lib,permission: support Buffer to permission.has

PR-URL: #54104Fixes: #54100
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>

Author: RafaelGSS

lib/fs.js

@@ -1554,7 +1554,8 @@ function lstat(path, options = { bigint: false }, callback) {
 callback=makeStatsCallback(callback);
 path=getValidatedPath(path);
 if(permission.isEnabled()&&!permission.has('fs.read',path)){
-callback(newERR_ACCESS_DENIED('Access to this API has been restricted','FileSystemRead',path));
+constresource=BufferIsBuffer(path) ? BufferToString(path) : path;
+callback(newERR_ACCESS_DENIED('Access to this API has been restricted','FileSystemRead',resource));
 return;
 }
 
@@ -1634,7 +1635,8 @@ function fstatSync(fd, options = { bigint: false }) {
 functionlstatSync(path,options={bigint: false,throwIfNoEntry: true}){
 path=getValidatedPath(path);
 if(permission.isEnabled()&&!permission.has('fs.read',path)){
-thrownewERR_ACCESS_DENIED('Access to this API has been restricted','FileSystemRead',path);
+constresource=BufferIsBuffer(path) ? BufferToString(path) : path;
+thrownewERR_ACCESS_DENIED('Access to this API has been restricted','FileSystemRead',resource);
 }
 conststats=binding.lstat(
 pathModule.toNamespacedPath(path),

lib/internal/process/permission.js

@@ -5,7 +5,9 @@ const {
 }=primordials;
 
 constpermission=internalBinding('permission');
-const{ validateString }=require('internal/validators');
+const{ validateString, validateBuffer }=require('internal/validators');
+const{ Buffer }=require('buffer');
+const{ isBuffer }=Buffer;
 
 letexperimentalPermission;
 
@@ -22,7 +24,11 @@ module.exports = ObjectFreeze({
 validateString(scope,'scope');
 if(reference!=null){
 // TODO: add support for WHATWG URLs and Uint8Arrays.
-validateString(reference,'reference');
+if(isBuffer(reference)){
+validateBuffer(reference,'reference');
+}else{
+validateString(reference,'reference');
+}
 }
 
 returnpermission.has(scope,reference);

test/fixtures/permission/fs-read.js

@@ -7,6 +7,7 @@ const fs = require('fs');
 constpath=require('path');
 
 constblockedFile=process.env.BLOCKEDFILE;
+constbufferBlockedFile=Buffer.from(process.env.BLOCKEDFILE);
 constblockedFileURL=newURL('file://'+process.env.BLOCKEDFILE);
 constblockedFolder=process.env.BLOCKEDFOLDER;
 constallowedFolder=process.env.ALLOWEDFOLDER;
@@ -410,6 +411,11 @@ const regularFile = __filename;
 },common.expectsError({
 code: 'ERR_ACCESS_DENIED',
 }));
+assert.throws(()=>{
+fs.lstatSync(bufferBlockedFile);
+},common.expectsError({
+code: 'ERR_ACCESS_DENIED',
+}));
 
 // doesNotThrow
 fs.lstat(regularFile,(err)=>{

test/fixtures/permission/fs-traversal.js

@@ -69,6 +69,16 @@ const uint8ArrayTraversalPath = new TextEncoder().encode(traversalPath);
 }));
 }
 
+{
+fs.lstat(bufferTraversalPath,common.expectsError({
+code: 'ERR_ACCESS_DENIED',
+permission: 'FileSystemRead',
+// lstat checks and throw on JS side.
+// resource is only resolved on C++ (is_granted)
+resource: bufferTraversalPath.toString(),
+}));
+}
+
 {
 fs.readFile(uint8ArrayTraversalPath,common.expectsError({
 code: 'ERR_ACCESS_DENIED',

test/parallel/test-permission-has.js

@@ -21,3 +21,7 @@ const assert = require('assert');
 message: 'The "reference" argument must be of type string. Received an instance of Object',
 }));
 }
+
+{
+assert.ok(!process.permission.has('FileSystemWrite',Buffer.from('reference')));
+}