node/test/parallel/test-permission-fs-write-report.js
RafaelGSS 9cc79c177d
permission: handle process.chdir on writereport
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs-private/node-private/pull/870
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48617
Refs: https://hackerone.com/reports/3625987
2026-06-18 06:29:23 +02:00

75 lines
1.7 KiB
JavaScript

'use strict';
const common = require('../common');
const { spawnSyncAndExitWithoutError } = require('../common/child_process');
const { isMainThread } = require('worker_threads');
if (!isMainThread) {
common.skip('This test only works on a main thread');
}
if (!common.hasCrypto) {
common.skip('no crypto');
}
// We need to define the flags dynamically to account for the `NODE_TEST_DIR` env var.
if (!process.permission) {
spawnSyncAndExitWithoutError(process.execPath, [
'--permission',
'--allow-fs-read=*', `--allow-fs-write=${process.env.NODE_TEST_DIR || './test'}/.tmp.*`, '--allow-child-process',
__filename,
]);
return;
}
const assert = require('assert');
const path = require('path');
const tmpdir = require('../common/tmpdir');
tmpdir.refresh();
{
assert.throws(() => {
process.report.writeReport('./secret.txt');
}, common.expectsError({
code: 'ERR_ACCESS_DENIED',
permission: 'FileSystemWrite',
resource: './secret.txt',
}));
}
{
assert.throws(() => {
process.report.writeReport();
}, common.expectsError({
code: 'ERR_ACCESS_DENIED',
permission: 'FileSystemWrite',
resource: process.cwd(),
}));
}
{
const reportPath = path.join(tmpdir.path, 'report.json');
spawnSyncAndExitWithoutError(
process.execPath,
[
'--permission',
'--allow-fs-read=*',
`--allow-fs-write=${tmpdir.path}/*`,
'-e',
`process.report.writeReport(${JSON.stringify(reportPath)})`,
]
);
}
spawnSyncAndExitWithoutError(
process.execPath,
[
'--permission',
'--allow-fs-read=*',
`--allow-fs-write=${tmpdir.path}`,
'-e',
'process.report.writeReport()',
],
{ cwd: tmpdir.path }
);