Repository: denoland/deno
File: cli/args/flags.rs (Rust)

Code before:
  if let Some(read_wl) = matches.remove_many::<String>("deny-read") {
    flags.permissions.deny_read = Some(read_wl.collect());
  }

  if let Some(write_wl) = matches.remove_many::<String>("allow-write") {
    flags.permissions.allow_write = Some(write_wl.collect());
  }

  if let Some(write_wl) = matches.remove_many::<String>("deny-write") {
    flags.permissions.deny_write = Some(write_wl.collect());
  }

  if let Some(net_wl) = matches.remove_many::<String>("allow-net") {
    let net_allowlist = flags_net::parse(net_wl.collect()).unwrap();
    flags.permissions.allow_net = Some(net_allowlist);
  }

  if let Some(net_wl) = matches.remove_many::<String>("deny-net") {
    let net_denylist = flags_net::parse(net_wl.collect()).unwrap();
    flags.permissions.deny_net = Some(net_denylist);
  }

  if let Some(env_wl) = matches.remove_many::<String>("allow-env") {
    let env_permissions: Vec<String> = env_wl.collect();
    for env_var in &env_permissions {
      if env_var.contains('*') {
        if let Err(e) =
          deno_runtime::deno_permissions::add_wildcard_permission(env_var)
        {
          error!("Failed to add wildcard permission: {}", e);
        }
      }
    }

    flags.permissions.allow_env = Some(env_permissions);
    debug!("env allowlist: {:#?}", &flags.permissions.allow_env);
  }

  if let Some(env_wl) = matches.remove_many::<String>("deny-env") {
    flags.permissions.deny_env = Some(env_wl.collect());
    debug!("env denylist: {:#?}", &flags.permissions.deny_env);
  }

  if let Some(run_wl) = matches.remove_many::<String>("allow-run") {
    flags.permissions.allow_run = Some(run_wl.collect());
    debug!("run allowlist: {:#?}", &flags.permissions.allow_run);
  }

  if let Some(run_wl) = matches.remove_many::<String>("deny-run") {
    flags.permissions.deny_run = Some(run_wl.collect());
    debug!("run denylist: {:#?}", &flags.permissions.deny_run);

Review comment (suggestion):
`--allow-env=*` makes no sense because it's equal to `--allow-env`. If we are to support "wildcards" in env var names it should only be at the begging or end (`AWS_*`, `*_DENO`)

Code after:
    },
    fix,
    rules,
    maybe_rules_tags,
    maybe_rules_include,
    maybe_rules_exclude,
    json,
    compact,
    watch: watch_arg_parse(matches)?,
  });
  Ok(())
}

fn repl_parse(
  flags: &mut Flags,
  matches: &mut ArgMatches,
) -> clap::error::Result<()> {
  unstable_args_parse(flags, matches, UnstableArgsConfig::ResolutionAndRuntime);
  compile_args_without_check_parse(flags, matches)?;
  cached_only_arg_parse(flags, matches);
  frozen_lockfile_arg_parse(flags, matches);
  permission_args_parse(flags, matches)?;
  inspect_arg_parse(flags, matches);
  location_arg_parse(flags, matches);
  v8_flags_arg_parse(flags, matches);
  seed_arg_parse(flags, matches);
  enable_testing_features_arg_parse(flags, matches);
  env_file_arg_parse(flags, matches);
  strace_ops_parse(flags, matches);

  let eval_files = matches
    .remove_many::<String>("eval-file")
    .map(|values| {
      values
        .flat_map(flat_escape_split_commas)
        .collect::<Result<Vec<_>, _>>()
    })
    .transpose()?;

  if let Some(args) = matches.remove_many::<String>("args") {
    flags.argv.extend(args);
  }

  handle_repl_flags(
    flags,
    ReplFlags {
      eval_files,
      eval: matches.remove_one::<String>("eval"),
      is_default_command: false,
    },
  );