permission: guard pipe open and chmod with net scope

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: nodejs-private/node-private#885
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48936
Refs: https://hackerone.com/reports/3618831

Author: RafaelGSS

src/pipe_wrap.cc

@@ -184,8 +184,10 @@ void PipeWrap::SetPendingInstances(const FunctionCallbackInfo<Value>& args) {
 void PipeWrap::Fchmod(const v8::FunctionCallbackInfo<v8::Value>& args) {
   PipeWrap* wrap;
   ASSIGN_OR_RETURN_UNWRAP(&wrap, args.This());
+  Environment* env = wrap->env();
   CHECK(args[0]->IsInt32());
   int mode = args[0].As<Int32>()->Value();
+  THROW_IF_INSUFFICIENT_PERMISSIONS(env, permission::PermissionScope::kNet, "");
   int err = uv_pipe_chmod(&wrap->handle_, mode);
   args.GetReturnValue().Set(err);
 }

test/parallel/test-permission-net-uds.js

@@ -9,11 +9,16 @@ if (common.isWindows) {
 }
 
 const assert = require('assert');
+const fs = require('fs');
 const net = require('net');
 const tls = require('tls');
 
+const pipePath = (name) => `/tmp/node-test-${process.pid}-${name}.sock`;
+
+assert.strictEqual(process.permission.has('net'), false);
+
 {
-  const client = net.connect({ path: '/tmp/perm.sock' });
+  const client = net.connect({ path: pipePath('perm') });
   client.on('error', common.mustCall((err) => {
     assert.strictEqual(err.code, 'ERR_ACCESS_DENIED');
   }));
@@ -22,7 +27,7 @@ const tls = require('tls');
 }
 
 {
-  const client = tls.connect({ path: '/tmp/perm.sock' });
+  const client = tls.connect({ path: pipePath('perm-tls') });
   client.on('error', common.mustCall((err) => {
     assert.strictEqual(err.code, 'ERR_ACCESS_DENIED');
   }));
@@ -31,19 +36,25 @@ const tls = require('tls');
 }
 
 {
+  const path = pipePath('perm-server');
+  const server = net.createServer();
   assert.throws(() => {
-    net.createServer().listen('/tmp/perm-server.sock');
+    server.listen(path);
   }, {
     code: 'ERR_ACCESS_DENIED',
     permission: 'Net',
   });
+  assert.strictEqual(fs.existsSync(path), false);
 }
 
 {
+  const path = pipePath('perm-tls-server');
+  const server = tls.createServer();
   assert.throws(() => {
-    tls.createServer().listen('/tmp/perm-tls-server.sock');
+    server.listen(path);
   }, {
     code: 'ERR_ACCESS_DENIED',
     permission: 'Net',
   });
+  assert.strictEqual(fs.existsSync(path), false);
 }