Commit a1bbc24
permission: handle process.chdir on writereport
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: nodejs-private/node-private#870
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48617
Refs: https://hackerone.com/reports/36259871 parent 9224427 commit a1bbc24
2 files changed
Lines changed: 54 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -5,9 +5,11 @@ const { | |||
| 5 | 5 | } = primordials; | |
| 6 | 6 | ||
| 7 | 7 | const { | |
| 8 | + ERR_ACCESS_DENIED, | ||
| 8 | 9 | ERR_SYNTHETIC, | |
| 9 | 10 | } = require('internal/errors').codes; | |
| 10 | 11 | const { getValidatedPath } = require('internal/fs/utils'); | |
| 12 | + const permission = require('internal/process/permission'); | ||
| 11 | 13 | const { | |
| 12 | 14 | validateBoolean, | |
| 13 | 15 | validateObject, | |
@@ -26,6 +28,17 @@ const report = { | |||
| 26 | 28 | file = getValidatedPath(file); | |
| 27 | 29 | } | |
| 28 | 30 | ||
| 31 | + if (permission.isEnabled()) { | ||
| 32 | + const resource = file ?? process.cwd(); | ||
| 33 | + if (!permission.has('fs.write', resource)) { | ||
| 34 | + throw new ERR_ACCESS_DENIED( | ||
| 35 | + 'Access to this API has been restricted', | ||
| 36 | + 'FileSystemWrite', | ||
| 37 | + resource, | ||
| 38 | + ); | ||
| 39 | + } | ||
| 40 | + } | ||
| 41 | + | ||
| 29 | 42 | if (err === undefined) { | |
| 30 | 43 | err = new ERR_SYNTHETIC(); | |
| 31 | 44 | } else { | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -1,7 +1,7 @@ | |||
| 1 | - // Flags: --permission --allow-fs-read=* | ||
| 2 | 1 | 'use strict'; | |
| 3 | 2 | ||
| 4 | 3 | const common = require('../common'); | |
| 4 | + const { spawnSyncAndExitWithoutError } = require('../common/child_process'); | ||
| 5 | 5 | const { isMainThread } = require('worker_threads'); | |
| 6 | 6 | ||
| 7 | 7 | if (!isMainThread) { | |
@@ -12,7 +12,21 @@ if (!common.hasCrypto) { | |||
| 12 | 12 | common.skip('no crypto'); | |
| 13 | 13 | } | |
| 14 | 14 | ||
| 15 | + // We need to define the flags dynamically to account for the `NODE_TEST_DIR` env var. | ||
| 16 | + if (!process.permission) { | ||
| 17 | + spawnSyncAndExitWithoutError(process.execPath, [ | ||
| 18 | + '--permission', | ||
| 19 | + '--allow-fs-read=*', `--allow-fs-write=${process.env.NODE_TEST_DIR || './test'}/.tmp.*`, '--allow-child-process', | ||
| 20 | + __filename, | ||
| 21 | + ]); | ||
| 22 | + return; | ||
| 23 | + } | ||
| 24 | + | ||
| 15 | 25 | const assert = require('assert'); | |
| 26 | + const path = require('path'); | ||
| 27 | + const tmpdir = require('../common/tmpdir'); | ||
| 28 | + | ||
| 29 | + tmpdir.refresh(); | ||
| 16 | 30 | ||
| 17 | 31 | { | |
| 18 | 32 | assert.throws(() => { | |
@@ -33,3 +47,29 @@ const assert = require('assert'); | |||
| 33 | 47 | resource: process.cwd(), | |
| 34 | 48 | })); | |
| 35 | 49 | } | |
| 50 | + | ||
| 51 | + { | ||
| 52 | + const reportPath = path.join(tmpdir.path, 'report.json'); | ||
| 53 | + spawnSyncAndExitWithoutError( | ||
| 54 | + process.execPath, | ||
| 55 | + [ | ||
| 56 | + '--permission', | ||
| 57 | + '--allow-fs-read=*', | ||
| 58 | + `--allow-fs-write=${tmpdir.path}/*`, | ||
| 59 | + '-e', | ||
| 60 | + `process.report.writeReport(${JSON.stringify(reportPath)})`, | ||
| 61 | + ] | ||
| 62 | + ); | ||
| 63 | + } | ||
| 64 | + | ||
| 65 | + spawnSyncAndExitWithoutError( | ||
| 66 | + process.execPath, | ||
| 67 | + [ | ||
| 68 | + '--permission', | ||
| 69 | + '--allow-fs-read=*', | ||
| 70 | + `--allow-fs-write=${tmpdir.path}`, | ||
| 71 | + '-e', | ||
| 72 | + 'process.report.writeReport()', | ||
| 73 | + ], | ||
| 74 | + { cwd: tmpdir.path } | ||
| 75 | + ); | ||
0 commit comments