permission: fix wildcard when children > 1

PR-URL: #51209
Fixes: #50659
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Rich Trott <rtrott@gmail.com>

src/permission/fs_permission.h

@@ -78,6 +78,14 @@ class FSPermission final : public PermissionBase {
           return nullptr;
         }
 
+        // wildcard node takes precedence
+        if (children.size() > 1) {
+          auto it = children.find('*');
+          if (it != children.end()) {
+            return it->second;
+          }
+        }
+
         auto it = children.find(path[idx]);
         if (it == children.end()) {
           return nullptr;

test/parallel/test-permission-fs-wildcard.js

@@ -98,3 +98,23 @@ if (common.isWindows) {
   );
   assert.strictEqual(status, 0, stderr.toString());
 }
+
+{
+  if (!common.isWindows) {
+    const { status, stderr } = spawnSync(
+      process.execPath,
+      [
+        '--experimental-permission',
+        '--allow-fs-read=/a/b/*',
+        '--allow-fs-read=/a/b/d',
+        '-e',
+        `
+        const assert = require('assert')
+        assert.ok(process.permission.has('fs.read', '/a/b/c'));
+        assert.ok(!process.permission.has('fs.read', '/a/c/c'));
+      `,
+      ]
+    );
+    assert.strictEqual(status, 0, stderr.toString());
+  }
+}