Skip to content

Commit

Permalink
permission: ensure to resolve path when calling mkdtemp
Browse files Browse the repository at this point in the history
PR-URL: nodejs-private/node-private#440
Refs: https://hackerone.com/bugs?subject=nodejs&report_id=2037887
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
  • Loading branch information
RafaelGSS committed Aug 9, 2023
1 parent 1f64147 commit 3868ae0
Showing 1 changed file with 14 additions and 2 deletions.
16 changes: 14 additions & 2 deletions test/fixtures/permission/fs-traversal.js
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,19 @@ const bufferTraversalPath = Buffer.from(allowedFolder + '../file.md');
}, common.expectsError({
code: 'ERR_ACCESS_DENIED',
permission: 'FileSystemWrite',
resource: path.toNamespacedPath(path.resolve(traversalFolderPath + 'XXXXXX')),
resource: path.resolve(traversalFolderPath + 'XXXXXX'),
}));
}

{
assert.throws(() => {
fs.mkdtemp(traversalFolderPath, (error) => {
assert.ifError(error);
});
}, common.expectsError({
code: 'ERR_ACCESS_DENIED',
permission: 'FileSystemWrite',
resource: path.resolve(traversalFolderPath + 'XXXXXX'),
}));
}

Expand All @@ -72,4 +84,4 @@ const bufferTraversalPath = Buffer.from(allowedFolder + '../file.md');
assert.ok(!process.permission.has('fs.write', traversalPath));
assert.ok(!process.permission.has('fs.read', traversalFolderPath));
assert.ok(!process.permission.has('fs.write', traversalFolderPath));
}
}

0 comments on commit 3868ae0

Please sign in to comment.