fix: readdir should check for access rights, fixes tschaub#294

lib/binding.js

@@ -963,6 +963,8 @@ Binding.prototype.readdir = function(
       throw new FSError('ENOTDIR', dirpath);
     }
 
+    this.access(dirpath, parseInt('0002', 8));
+
     let list = dir.list();
     if (encoding === 'buffer') {
       list = list.map(function(item) {

test/lib/fs.readdir.spec.js

@@ -21,7 +21,15 @@ describe('fs.readdir(path, callback)', function() {
             empty: {}
           }
         }
-      }
+      },
+      denied: mock.directory({
+        mode: 0o000,
+        items: [
+          {
+            'one.txt': 'content'
+          }
+        ]
+      })
     });
   });
   afterEach(mock.restore);
@@ -92,6 +100,29 @@ describe('fs.readdir(path, callback)', function() {
     );
   });
 
+  it('calls with an error for restricted path', function(done) {
+    fs.readdir('denied', function(err, items) {
+      assert.instanceOf(err, Error);
+      assert.isUndefined(items);
+      done();
+    });
+  });
+
+  withPromise.it('promise calls with an error for restricted path', function(
+    done
+  ) {
+    fs.promises.readdir('denied').then(
+      function() {
+        assert.fail('should not succeed.');
+        done();
+      },
+      function(err) {
+        assert.instanceOf(err, Error);
+        done();
+      }
+    );
+  });
+
   inVersion('>=10.10').it('should support "withFileTypes" option', function(
     done
   ) {
@@ -216,4 +247,16 @@ describe('fs.readdirSync(path)', function() {
       fs.readdirSync('bogus');
     });
   });
+
+  it('throws when access refused', function() {
+    assert.throws(function() {
+      fs.readdirSync('denied');
+    });
+  });
+
+  it('throws when access refused', function() {
+    assert.throws(function() {
+      fs.readdirSync('denied');
+    });
+  });
 });