GeezerVison is showing github.com — permission: handle process.chdir on writereport · nodejs/node@a1bbc24
File treeExpand file treeCollapse file tree Open diff view settings Expand file treeCollapse file tree Open diff view settings Collapse file Copy file name to clipboardExpand all lines: lib/internal/process/report.js +13Lines changed: 13 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
| 5 | 5 | } = primordials; | 6 | 6 |
| 7 | 7 | const { | | 8 | + ERR_ACCESS_DENIED, | 8 | 9 | ERR_SYNTHETIC, | 9 | 10 | } = require('internal/errors').codes; | 10 | 11 | const { getValidatedPath } = require('internal/fs/utils'); | | 12 | +const permission = require('internal/process/permission'); | 11 | 13 | const { | 12 | 14 | validateBoolean, | 13 | 15 | validateObject, | @@ -26,6 +28,17 @@ const report = { | 26 | 28 | file = getValidatedPath(file); | 27 | 29 | } | 28 | 30 |
| | 31 | + if (permission.isEnabled()) { | | 32 | + const resource = file ?? process.cwd(); | | 33 | + if (!permission.has('fs.write', resource)) { | | 34 | + throw new ERR_ACCESS_DENIED( | | 35 | + 'Access to this API has been restricted', | | 36 | + 'FileSystemWrite', | | 37 | + resource, | | 38 | + ); | | 39 | + } | | 40 | + } | | 41 | + | 29 | 42 | if (err === undefined) { | 30 | 43 | err = new ERR_SYNTHETIC(); | 31 | 44 | } else { | |
Collapse file Copy file name to clipboardExpand all lines: test/parallel/test-permission-fs-write-report.js +41-1Lines changed: 41 additions & 1 deletion | Original file line number | Diff line number | Diff line change |
|---|
| 1 | | -// Flags: --permission --allow-fs-read=* | 2 | 1 | 'use strict'; | 3 | 2 |
| 4 | 3 | const common = require('../common'); | | 4 | +const { spawnSyncAndExitWithoutError } = require('../common/child_process'); | 5 | 5 | const { isMainThread } = require('worker_threads'); | 6 | 6 |
| 7 | 7 | if (!isMainThread) { | @@ -12,7 +12,21 @@ if (!common.hasCrypto) { | 12 | 12 | common.skip('no crypto'); | 13 | 13 | } | 14 | 14 |
| | 15 | +// We need to define the flags dynamically to account for the `NODE_TEST_DIR` env var. | | 16 | +if (!process.permission) { | | 17 | + spawnSyncAndExitWithoutError(process.execPath, [ | | 18 | + '--permission', | | 19 | + '--allow-fs-read=*', `--allow-fs-write=${process.env.NODE_TEST_DIR || './test'}/.tmp.*`, '--allow-child-process', | | 20 | + __filename, | | 21 | + ]); | | 22 | + return; | | 23 | +} | | 24 | + | 15 | 25 | const assert = require('assert'); | | 26 | +const path = require('path'); | | 27 | +const tmpdir = require('../common/tmpdir'); | | 28 | + | | 29 | +tmpdir.refresh(); | 16 | 30 |
| 17 | 31 | { | 18 | 32 | assert.throws(() => { | @@ -33,3 +47,29 @@ const assert = require('assert'); | 33 | 47 | resource: process.cwd(), | 34 | 48 | })); | 35 | 49 | } | | 50 | + | | 51 | +{ | | 52 | + const reportPath = path.join(tmpdir.path, 'report.json'); | | 53 | + spawnSyncAndExitWithoutError( | | 54 | + process.execPath, | | 55 | + [ | | 56 | + '--permission', | | 57 | + '--allow-fs-read=*', | | 58 | + `--allow-fs-write=${tmpdir.path}/*`, | | 59 | + '-e', | | 60 | + `process.report.writeReport(${JSON.stringify(reportPath)})`, | | 61 | + ] | | 62 | + ); | | 63 | +} | | 64 | + | | 65 | +spawnSyncAndExitWithoutError( | | 66 | + process.execPath, | | 67 | + [ | | 68 | + '--permission', | | 69 | + '--allow-fs-read=*', | | 70 | + `--allow-fs-write=${tmpdir.path}`, | | 71 | + '-e', | | 72 | + 'process.report.writeReport()', | | 73 | + ], | | 74 | + { cwd: tmpdir.path } | | 75 | +); |
|