src,permission: do not grant cwd read access without entrypoint

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>

Author: RafaelGSS

src/env.cc

@@ -1169,7 +1169,8 @@ Environment::Environment(IsolateData* isolate_data,
         }
       }
 
-      if (first_argv != "inspect") {
+      if (!first_argv.empty() && first_argv != "-" &&
+          first_argv != "inspect") {
         options_->allow_fs_read.push_back(first_argv);
       }
     }

test/parallel/test-permission-fs-read-entrypoint.js

@@ -14,6 +14,7 @@ if (!common.hasCrypto) {
 
 const assert = require('assert');
 const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
 const { spawnSync } = require('child_process');
 
 const file = fixtures.path('permission', 'hello-world.js');
@@ -36,3 +37,19 @@ const fsReadLoader = fixtures.path('permission', 'fs-read-loader.js');
   );
   assert.strictEqual(status, 0, `${arg0} Error: ${stderr.toString()}`);
 });
+
+// When the code is read from stdin there is no entrypoint, so no implicit
+// read access should be granted (in particular, not to the cwd).
+tmpdir.refresh();
+[
+  ['--permission'],
+  ['--permission', '-'],
+].forEach((args) => {
+  const { status, stdout, stderr } = spawnSync(process.execPath, args, {
+    cwd: tmpdir.path,
+    input: 'console.log(process.permission.has("fs.read", ' +
+           'require("path").join(process.cwd(), "x")))',
+  });
+  assert.strictEqual(status, 0, `${args} Error: ${stderr.toString()}`);
+  assert.strictEqual(stdout.toString().trim(), 'false');
+});