permission: check permission model in realpathSync

The equivalent entry points (fs.realpathSync.native(),
fs.promises.realpath(), fs.lstatSync(), fs.existsSync())
already deny access for the same paths

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
Backport-PR-URL: nodejs-private/node-private#1011
Reviewed-By: Rich Trott <rtrott@gmail.com>
PR-URL: nodejs-private/node-private#973
CVE-ID: CVE-2026-106073

Author: RafaelGSS

lib/fs.js

@@ -2787,6 +2787,16 @@ function realpathSync(p, options) {
   validatePath(p);
   p = pathModule.resolve(p);
 
+  // Check the resolved input path up front so that the lstat walk below cannot
+  // be used to probe the existence of paths outside the granted set.
+  if (permission.isEnabled() && !permission.has('fs.read', p)) {
+    throw new ERR_ACCESS_DENIED(
+      'Access to this API has been restricted. Use --allow-fs-read to manage permissions.',
+      'FileSystemRead',
+      p,
+    );
+  }
+
   const cache = options[realpathCacheKey];
   const maybeCachedResult = cache?.get(p);
   if (maybeCachedResult) {

test/common/tmpdir.js

@@ -32,8 +32,20 @@ function rmSync(pathname, useSpawn) {
   }
 }
 
+// Under the permission model, fs.realpathSync() requires read access to the
+// path, which tests running with a restricted --allow-fs-read may not grant
+// for NODE_TEST_DIR.
+function resolveTestRoot(dir) {
+  try {
+    return fs.realpathSync(dir);
+  } catch (err) {
+    if (err.code !== 'ERR_ACCESS_DENIED') throw err;
+    return path.resolve(dir);
+  }
+}
+
 const testRoot = process.env.NODE_TEST_DIR ?
-  fs.realpathSync(process.env.NODE_TEST_DIR) : path.resolve(__dirname, '..');
+  resolveTestRoot(process.env.NODE_TEST_DIR) : path.resolve(__dirname, '..');
 
 // Using a `.` prefixed name, which is the convention for "hidden" on POSIX,
 // gets tools to ignore it by default or by simple rules, especially eslint.

test/fixtures/permission/fs-read.js

@@ -698,6 +698,57 @@ const regularFile = __filename;
   });
 }
 
+// fs.realpath (JS implementation, walks the path with lstat)
+{
+  assert.throws(() => {
+    fs.realpathSync(blockedFile);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+  }));
+  assert.throws(() => {
+    fs.realpathSync(bufferBlockedFile);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+  }));
+  assert.throws(() => {
+    fs.realpathSync(path.join(blockedFolder, 'anyfile'));
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+  }));
+  // Must not act as a file-existence oracle: a non-existent path inside a
+  // blocked folder must be denied, not reported as ENOENT.
+  assert.throws(() => {
+    fs.realpathSync(path.join(blockedFolder, 'does-not-exist'));
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+  }));
+  fs.realpath(blockedFile, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+  }));
+  assert.throws(() => {
+    fs.realpathSync(blockedFile);
+  }, common.expectsError({
+    message: 'Access to this API has been restricted. Use --allow-fs-read to manage permissions.',
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: blockedFile,
+  }));
+  assert.rejects(async () => {
+    await fsPromises.realpath(blockedFile);
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+  })).then(common.mustCall());
+
+  // doesNotThrow
+  assert.strictEqual(typeof fs.realpathSync(regularFile), 'string');
+}
+
 // fs.realpath.native
 {
   fs.realpath.native(blockedFile, common.expectsError({

test/parallel/test-permission-fs-require.js

@@ -44,7 +44,7 @@ const { spawnSync } = require('node:child_process');
   );
 
   assert.strictEqual(status, 1, stderr.toString());
-  assert.match(stderr.toString(), /Error: Access to this API has been restricted/);
+  assert.match(stderr.toString(), /Error(?: \[ERR_ACCESS_DENIED\])?: Access to this API has been restricted/);
 }
 
 {
@@ -78,5 +78,5 @@ const { spawnSync } = require('node:child_process');
   );
 
   assert.strictEqual(status, 1, stderr.toString());
-  assert.match(stderr.toString(), /Error: Access to this API has been restricted/);
+  assert.match(stderr.toString(), /Error(?: \[ERR_ACCESS_DENIED\])?: Access to this API has been restricted/);
 }