permission: include permission check to pipe_wrap.cc

PR-URL: nodejs-private/node-private#820
Refs: https://hackerone.com/reports/3559715
Reviewed-By: Santiago Gimeno <santiago.gimeno@gmail.com>
CVE-ID: CVE-2026-21711

Author: RafaelGSS

src/pipe_wrap.cc

@@ -162,7 +162,10 @@ PipeWrap::PipeWrap(Environment* env,
 void PipeWrap::Bind(const FunctionCallbackInfo<Value>& args) {
   PipeWrap* wrap;
   ASSIGN_OR_RETURN_UNWRAP(&wrap, args.This());
-  node::Utf8Value name(args.GetIsolate(), args[0]);
+  Environment* env = wrap->env();
+  node::Utf8Value name(env->isolate(), args[0]);
+  THROW_IF_INSUFFICIENT_PERMISSIONS(
+      env, permission::PermissionScope::kNet, name.ToStringView());
   int err =
       uv_pipe_bind2(&wrap->handle_, *name, name.length(), UV_PIPE_NO_TRUNCATE);
   args.GetReturnValue().Set(err);
@@ -193,6 +196,7 @@ void PipeWrap::Listen(const FunctionCallbackInfo<Value>& args) {
   Environment* env = wrap->env();
   int backlog;
   if (!args[0]->Int32Value(env->context()).To(&backlog)) return;
+  THROW_IF_INSUFFICIENT_PERMISSIONS(env, permission::PermissionScope::kNet, "");
   int err = uv_listen(
       reinterpret_cast<uv_stream_t*>(&wrap->handle_), backlog, OnConnection);
   args.GetReturnValue().Set(err);

test/parallel/test-permission-net-uds.js

@@ -29,3 +29,21 @@ const tls = require('tls');
 
   client.on('connect', common.mustNotCall('TCP connection should be blocked'));
 }
+
+{
+  assert.throws(() => {
+    net.createServer().listen('/tmp/perm-server.sock');
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'Net',
+  });
+}
+
+{
+  assert.throws(() => {
+    tls.createServer().listen('/tmp/perm-tls-server.sock');
+  }, {
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'Net',
+  });
+}