permission: add network check on pipe_wrap connect

RafaelGSS · RafaelGSS · commit bdf5873d449a · 2026-01-09T18:33:16.000-03:00
Refs: https://hackerone.com/reports/3465156 PR-URL: nodejs-private/node-private#784 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> CVE-ID: CVE-2026-21636
diff --git a/src/pipe_wrap.cc b/src/pipe_wrap.cc
@@ -226,6 +226,9 @@ void PipeWrap::Connect(const FunctionCallbackInfo<Value>& args) {
   Local<Object> req_wrap_obj = args[0].As<Object>();
   node::Utf8Value name(env->isolate(), args[1]);
 
+  ERR_ACCESS_DENIED_IF_INSUFFICIENT_PERMISSIONS(
+      env, permission::PermissionScope::kNet, name.ToStringView(), args);
+
   ConnectWrap* req_wrap =
       new ConnectWrap(env, req_wrap_obj, AsyncWrap::PROVIDER_PIPECONNECTWRAP);
   int err = req_wrap->Dispatch(uv_pipe_connect2,
diff --git a/test/parallel/test-permission-net-uds.js b/test/parallel/test-permission-net-uds.js
@@ -0,0 +1,31 @@
+// Flags: --permission --allow-fs-read=*
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto) { common.skip('missing crypto'); };
+
+if (common.isWindows) {
+  common.skip('This test only works on unix');
+}
+
+const assert = require('assert');
+const net = require('net');
+const tls = require('tls');
+
+{
+  const client = net.connect({ path: '/tmp/perm.sock' });
+  client.on('error', common.mustCall((err) => {
+    assert.strictEqual(err.code, 'ERR_ACCESS_DENIED');
+  }));
+
+  client.on('connect', common.mustNotCall('TCP connection should be blocked'));
+}
+
+{
+  const client = tls.connect({ path: '/tmp/perm.sock' });
+  client.on('error', common.mustCall((err) => {
+    assert.strictEqual(err.code, 'ERR_ACCESS_DENIED');
+  }));
+
+  client.on('connect', common.mustNotCall('TCP connection should be blocked'));
+}
