nodejs
diff --git a/‎lib/fs.js‎
Lines changed: 4 additions & 2 deletions b/‎lib/fs.js‎
Lines changed: 4 additions & 2 deletions
diff --git a/‎lib/internal/process/permission.js‎
Lines changed: 8 additions & 2 deletions b/‎lib/internal/process/permission.js‎
Lines changed: 8 additions & 2 deletions
diff --git a/‎test/fixtures/permission/fs-read.js‎
Lines changed: 6 additions & 0 deletions b/‎test/fixtures/permission/fs-read.js‎
Lines changed: 6 additions & 0 deletions
diff --git a/‎test/fixtures/permission/fs-traversal.js‎
Lines changed: 10 additions & 0 deletions b/‎test/fixtures/permission/fs-traversal.js‎
Lines changed: 10 additions & 0 deletions
diff --git a/‎test/parallel/test-permission-has.js‎
Lines changed: 4 additions & 0 deletions b/‎test/parallel/test-permission-has.js‎
Lines changed: 4 additions & 0 deletions
@@ -1550,7 +1550,8 @@ function lstat(path, options = { bigint: false }, callback) {
   callback = makeStatsCallback(callback);
   path = getValidatedPath(path);
   if (permission.isEnabled() && !permission.has('fs.read', path)) {
-    callback(new ERR_ACCESS_DENIED('Access to this API has been restricted', 'FileSystemRead', path));
+    const resource = BufferIsBuffer(path) ? BufferToString(path) : path;
+    callback(new ERR_ACCESS_DENIED('Access to this API has been restricted', 'FileSystemRead', resource));
     return;
   }
 
@@ -1627,7 +1628,8 @@ function fstatSync(fd, options = { bigint: false }) {
 function lstatSync(path, options = { bigint: false, throwIfNoEntry: true }) {
   path = getValidatedPath(path);
   if (permission.isEnabled() && !permission.has('fs.read', path)) {
-    throw new ERR_ACCESS_DENIED('Access to this API has been restricted', 'FileSystemRead', path);
+    const resource = BufferIsBuffer(path) ? BufferToString(path) : path;
+    throw new ERR_ACCESS_DENIED('Access to this API has been restricted', 'FileSystemRead', resource);
   }
   const stats = binding.lstat(
     getValidatedPath(path),
 
@@ -5,7 +5,9 @@ const {
 } = primordials;
 
 const permission = internalBinding('permission');
-const { validateString } = require('internal/validators');
+const { validateString, validateBuffer } = require('internal/validators');
+const { Buffer } = require('buffer');
+const { isBuffer } = Buffer;
 
 let experimentalPermission;
 
@@ -22,7 +24,11 @@ module.exports = ObjectFreeze({
     validateString(scope, 'scope');
     if (reference != null) {
       // TODO: add support for WHATWG URLs and Uint8Arrays.
-      validateString(reference, 'reference');
+      if (isBuffer(reference)) {
+        validateBuffer(reference, 'reference');
+      } else {
+        validateString(reference, 'reference');
+      }
     }
 
     return permission.has(scope, reference);
 
@@ -7,6 +7,7 @@ const fs = require('fs');
 const path = require('path');
 
 const blockedFile = process.env.BLOCKEDFILE;
+const bufferBlockedFile = Buffer.from(process.env.BLOCKEDFILE);
 const blockedFileURL = new URL('file://' + process.env.BLOCKEDFILE);
 const blockedFolder = process.env.BLOCKEDFOLDER;
 const allowedFolder = process.env.ALLOWEDFOLDER;
@@ -408,6 +409,11 @@ const regularFile = __filename;
   }, common.expectsError({
     code: 'ERR_ACCESS_DENIED',
   }));
+  assert.throws(() => {
+    fs.lstatSync(bufferBlockedFile);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+  }));
 
   // doesNotThrow
   fs.lstat(regularFile, (err) => {
 
@@ -69,6 +69,16 @@ const uint8ArrayTraversalPath = new TextEncoder().encode(traversalPath);
   }));
 }
 
+{
+  fs.lstat(bufferTraversalPath, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    // lstat checks and throw on JS side.
+    // resource is only resolved on C++ (is_granted)
+    resource: bufferTraversalPath.toString(),
+  }));
+}
+
 {
   fs.readFile(uint8ArrayTraversalPath, common.expectsError({
     code: 'ERR_ACCESS_DENIED',
 
@@ -21,3 +21,7 @@ const assert = require('assert');
     message: 'The "reference" argument must be of type string. Received an instance of Object',
   }));
 }
+
+{
+  assert.ok(!process.permission.has('FileSystemWrite', Buffer.from('reference')));
+}
Original file line number	Diff line number	Diff line change
@@ -21,3 +21,7 @@ const assert = require('assert');
21	21	message: 'The "reference" argument must be of type string. Received an instance of Object',
22	22	}));
23	23	}
	24	+
	25	+ {
	26	+ assert.ok(!process.permission.has('FileSystemWrite', Buffer.from('reference')));
	27	+ }