permission: support fs.mkdtemp

RafaelGSS · web-flow · commit 4b80a7b0c404 · 2023-04-09T21:35:16.000Z
PR-URL: nodejs#47470 Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com>
diff --git a/src/node_file.cc b/src/node_file.cc
@@ -2678,6 +2678,8 @@ static void Mkdtemp(const FunctionCallbackInfo<Value>& args) {
 
   BufferValue tmpl(isolate, args[0]);
   CHECK_NOT_NULL(*tmpl);
+  THROW_IF_INSUFFICIENT_PERMISSIONS(
+      env, permission::PermissionScope::kFileSystemWrite, tmpl.ToStringView());
 
   const enum encoding encoding = ParseEncoding(isolate, args[1], UTF8);
 
diff --git a/test/fixtures/permission/fs-write.js b/test/fixtures/permission/fs-write.js
@@ -130,6 +130,23 @@ const absoluteProtectedFolder = path.resolve(relativeProtectedFolder);
   }));
 }
 
+{
+  assert.throws(() => {
+    fs.mkdtempSync(path.join(blockedFolder, 'any-folder'));
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  }));
+  assert.throws(() => {
+    fs.mkdtemp(path.join(relativeProtectedFolder, 'any-folder'), (err) => {
+      assert.ifError(err);
+    });
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemWrite',
+  }));
+}
+
 // fs.rename
 {
   assert.throws(() => {
