permission: enforce fs write permission for trace events

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: nodejs-private/node-private#924
Refs: https://hackerone.com/reports/3838601
CVE-ID: CVE-2026-56847

Author: RafaelGSS

src/node_trace_events.cc

@@ -5,7 +5,9 @@
 #include "node_external_reference.h"
 #include "node_internals.h"
 #include "node_v8_platform-inl.h"
+#include "permission/permission.h"
 #include "tracing/agent.h"
+#include "tracing/node_trace_writer.h"
 #include "util-inl.h"
 
 #include <set>
@@ -85,6 +87,11 @@ void NodeCategorySet::Enable(const FunctionCallbackInfo<Value>& args) {
   if (!category_set->enabled_ && !categories.empty()) {
     // Starts the Tracing Agent if it wasn't started already (e.g. through
     // a command line flag.)
+    THROW_IF_INSUFFICIENT_PERMISSIONS(
+        category_set->env(),
+        permission::PermissionScope::kFileSystemWrite,
+        tracing::NodeTraceWriter::GetFilePath(
+            per_process::cli_options->trace_event_file_pattern, 1));
     auto* agent = tracing::Agent::GetInstance();
     agent->StartTracing(per_process::cli_options->trace_event_categories);
     tracing::AgentWriterHandle* writer = agent->GetDefaultWriterHandle();

src/tracing/node_trace_writer.cc

@@ -8,9 +8,27 @@
 namespace node {
 namespace tracing {
 
+void replace_substring(std::string* target,
+                       const std::string& search,
+                       const std::string& insert) {
+  size_t pos = target->find(search);
+  for (; pos != std::string::npos; pos = target->find(search, pos)) {
+    target->replace(pos, search.size(), insert);
+    pos += insert.size();
+  }
+}
+
 NodeTraceWriter::NodeTraceWriter(const std::string& log_file_pattern)
     : log_file_pattern_(log_file_pattern) {}
 
+std::string NodeTraceWriter::GetFilePath(const std::string& log_file_pattern,
+                                         int file_num) {
+  std::string filepath(log_file_pattern);
+  replace_substring(&filepath, "${pid}", std::to_string(uv_os_getpid()));
+  replace_substring(&filepath, "${rotation}", std::to_string(file_num));
+  return filepath;
+}
+
 void NodeTraceWriter::InitializeOnThread(uv_loop_t* loop) {
   CHECK_NULL(tracing_loop_);
   tracing_loop_ = loop;
@@ -60,25 +78,13 @@ NodeTraceWriter::~NodeTraceWriter() {
   }
 }
 
-void replace_substring(std::string* target,
-                       const std::string& search,
-                       const std::string& insert) {
-  size_t pos = target->find(search);
-  for (; pos != std::string::npos; pos = target->find(search, pos)) {
-    target->replace(pos, search.size(), insert);
-    pos += insert.size();
-  }
-}
-
 void NodeTraceWriter::OpenNewFileForStreaming() {
   ++file_num_;
   uv_fs_t req;
 
   // Evaluate a JS-style template string, it accepts the values ${pid} and
   // ${rotation}
-  std::string filepath(log_file_pattern_);
-  replace_substring(&filepath, "${pid}", std::to_string(uv_os_getpid()));
-  replace_substring(&filepath, "${rotation}", std::to_string(file_num_));
+  std::string filepath(GetFilePath(log_file_pattern_, file_num_));
 
   if (fd_ != -1) {
     CHECK_EQ(uv_fs_close(nullptr, &req, fd_, nullptr), 0);

src/tracing/node_trace_writer.h

@@ -21,6 +21,9 @@ class NodeTraceWriter : public AsyncTraceWriter {
   explicit NodeTraceWriter(const std::string& log_file_pattern);
   ~NodeTraceWriter() override;
 
+  static std::string GetFilePath(const std::string& log_file_pattern,
+                                 int file_num);
+
   void InitializeOnThread(uv_loop_t* loop) override;
   void AppendTraceEvent(TraceObject* trace_event) override;
   void Flush(bool blocking) override;

test/parallel/test-permission-fs-write-trace-events.js

@@ -0,0 +1,61 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+const { spawnSyncAndExitWithoutError } = require('../common/child_process');
+const { isMainThread } = require('worker_threads');
+
+if (!isMainThread) {
+  common.skip('This test only works on a main thread');
+}
+
+const assert = require('assert');
+const fs = require('fs');
+const tmpdir = require('../common/tmpdir');
+
+try {
+  require('trace_events');
+} catch {
+  common.skip('missing trace events');
+}
+
+if (!process.permission) {
+  tmpdir.refresh();
+
+  const allowed = tmpdir.resolve('allowed');
+  const outside = tmpdir.resolve('outside');
+  fs.mkdirSync(allowed);
+  fs.mkdirSync(outside);
+
+  spawnSyncAndExitWithoutError(process.execPath, [
+    '--permission',
+    '--allow-fs-read=*',
+    `--allow-fs-write=${allowed}`,
+    __filename,
+    'child',
+  ], { cwd: outside });
+  return;
+}
+
+assert.strictEqual(process.argv[2], 'child');
+
+assert.throws(() => {
+  fs.writeFileSync('canary', 'x');
+}, common.expectsError({
+  code: 'ERR_ACCESS_DENIED',
+  permission: 'FileSystemWrite',
+}));
+
+const tracing = require('trace_events').createTracing({
+  categories: ['node', 'v8', 'node.perf'],
+});
+
+assert.throws(() => {
+  tracing.enable();
+}, common.expectsError({
+  code: 'ERR_ACCESS_DENIED',
+  permission: 'FileSystemWrite',
+  resource: 'node_trace.1.log',
+}));
+
+assert.strictEqual(fs.existsSync('node_trace.1.log'), false);