nodejs
diff --git a/‎src/permission/fs_permission.h‎
Lines changed: 5 additions & 2 deletions b/‎src/permission/fs_permission.h‎
Lines changed: 5 additions & 2 deletions
diff --git a/‎test/parallel/test-permission-fs-read.js‎
Lines changed: 46 additions & 0 deletions b/‎test/parallel/test-permission-fs-read.js‎
Lines changed: 46 additions & 0 deletions
@@ -48,12 +48,13 @@ class FSPermission final : public PermissionBase {
           children[label] = new Node(path_prefix);
           return children[label];
         }
+        bool child_was_end_node = child->IsEndNode();
 
         // swap prefix
         size_t i = 0;
         size_t prefix_len = path_prefix.length();
         for (; i < child->prefix.length(); ++i) {
-          if (i > prefix_len || path_prefix[i] != child->prefix[i]) {
+          if (i >= prefix_len || path_prefix[i] != child->prefix[i]) {
             std::string parent_prefix = child->prefix.substr(0, i);
             std::string child_prefix = child->prefix.substr(i);
 
@@ -65,7 +66,9 @@ class FSPermission final : public PermissionBase {
             return split_child->CreateChild(path_prefix.substr(i));
           }
         }
-        child->is_leaf = true;
+        if (child_was_end_node) {
+          child->is_leaf = true;
+        }
         return child->CreateChild(path_prefix.substr(i));
       }
 
 
@@ -15,6 +15,7 @@ if (!common.hasCrypto) {
 const assert = require('assert');
 const fixtures = require('../common/fixtures');
 const tmpdir = require('../common/tmpdir');
+const fs = require('fs');
 const { spawnSync } = require('child_process');
 const path = require('path');
 
@@ -28,6 +29,51 @@ const commonPath = path.join(__filename, '../../common');
   tmpdir.refresh();
 }
 
+{
+  const boundaryFile = path.join(tmpdir.path, 'secret');
+  const grantedFiles = ['secret1', 'secret2', 'secret3']
+    .map((file) => path.join(tmpdir.path, file));
+
+  fs.writeFileSync(boundaryFile, 'protected');
+  for (const file of grantedFiles) {
+    fs.writeFileSync(file, 'granted');
+  }
+
+  const { status, stderr } = spawnSync(
+    process.execPath,
+    [
+      '--permission',
+      ...grantedFiles.map((file) => `--allow-fs-read=${file}`),
+      ...grantedFiles.map((file) => `--allow-fs-write=${file}`),
+      '-e',
+      `
+        const assert = require('assert');
+        const fs = require('fs');
+        const target = process.env.BOUNDARY_FILE;
+
+        assert.strictEqual(process.permission.has('fs.read', target), false);
+        assert.strictEqual(process.permission.has('fs.write', target), false);
+        assert.throws(
+          () => fs.readFileSync(target, 'utf8'),
+          { code: 'ERR_ACCESS_DENIED', permission: 'FileSystemRead' }
+        );
+        assert.throws(
+          () => fs.writeFileSync(target, 'modified'),
+          { code: 'ERR_ACCESS_DENIED', permission: 'FileSystemWrite' }
+        );
+      `,
+    ],
+    {
+      env: {
+        ...process.env,
+        BOUNDARY_FILE: boundaryFile,
+      },
+    }
+  );
+  assert.strictEqual(status, 0, stderr.toString());
+  assert.strictEqual(fs.readFileSync(boundaryFile, 'utf8'), 'protected');
+}
+
 {
   const { status, stderr } = spawnSync(
     process.execPath,
Original file line number	Diff line number	Diff line change
@@ -48,12 +48,13 @@ class FSPermission final : public PermissionBase {
48	48	children[label] = new Node(path_prefix);
49	49	return children[label];
50	50	}
	51	+ bool child_was_end_node = child->IsEndNode();
51	52
52	53	// swap prefix
53	54	size_t i = 0;
54	55	size_t prefix_len = path_prefix.length();
55	56	for (; i < child->prefix.length(); ++i) {
56		- if (i > prefix_len \|\| path_prefix[i] != child->prefix[i]) {
	57	+ if (i >= prefix_len \|\| path_prefix[i] != child->prefix[i]) {
57	58	std::string parent_prefix = child->prefix.substr(0, i);
58	59	std::string child_prefix = child->prefix.substr(i);
59	60
@@ -65,7 +66,9 @@ class FSPermission final : public PermissionBase {
65	66	return split_child->CreateChild(path_prefix.substr(i));
66	67	}
67	68	}
68		- child->is_leaf = true;
	69	+ if (child_was_end_node) {
	70	+ child->is_leaf = true;
	71	+ }
69	72	return child->CreateChild(path_prefix.substr(i));
70	73	}
71	74