fix(fs): improve file stat checks (#30876)

Author: dsherret

ext/fs/lib.rs

@@ -166,8 +166,8 @@ deno_core::extension!(deno_fs,
     op_fs_file_sync_data_async,
     op_fs_file_sync_sync,
     op_fs_file_sync_async,
-    op_fs_file_stat_sync,
-    op_fs_file_stat_async,
+    op_fs_file_stat_sync<P>,
+    op_fs_file_stat_async<P>,
     op_fs_fchmod_async,
     op_fs_fchmod_sync,
     op_fs_fchown_async,

ext/fs/ops.rs

@@ -1772,13 +1772,20 @@ pub async fn op_fs_file_sync_async(
 }
 
 #[op2(fast)]
-pub fn op_fs_file_stat_sync(
+pub fn op_fs_file_stat_sync<P: FsPermissions + 'static>(
   state: &mut OpState,
   #[smi] rid: ResourceId,
   #[buffer] stat_out_buf: &mut [u32],
 ) -> Result<(), FsOpsError> {
   let file =
     FileResource::get_file(state, rid).map_err(FsOpsErrorKind::Resource)?;
+  if let Some(path) = file.maybe_path() {
+    _ = state.borrow::<P>().check_open(
+      Cow::Borrowed(path),
+      OpenAccessKind::Read,
+      "Deno.FsFile.prototype.statSync()",
+    )?;
+  }
   let stat = file.stat_sync()?;
   let serializable_stat = SerializableStat::from(stat);
   serializable_stat.write(stat_out_buf);
@@ -1787,12 +1794,19 @@ pub fn op_fs_file_stat_sync(
 
 #[op2(async)]
 #[serde]
-pub async fn op_fs_file_stat_async(
+pub async fn op_fs_file_stat_async<P: FsPermissions + 'static>(
   state: Rc<RefCell<OpState>>,
   #[smi] rid: ResourceId,
 ) -> Result<SerializableStat, FsOpsError> {
   let file = FileResource::get_file(&state.borrow(), rid)
     .map_err(FsOpsErrorKind::Resource)?;
+  if let Some(path) = file.maybe_path() {
+    _ = state.borrow().borrow::<P>().check_open(
+      Cow::Borrowed(path),
+      OpenAccessKind::Read,
+      "Deno.FsFile.prototype.stat()",
+    )?;
+  }
   let stat = file.stat_async().await?;
   Ok(stat.into())
 }

tests/unit/stat_test.ts

@@ -329,3 +329,27 @@ Deno.test(
     assert(!s.isSocket);
   },
 );
+
+Deno.test(
+  { permissions: { read: false, write: true } },
+  async function fsFileStatFailPermissions() {
+    const testDir = Deno.makeTempDirSync();
+    const filename = testDir + "/file.txt";
+    using file = await Deno.open(filename, {
+      read: false,
+      write: true,
+      create: true,
+    });
+
+    await assertRejects(
+      () => file.stat(),
+      Deno.errors.NotCapable,
+      "Requires read access to",
+    );
+    assertThrows(
+      () => file.statSync(),
+      Deno.errors.NotCapable,
+      "Requires read access to",
+    );
+  },
+);