permission: check final report output path

Refs: https://hackerone.com/reports/3815767
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: nodejs-private/node-private#908
CVE-ID: CVE-2026-58039

Author: RafaelGSS

lib/internal/process/report.js

@@ -9,6 +9,7 @@ const {
   ERR_SYNTHETIC,
 } = require('internal/errors').codes;
 const { getValidatedPath } = require('internal/fs/utils');
+const { sep } = require('path');
 const permission = require('internal/process/permission');
 const {
   validateBoolean,
@@ -29,7 +30,14 @@ const report = {
     }
 
     if (permission.isEnabled()) {
-      const resource = file ?? process.cwd();
+      let resource = file;
+      if (resource !== undefined) {
+        const directory = nr.getDirectory();
+        if (directory !== '')
+          resource = `${directory}${sep}${resource}`;
+      } else {
+        resource = process.cwd();
+      }
       if (!permission.has('fs.write', resource)) {
         throw new ERR_ACCESS_DENIED(
           'Access to this API has been restricted',

src/node_report.cc

@@ -835,13 +835,6 @@ std::string TriggerNodeReport(Isolate* isolate,
   //   1) supplied on API 2) configured on startup 3) default generated
   if (!name.empty()) {
     filename = name;
-    // we may not always be in a great state when generating a node report
-    // allow for the case where we don't have an env
-    if (env != nullptr) {
-      THROW_IF_INSUFFICIENT_PERMISSIONS(
-          env, permission::PermissionScope::kFileSystemWrite, name, filename);
-      // Filename was specified as API parameter.
-    }
   } else {
     std::string report_filename;
     {
@@ -855,13 +848,6 @@ std::string TriggerNodeReport(Isolate* isolate,
       filename = *DiagnosticFilename(
           env != nullptr ? env->thread_id() : 0, "report", "json");
     }
-    if (env != nullptr) {
-      THROW_IF_INSUFFICIENT_PERMISSIONS(
-          env,
-          permission::PermissionScope::kFileSystemWrite,
-          Environment::GetCwd(env->exec_path()),
-          filename);
-    }
   }
 
   // Open the report file stream for writing. Supports stdout/err,
@@ -879,12 +865,21 @@ std::string TriggerNodeReport(Isolate* isolate,
       report_directory = per_process::cli_options->report_directory;
     }
     // Regular file. Append filename to directory path if one was specified
+    std::string pathname;
     if (report_directory.length() > 0) {
-      std::string pathname = report_directory + kPathSeparator + filename;
-      outfile.open(pathname, std::ios::out | std::ios::binary);
+      pathname = report_directory + kPathSeparator + filename;
     } else {
-      outfile.open(filename, std::ios::out | std::ios::binary);
+      pathname = filename;
     }
+
+    // We may not always be in a great state when generating a node report.
+    // Allow for the case where we don't have an env.
+    if (env != nullptr) {
+      THROW_IF_INSUFFICIENT_PERMISSIONS(
+          env, permission::PermissionScope::kFileSystemWrite, pathname, "");
+    }
+
+    outfile.open(pathname, std::ios::out | std::ios::binary);
     // Check for errors on the file open
     if (!outfile.is_open()) {
       std::cerr << "\nFailed to open Node.js report file: " << filename;

test/parallel/test-permission-fs-write-report.js

@@ -23,6 +23,7 @@ if (!process.permission) {
 }
 
 const assert = require('assert');
+const fs = require('fs');
 const path = require('path');
 const tmpdir = require('../common/tmpdir');
 
@@ -73,3 +74,67 @@ spawnSyncAndExitWithoutError(
   ],
   { cwd: tmpdir.path }
 );
+
+{
+  const allowedDir = path.join(tmpdir.path, 'report-allowed');
+  const deniedDir = path.join(tmpdir.path, 'report-denied');
+  fs.mkdirSync(allowedDir);
+  fs.mkdirSync(deniedDir);
+
+  const deniedFile = path.join(deniedDir, 'report.json');
+  fs.writeFileSync(deniedFile, 'existing content');
+  spawnSyncAndExitWithoutError(
+    process.execPath,
+    [
+      '--permission',
+      '--allow-fs-read=*',
+      `--allow-fs-write=${allowedDir}`,
+      '-e',
+      `
+      const assert = require('assert');
+      process.report.directory = ${JSON.stringify(deniedDir)};
+      assert.throws(() => {
+        process.report.writeReport('report.json');
+      }, {
+        code: 'ERR_ACCESS_DENIED',
+        permission: 'FileSystemWrite',
+        resource: ${JSON.stringify(deniedFile)},
+      });
+      `,
+    ],
+    { cwd: allowedDir },
+  );
+  assert.strictEqual(fs.readFileSync(deniedFile, 'utf8'), 'existing content');
+}
+
+{
+  const allowedDir = path.join(tmpdir.path, 'report-filename-allowed');
+  const deniedDir = path.join(tmpdir.path, 'report-filename-denied');
+  fs.mkdirSync(allowedDir);
+  fs.mkdirSync(deniedDir);
+
+  const deniedFile = path.join(deniedDir, 'report.json');
+  spawnSyncAndExitWithoutError(
+    process.execPath,
+    [
+      '--permission',
+      '--allow-fs-read=*',
+      `--allow-fs-write=${allowedDir}`,
+      '-e',
+      `
+      const assert = require('assert');
+      process.report.directory = ${JSON.stringify(deniedDir)};
+      process.report.filename = 'report.json';
+      assert.throws(() => {
+        process.report.writeReport();
+      }, {
+        code: 'ERR_ACCESS_DENIED',
+        permission: 'FileSystemWrite',
+        resource: ${JSON.stringify(deniedFile)},
+      });
+      `,
+    ],
+    { cwd: allowedDir },
+  );
+  assert.strictEqual(fs.existsSync(deniedFile), false);
+}