permission: add path separator to loader check

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: #47030
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>

Author: RafaelGSS

lib/internal/modules/cjs/loader.js

@@ -423,7 +423,7 @@ function readPackageScope(checkPath) {
 checkPath=StringPrototypeSlice(checkPath,0,separatorIndex);
 // Stop the search when the process doesn't have permissions
 // to walk upwards
-if(enabledPermission&&!permission.has('fs.read',checkPath)){
+if(enabledPermission&&!permission.has('fs.read',checkPath+sep)){
 returnfalse;
 }
 if(StringPrototypeEndsWith(checkPath,sep+'node_modules'))

test/fixtures/permission/loader/index.js

@@ -0,0 +1,3 @@
+constfs=require('node:fs');
+
+fs.readFile('/etc/passwd',()=>{});

test/parallel/test-cli-permission-deny-fs.js

@@ -1,9 +1,12 @@
 'use strict';
 
-require('../common');
+constcommon=require('../common');
+
+constfixtures=require('../common/fixtures');
 const{ spawnSync }=require('child_process');
 constassert=require('assert');
 constfs=require('fs');
+constpath=require('path');
 
 {
 const{ status, stdout }=spawnSync(
@@ -126,3 +129,23 @@ const fs = require('fs');
 assert.strictEqual(status,1);
 assert.ok(!fs.existsSync('permission-deny-example.md'));
 }
+
+{
+const{ root }=path.parse(process.cwd());
+constabs=(p)=>path.join(root,p);
+constfirstPath=abs(path.sep+process.cwd().split(path.sep,2)[1]);
+if(firstPath.startsWith('/etc')){
+common.skip('/etc as firstPath');
+}
+constfile=fixtures.path('permission','loader','index.js');
+const{ status, stderr }=spawnSync(
+process.execPath,
+[
+'--experimental-permission',
+`--allow-fs-read=${firstPath}`,
+file,
+]
+);
+assert.match(stderr.toString(),/resource:'.*?[\\/](?:etc|passwd)'/);
+assert.strictEqual(status,1);
+}