FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

permission: check final report output path · nodejs/node@6122200 · GitHub

/ node Public

Commit 6122200

Browse files
RafaelGSS
committed
permission: check final report output path
Refs: https://hackerone.com/reports/3815767 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: nodejs-private/node-private#908 CVE-ID: CVE-2026-58039
1 parent 8f66692 commit 6122200

3 files changed

Lines changed: 86 additions & 18 deletions

File tree

‎lib/internal/process/report.js‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ const {
99
ERR_SYNTHETIC,
1010
} = require('internal/errors').codes;
1111
const { getValidatedPath } = require('internal/fs/utils');
12+
const { sep } = require('path');
1213
const permission = require('internal/process/permission');
1314
const {
1415
validateBoolean,
@@ -29,7 +30,14 @@ const report = {
2930
}
3031

3132
if (permission.isEnabled()) {
32-
const resource = file ?? process.cwd();
33+
let resource = file;
34+
if (resource !== undefined) {
35+
const directory = nr.getDirectory();
36+
if (directory !== '')
37+
resource = `${directory}${sep}${resource}`;
38+
} else {
39+
resource = process.cwd();
40+
}
3341
if (!permission.has('fs.write', resource)) {
3442
throw new ERR_ACCESS_DENIED(
3543
'Access to this API has been restricted',

‎src/node_report.cc‎

Lines changed: 12 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -835,13 +835,6 @@ std::string TriggerNodeReport(Isolate* isolate,
835835
// 1) supplied on API 2) configured on startup 3) default generated
836836
if (!name.empty()) {
837837
filename = name;
838-
// we may not always be in a great state when generating a node report
839-
// allow for the case where we don't have an env
840-
if (env != nullptr) {
841-
THROW_IF_INSUFFICIENT_PERMISSIONS(
842-
env, permission::PermissionScope::kFileSystemWrite, name, filename);
843-
// Filename was specified as API parameter.
844-
}
845838
} else {
846839
std::string report_filename;
847840
{
@@ -855,13 +848,6 @@ std::string TriggerNodeReport(Isolate* isolate,
855848
filename = *DiagnosticFilename(
856849
env != nullptr ? env->thread_id() : 0, "report", "json");
857850
}
858-
if (env != nullptr) {
859-
THROW_IF_INSUFFICIENT_PERMISSIONS(
860-
env,
861-
permission::PermissionScope::kFileSystemWrite,
862-
Environment::GetCwd(env->exec_path()),
863-
filename);
864-
}
865851
}
866852

867853
// Open the report file stream for writing. Supports stdout/err,
@@ -879,12 +865,21 @@ std::string TriggerNodeReport(Isolate* isolate,
879865
report_directory = per_process::cli_options->report_directory;
880866
}
881867
// Regular file. Append filename to directory path if one was specified
868+
std::string pathname;
882869
if (report_directory.length() > 0) {
883-
std::string pathname = report_directory + kPathSeparator + filename;
884-
outfile.open(pathname, std::ios::out | std::ios::binary);
870+
pathname = report_directory + kPathSeparator + filename;
885871
} else {
886-
outfile.open(filename, std::ios::out | std::ios::binary);
872+
pathname = filename;
887873
}
874+
875+
// We may not always be in a great state when generating a node report.
876+
// Allow for the case where we don't have an env.
877+
if (env != nullptr) {
878+
THROW_IF_INSUFFICIENT_PERMISSIONS(
879+
env, permission::PermissionScope::kFileSystemWrite, pathname, "");
880+
}
881+
882+
outfile.open(pathname, std::ios::out | std::ios::binary);
888883
// Check for errors on the file open
889884
if (!outfile.is_open()) {
890885
std::cerr << "\nFailed to open Node.js report file: " << filename;

‎test/parallel/test-permission-fs-write-report.js‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ if (!process.permission) {
2323
}
2424

2525
const assert = require('assert');
26+
const fs = require('fs');
2627
const path = require('path');
2728
const tmpdir = require('../common/tmpdir');
2829

@@ -73,3 +74,67 @@ spawnSyncAndExitWithoutError(
7374
],
7475
{ cwd: tmpdir.path }
7576
);
77+
78+
{
79+
const allowedDir = path.join(tmpdir.path, 'report-allowed');
80+
const deniedDir = path.join(tmpdir.path, 'report-denied');
81+
fs.mkdirSync(allowedDir);
82+
fs.mkdirSync(deniedDir);
83+
84+
const deniedFile = path.join(deniedDir, 'report.json');
85+
fs.writeFileSync(deniedFile, 'existing content');
86+
spawnSyncAndExitWithoutError(
87+
process.execPath,
88+
[
89+
'--permission',
90+
'--allow-fs-read=*',
91+
`--allow-fs-write=${allowedDir}`,
92+
'-e',
93+
`
94+
const assert = require('assert');
95+
process.report.directory = ${JSON.stringify(deniedDir)};
96+
assert.throws(() => {
97+
process.report.writeReport('report.json');
98+
}, {
99+
code: 'ERR_ACCESS_DENIED',
100+
permission: 'FileSystemWrite',
101+
resource: ${JSON.stringify(deniedFile)},
102+
});
103+
`,
104+
],
105+
{ cwd: allowedDir },
106+
);
107+
assert.strictEqual(fs.readFileSync(deniedFile, 'utf8'), 'existing content');
108+
}
109+
110+
{
111+
const allowedDir = path.join(tmpdir.path, 'report-filename-allowed');
112+
const deniedDir = path.join(tmpdir.path, 'report-filename-denied');
113+
fs.mkdirSync(allowedDir);
114+
fs.mkdirSync(deniedDir);
115+
116+
const deniedFile = path.join(deniedDir, 'report.json');
117+
spawnSyncAndExitWithoutError(
118+
process.execPath,
119+
[
120+
'--permission',
121+
'--allow-fs-read=*',
122+
`--allow-fs-write=${allowedDir}`,
123+
'-e',
124+
`
125+
const assert = require('assert');
126+
process.report.directory = ${JSON.stringify(deniedDir)};
127+
process.report.filename = 'report.json';
128+
assert.throws(() => {
129+
process.report.writeReport();
130+
}, {
131+
code: 'ERR_ACCESS_DENIED',
132+
permission: 'FileSystemWrite',
133+
resource: ${JSON.stringify(deniedFile)},
134+
});
135+
`,
136+
],
137+
{ cwd: allowedDir },
138+
);
139+
assert.strictEqual(fs.existsSync(deniedFile), false);
140+
}

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL