permission: enforce fs write permission for trace events

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: nodejs-private/node-private#927
CVE-ID: CVE-2026-56847

Author: RafaelGSS

src/node_trace_events.cc

@@ -5,7 +5,9 @@
 #include "node_external_reference.h"
 #include "node_internals.h"
 #include "node_v8_platform-inl.h"
+#include "permission/permission.h"
 #include "tracing/agent.h"
+#include "tracing/node_trace_writer.h"
 #include "util-inl.h"
 
 #include <set>
@@ -83,6 +85,12 @@ void NodeCategorySet::Enable(const FunctionCallbackInfo<Value>& args) {
   CHECK_NOT_NULL(category_set);
   const auto& categories = category_set->GetCategories();
   if (!category_set->enabled_ && !categories.empty()) {
+    const std::string filepath = tracing::NodeTraceWriter::GetFilePath(
+        per_process::cli_options->trace_event_file_pattern, 1);
+    THROW_IF_INSUFFICIENT_PERMISSIONS(
+        category_set->env(),
+        permission::PermissionScope::kFileSystemWrite,
+        filepath);
     // Starts the Tracing Agent if it wasn't started already (e.g. through
     // a command line flag.)
     StartTracingAgent();

src/tracing/node_trace_writer.cc

@@ -8,9 +8,27 @@
 namespace node {
 namespace tracing {
 
+void replace_substring(std::string* target,
+                       const std::string& search,
+                       const std::string& insert) {
+  size_t pos = target->find(search);
+  for (; pos != std::string::npos; pos = target->find(search, pos)) {
+    target->replace(pos, search.size(), insert);
+    pos += insert.size();
+  }
+}
+
 NodeTraceWriter::NodeTraceWriter(const std::string& log_file_pattern)
     : log_file_pattern_(log_file_pattern) {}
 
+std::string NodeTraceWriter::GetFilePath(const std::string& log_file_pattern,
+                                         int file_num) {
+  std::string filepath(log_file_pattern);
+  replace_substring(&filepath, "${pid}", std::to_string(uv_os_getpid()));
+  replace_substring(&filepath, "${rotation}", std::to_string(file_num));
+  return filepath;
+}
+
 void NodeTraceWriter::InitializeOnThread(uv_loop_t* loop) {
   CHECK_NULL(tracing_loop_);
   tracing_loop_ = loop;
@@ -60,25 +78,13 @@ NodeTraceWriter::~NodeTraceWriter() {
   }
 }
 
-void replace_substring(std::string* target,
-                       const std::string& search,
-                       const std::string& insert) {
-  size_t pos = target->find(search);
-  for (; pos != std::string::npos; pos = target->find(search, pos)) {
-    target->replace(pos, search.size(), insert);
-    pos += insert.size();
-  }
-}
-
 void NodeTraceWriter::OpenNewFileForStreaming() {
   ++file_num_;
   uv_fs_t req;
 
   // Evaluate a JS-style template string, it accepts the values ${pid} and
   // ${rotation}
-  std::string filepath(log_file_pattern_);
-  replace_substring(&filepath, "${pid}", std::to_string(uv_os_getpid()));
-  replace_substring(&filepath, "${rotation}", std::to_string(file_num_));
+  std::string filepath(GetFilePath(log_file_pattern_, file_num_));
 
   if (fd_ != -1) {
     CHECK_EQ(uv_fs_close(nullptr, &req, fd_, nullptr), 0);

src/tracing/node_trace_writer.h

@@ -19,6 +19,9 @@ class NodeTraceWriter : public AsyncTraceWriter {
   explicit NodeTraceWriter(const std::string& log_file_pattern);
   ~NodeTraceWriter() override;
 
+  static std::string GetFilePath(const std::string& log_file_pattern,
+                                 int file_num);
+
   void InitializeOnThread(uv_loop_t* loop) override;
   void AppendTraceEvent(TraceObject* trace_event) override;
   void Flush(bool blocking) override;