lib,permission: handle buffer on fs.symlink

PR-URL: #51212 Reviewed-By: Stephen Belanger <[email protected]> Reviewed-By: Paolo Insogna <[email protected]>

Author: RafaelGSS

lib/fs.js

@@ -40,6 +40,7 @@ const{
  StringPrototypeCharCodeAt,
  StringPrototypeIndexOf,
  StringPrototypeSlice,
+ uncurryThis,
 }=primordials;
 
 const{fs: constants}=internalBinding('constants');
@@ -66,6 +67,8 @@ const binding = internalBinding('fs');
 const{ createBlobFromFilePath }=require('internal/blob');
 
 const{ Buffer }=require('buffer');
+const{isBuffer: BufferIsBuffer}=Buffer;
+constBufferToString=uncurryThis(Buffer.prototype.toString);
 const{
  aggregateTwoErrors,
 codes: {
@@ -1721,7 +1724,12 @@ function symlink(target, path, type_, callback_){
 if(permission.isEnabled()){
 // The permission model's security guarantees fall apart in the presence of
 // relative symbolic links. Thus, we have to prevent their creation.
-if(typeoftarget!=='string'||!isAbsolute(toPathIfFileURL(target))){
+if(BufferIsBuffer(target)){
+if(!isAbsolute(BufferToString(target))){
+callback(newERR_ACCESS_DENIED('relative symbolic link target'));
+return;
+}
+}elseif(typeoftarget!=='string'||!isAbsolute(toPathIfFileURL(target))){
 callback(newERR_ACCESS_DENIED('relative symbolic link target'));
 return;
 }

test/parallel/test-permission-fs-symlink-relative.js

@@ -5,6 +5,7 @@ const common = require('../common');
 common.skipIfWorker();
 
 constassert=require('assert');
+constpath=require('path');
 const{ symlinkSync, symlink,promises: {symlink: symlinkAsync}}=require('fs');
 
 consterror={
@@ -25,3 +26,16 @@ for (const targetString of ['a', './b/c', '../d', 'e/../f', 'C:drive-relative',
 }
 }
 }
+
+// Absolute should not throw
+for(consttargetStringof[path.resolve('.')]){
+for(consttargetof[targetString,Buffer.from(targetString)]){
+for(constpathof[__filename]){
+symlink(target,path,common.mustCall((err)=>{
+assert(err);
+assert.strictEqual(err.code,'EEXIST');
+assert.match(err.message,/filealreadyexists/);
+}));
+}
+}
+}