[SANDBOXING] Node require fails when the resource is a symbolic link

[luxu-gg]

What happened?

This error occurs when using a symlinked resource.

LoadResourceFile function reads the targeted file correctly.
Using require on the same path, produces a filesystem permission error.
Error: Access to this API has been restricted. Use --allow-fs-read to manage permissions.

Example code

const modulePath = GetResourcePath(GetCurrentResourceName()) + "/module.cjs";

// ✅ Success
try {
    console.log("Loading file via LoadResourceFile");
    const file = LoadResourceFile(GetCurrentResourceName(), "module.cjs");
    const { foo } = eval(file);
    foo();
    console.log("LoadResourceFile Passes");
} catch (e) {
    console.error("Failed to load module via LoadResourceFile:\n", e);
}

// ❌ Fail
try {
    console.log("Loading file via require");
    const { foo } = require(modulePath);
    foo();
    console.log("require Passes");
} catch (e) {
    console.error("Failed to load module via require:\n", e);
}

Expected result

require should be able to access the file like LoadResourceFile

Reproduction steps

Reproduction Steps

symb_bug.zip

• Download the resource
• Place it in your home folder (The location is arbitrary)
• Create a symbolic link to the FXServer's resources folder

ln -s ~/symb_bug ~/FiveM/txData/Main/resources/symb_bug

• Start this resource in your server.

Importancy

There's a workaround

Area(s)

FXServer, ScRT: JS

Specific version(s)

b27092/Lin

Additional information

No issue found on b25770/Lin

[jamesdevvs]

This has been a major regression since the new filesystem sandboxing push.
It's basically impossible to develop off network drives on newer artifacts.

In the resource permission check both paths should be normalised consistently eg. with std::filesystem::weakly_canonical.

[TGIANN]

https://docs.fivem.net/docs/developers/sandbox/

File System Permissions
To allow specific resources to write to other resources regardless of file extension restrictions, use the add_filesystem_permission configuration:

Please note that author names need to match to authorize write access.