From 56c687c39b8c4a907b2b067b415d775d83d87080 Mon Sep 17 00:00:00 2001 From: RafaelGSS Date: Sat, 12 Sep 2026 14:19:25 -0300 Subject: [PATCH] doc: clarify permission model scope for output paths Flags such --trace-event-file or any other flag that specifies a directory are subject to permission model rules, but a "bypass" isn't considered a vulnerability while it doesn't pose a risk to the user application Signed-off-by: RafaelGSS --- SECURITY.md | 10 +++++++++- doc/api/permissions.md | 8 ++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 17d35fd4432f..f5a4ef3370ad 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -522,7 +522,15 @@ The following are **not** vulnerabilities in Node.js: * **Operator-controlled flags**: Behavior unlocked by flags the operator explicitly passes (e.g., `--localstorage-file`) is the operator's responsibility. The permission model does not restrict how Node.js behaves - when the operator intentionally configures it. + when the operator intentionally configures it. This includes any file or + resource that Node.js itself creates, writes, or reads at a location the + operator selected through a flag, including every path derived from a + template or pattern in that flag. For example, trace files rotated by + `--trace-event-file-pattern` (`${rotation}`) being written without a + matching `--allow-fs-write` entry is not a permission model bypass. Such + paths are part of the operator's configuration, not application file-system + access. Inconsistent checks on these paths are treated as regular bugs and + should be reported through the public issue tracker. * **`node:sqlite` and the permission model**: `DatabaseSync` operates with the same file-system privileges as the process. Using SQL pragmas or built-in diff --git a/doc/api/permissions.md b/doc/api/permissions.md index b677013d7978..dc5e3e6111ca 100644 --- a/doc/api/permissions.md +++ b/doc/api/permissions.md @@ -354,6 +354,14 @@ There are constraints you need to know before using this system: to read files before environment initialization. As a result, such flags are not subject to the rules of the Permission Model. The same applies for V8 flags that can be set via runtime through `v8.setFlagsFromString`. +* Files that Node.js itself creates, writes, or reads at a location selected + by an operator flag may not be consistently checked against the Permission + Model, in particular when the flag accepts a template or pattern that + expands to several paths. For example, trace files rotated by + `--trace-event-file-pattern` (`${rotation}`) can be written even when the + expanded path is not covered by `--allow-fs-write`. Because the location is + chosen by the operator, gaps like this are treated as regular bugs rather + than vulnerabilities. Please report them through the regular issue tracker. * OpenSSL engines cannot be requested at runtime when the Permission Model is enabled, affecting the built-in crypto, https, and tls modules. * Run-Time Loadable Extensions cannot be loaded when the Permission Model is