Commit 0566c3c
committed
permission: enforce fs write permission for trace events
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: nodejs-private/node-private#927
CVE-ID: CVE-2026-568471 parent f14d78b commit 0566c3c
9 files changed
Lines changed: 1186 additions & 13 deletions
File tree
- src
- tracing
- test
- ffi/fixture_library/build
- parallel
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -5,7 +5,9 @@ | |||
| 5 | 5 | #include "node_external_reference.h" | |
| 6 | 6 | #include "node_internals.h" | |
| 7 | 7 | #include "node_v8_platform-inl.h" | |
| 8 | + #include "permission/permission.h" | ||
| 8 | 9 | #include "tracing/agent.h" | |
| 10 | + #include "tracing/node_trace_writer.h" | ||
| 9 | 11 | #include "util-inl.h" | |
| 10 | 12 | ||
| 11 | 13 | #include <set> | |
@@ -84,6 +86,12 @@ void NodeCategorySet::Enable(const FunctionCallbackInfo<Value>& args) { | |||
| 84 | 86 | CHECK_NOT_NULL(category_set); | |
| 85 | 87 | const auto& categories = category_set->GetCategories(); | |
| 86 | 88 | if (!category_set->enabled_ && !categories.empty()) { | |
| 89 | + const std::string filepath = tracing::NodeTraceWriter::GetFilePath( | ||
| 90 | + per_process::cli_options->trace_event_file_pattern, 1); | ||
| 91 | + THROW_IF_INSUFFICIENT_PERMISSIONS( | ||
| 92 | + category_set->env(), | ||
| 93 | + permission::PermissionScope::kFileSystemWrite, | ||
| 94 | + filepath); | ||
| 87 | 95 | // Starts the Tracing Agent if it wasn't started already (e.g. through | |
| 88 | 96 | // a command line flag.) | |
| 89 | 97 | StartTracingAgent(); | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -8,9 +8,27 @@ | |||
| 8 | 8 | namespace node { | |
| 9 | 9 | namespace tracing { | |
| 10 | 10 | ||
| 11 | + void replace_substring(std::string* target, | ||
| 12 | + const std::string& search, | ||
| 13 | + const std::string& insert) { | ||
| 14 | + size_t pos = target->find(search); | ||
| 15 | + for (; pos != std::string::npos; pos = target->find(search, pos)) { | ||
| 16 | + target->replace(pos, search.size(), insert); | ||
| 17 | + pos += insert.size(); | ||
| 18 | + } | ||
| 19 | + } | ||
| 20 | + | ||
| 11 | 21 | NodeTraceWriter::NodeTraceWriter(const std::string& log_file_pattern) | |
| 12 | 22 | : log_file_pattern_(log_file_pattern) {} | |
| 13 | 23 | ||
| 24 | + std::string NodeTraceWriter::GetFilePath(const std::string& log_file_pattern, | ||
| 25 | + int file_num) { | ||
| 26 | + std::string filepath(log_file_pattern); | ||
| 27 | + replace_substring(&filepath, "${pid}", std::to_string(uv_os_getpid())); | ||
| 28 | + replace_substring(&filepath, "${rotation}", std::to_string(file_num)); | ||
| 29 | + return filepath; | ||
| 30 | + } | ||
| 31 | + | ||
| 14 | 32 | void NodeTraceWriter::InitializeOnThread(uv_loop_t* loop) { | |
| 15 | 33 | CHECK_NULL(tracing_loop_); | |
| 16 | 34 | tracing_loop_ = loop; | |
@@ -60,25 +78,13 @@ NodeTraceWriter::~NodeTraceWriter() { | |||
| 60 | 78 | } | |
| 61 | 79 | } | |
| 62 | 80 | ||
| 63 | - void replace_substring(std::string* target, | ||
| 64 | - const std::string& search, | ||
| 65 | - const std::string& insert) { | ||
| 66 | - size_t pos = target->find(search); | ||
| 67 | - for (; pos != std::string::npos; pos = target->find(search, pos)) { | ||
| 68 | - target->replace(pos, search.size(), insert); | ||
| 69 | - pos += insert.size(); | ||
| 70 | - } | ||
| 71 | - } | ||
| 72 | - | ||
| 73 | 81 | void NodeTraceWriter::OpenNewFileForStreaming() { | |
| 74 | 82 | ++file_num_; | |
| 75 | 83 | uv_fs_t req; | |
| 76 | 84 | ||
| 77 | 85 | // Evaluate a JS-style template string, it accepts the values ${pid} and | |
| 78 | 86 | // ${rotation} | |
| 79 | - std::string filepath(log_file_pattern_); | ||
| 80 | - replace_substring(&filepath, "${pid}", std::to_string(uv_os_getpid())); | ||
| 81 | - replace_substring(&filepath, "${rotation}", std::to_string(file_num_)); | ||
| 87 | + std::string filepath(GetFilePath(log_file_pattern_, file_num_)); | ||
| 82 | 88 | ||
| 83 | 89 | if (fd_ != -1) { | |
| 84 | 90 | CHECK_EQ(uv_fs_close(nullptr, &req, fd_, nullptr), 0); | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -19,6 +19,9 @@ class NodeTraceWriter : public AsyncTraceWriter { | |||
| 19 | 19 | explicit NodeTraceWriter(const std::string& log_file_pattern); | |
| 20 | 20 | ~NodeTraceWriter() override; | |
| 21 | 21 | ||
| 22 | + static std::string GetFilePath(const std::string& log_file_pattern, | ||
| 23 | + int file_num); | ||
| 24 | + | ||
| 22 | 25 | void InitializeOnThread(uv_loop_t* loop) override; | |
| 23 | 26 | void AppendTraceEvent(TraceObject* trace_event) override; | |
| 24 | 27 | void Flush(bool blocking) override; | |
0 commit comments