Permission(#[from] PermissionCheckError),
+  #[class(type)]
+  #[error("Could not resolve the hostname \"{0}\"")]
+  Resolution(String),
 }
 
 #[op2(async, stack_trace)]
 #[serde]
-pub async fn op_getaddrinfo(
+pub async fn op_getaddrinfo<P>(
+  state: Rc<RefCell<OpState>>,
   #[string] hostname: String,
-) -> Result<Vec<GetAddrInfoResult>, GetAddrInfoError> {
+) -> Result<Vec<GetAddrInfoResult>, GetAddrInfoError>
+where
+  P: crate::NodePermissions + 'static,
+{
+  {
+    let mut state_ = state.borrow_mut();
+    let permissions = state_.borrow_mut::<P>();
+    permissions.check_net((hostname.as_str(), None), "lookup")?;
+  }
   let mut resolver = GaiResolver::new();
-  let name = Name::from_str(&hostname).map_err(|_| GetAddrInfoError {
-    hostname: hostname.clone(),
-  })?;
+  let name = Name::from_str(&hostname)
+    .map_err(|_| GetAddrInfoError::Resolution(hostname.clone()))?;
   resolver
     .call(name)
     .await
-    .map_err(|_| GetAddrInfoError { hostname })
+    .map_err(|_| GetAddrInfoError::Resolution(hostname))
     .map(|addrs| {
       addrs
         .into_iter()