diff --git a/src/node_binding.cc b/src/node_binding.cc index 330c7f167105..26f8d046f6da 100644 --- a/src/node_binding.cc +++ b/src/node_binding.cc @@ -672,6 +672,9 @@ void GetLinkedBinding(const FunctionCallbackInfo& args) { node::Utf8Value module_name_v(env->isolate(), module_name); const char* name = *module_name_v; + THROW_IF_INSUFFICIENT_PERMISSIONS( + env, permission::PermissionScope::kAddon, module_name_v.ToStringView()); + node_module* mod = nullptr; // Iterate from here to the nearest non-Worker Environment to see if there's diff --git a/test/parallel/test-permission-linked-binding-drop.js b/test/parallel/test-permission-linked-binding-drop.js new file mode 100644 index 000000000000..865761a2bd7e --- /dev/null +++ b/test/parallel/test-permission-linked-binding-drop.js @@ -0,0 +1,19 @@ +// Flags: --permission --allow-addons --allow-fs-read=* +'use strict'; + +const common = require('../common'); +const assert = require('node:assert'); + +assert.strictEqual(process.permission.has('addon'), true); + +process.permission.drop('addon'); + +assert.strictEqual(process.permission.has('addon'), false); + +assert.throws(() => { + process._linkedBinding('missing'); +}, common.expectsError({ + code: 'ERR_ACCESS_DENIED', + permission: 'Addon', + resource: 'missing', +})); diff --git a/test/parallel/test-permission-linked-binding.js b/test/parallel/test-permission-linked-binding.js new file mode 100644 index 000000000000..b30ea9aaa24b --- /dev/null +++ b/test/parallel/test-permission-linked-binding.js @@ -0,0 +1,15 @@ +// Flags: --permission --allow-fs-read=* +'use strict'; + +const common = require('../common'); +const assert = require('node:assert'); + +assert.strictEqual(process.permission.has('addon'), false); + +assert.throws(() => { + process._linkedBinding('missing'); +}, common.expectsError({ + code: 'ERR_ACCESS_DENIED', + permission: 'Addon', + resource: 'missing', +}));