AI-written path comparison mishandled Unicode normalization on APFS, letting fi/fi or ß/ss aliases bypass deny rules for read/write/run.

   requested: Option<String>,   is_windows_device_path: bool, }  impl PartialEq for PathQueryDescriptor<'_> {   fn eq(&self, other: &Self) -> bool {-    self.path == other.path+    self.cmp_path == other.cmp_path   } }  impl Eq for PathQueryDescriptor<'_> {}  impl PartialEq<PathDescriptor> for PathQueryDescriptor<'_> {   fn eq(&self, other: &PathDescriptor) -> bool {-    self.path == other.path+    self.cmp_path == other.cmp_path

+  if cfg!(windows) {+    PathBuf::from(path.to_string_lossy().to_ascii_lowercase())+  } else {+    path.to_path_buf()   } } @@ -1338,8 +1352,10 @@ impl<'a> PathQueryDescriptor<'a> {         Some(path.to_string_lossy().into_owned()),       )     };+    let cmp_path = comparison_path(&path);     Ok(Self {       path,+      cmp_path,       requested,       is_windows_device_path,     })@@ -1357,8 +1373,10 @@ impl<'a> PathQueryDescriptor<'a> {     } else {       normalize_path(path)     };+    let cmp_path = comparison_path(&path);     Self {       path,+      cmp_path,       requested: None,       is_windows_device_path,     }@@ -1372,7 +1390,7 @@ impl<'a> PathQueryDescriptor<'a> {   }    pub fn starts_with(&self, base: &PathDescriptor) -> bool {-    self.path.starts_with(&base.path)+    self.cmp_path.starts_with(&base.cmp_path)   }    pub fn display_name(&self) -> Cow<'_, str> {@@ -1385,6 +1403,7 @@ impl<'a> PathQueryDescriptor<'a> {   pub fn as_descriptor(&self) -> PathDescriptor {     PathDescriptor {       path: self.path.to_path_buf(),+      cmp_path: self.cmp_path.clone(),       requested: self.requested.clone(),       is_windows_device_path: self.is_windows_device_path,     }@@ -1393,6 +1412,7 @@ impl<'a> PathQueryDescriptor<'a> {   pub fn into_descriptor(self) -> PathDescriptor {     PathDescriptor {       path: self.path.into_owned(),+      cmp_path: self.cmp_path,       requested: self.requested,       is_windows_device_path: self.is_windows_device_path,     }@@ -1475,22 +1495,25 @@ impl QueryDescriptor for ReadQueryDescriptor<'_> { #[derive(Clone, Debug)] pub struct PathDescriptor {   path: PathBuf,

+const file = dir + "\\secret.txt";+Deno.writeTextFileSync(file, "secret");++const lowerDir = dir.toLowerCase();+const lowerFile = lowerDir + "\\secret.txt";++// Write the test script to a separate temp dir (not under the denied path).+const scriptDir = Deno.makeTempDirSync();+const scriptFile = scriptDir + "\\test_read.ts";+Deno.writeTextFileSync(+  scriptFile,+  `try {+  Deno.readTextFileSync(${JSON.stringify(lowerFile)});+  console.log("BYPASSED");+} catch (e) {+  console.log("BLOCKED:" + e.constructor.name);+}+`,+);++// Spawn a subprocess with --deny-read on the original-case path,+// then run the script which reads via the lowered-case path.+const result = new Deno.Command(Deno.execPath(), {+  args: [+    "run",+    "--allow-read",+    `--deny-read=${dir}`,+    scriptFile,

+  console.log(stderr || "NO OUTPUT");+}++Deno.removeSync(dir, { recursive: true });+Deno.removeSync(scriptDir, { recursive: true });

-/// On Windows, returns a lowercased copy of the path for case-insensitive-/// comparison, matching NTFS behavior. On other platforms, returns a clone.+/// Returns a normalized copy of the path for filesystem-aware comparison.+///+/// - Windows (NTFS): ASCII-lowercased for case-insensitive matching.+/// - macOS (APFS/HFS+): NFKD-normalized and Unicode-case-folded, because+///   APFS resolves Unicode-equivalent and case-differing paths to the same+///   inode (e.g. `ß`/`ss`, `fi`/`fi`, NFC/NFD forms, upper/lower).+/// - Other platforms: returns a clone (case-sensitive, no normalization). #[inline]+#[cfg(windows)] fn comparison_path(path: &Path) -> PathBuf {-  if cfg!(windows) {-    PathBuf::from(path.to_string_lossy().to_ascii_lowercase())-  } else {-    path.to_path_buf()-  }+  PathBuf::from(path.to_string_lossy().to_ascii_lowercase())+}+

+  let s = path.to_string_lossy();+  let normalized: String = s.nfkd().collect();+  PathBuf::from(normalized.to_uppercase().to_lowercase())+}++#[inline]+#[cfg(not(any(windows, target_os = "macos")))]+fn comparison_path(path: &Path) -> PathBuf {+  path.to_path_buf() }  impl<'a> PathQueryDescriptor<'a> {@@ -5601,6 +5621,118 @@ mod tests {     }   } +  #[test]

+      &parser,+      &PermissionsOptions {+        allow_read: Some(svec!["/data"]),+        deny_read: Some(svec!["/data/file_\u{00df}.txt"]),+        allow_write: Some(svec!["/data"]),+        deny_write: Some(svec!["/data/file_\u{00df}.txt"]),+        ..Default::default()

+      perms+        .check_open(+          Cow::Borrowed(Path::new("/data/file_ss.txt")),+          OpenAccessKind::Read,+          Some("api")+        )+        .is_err(),+      "deny-read bypass via ß/ss equivalence"+    );+    assert!(+      perms+        .check_open(+          Cow::Borrowed(Path::new("/data/file_ss.txt")),+          OpenAccessKind::Write,+          Some("api")+        )+        .is_err(),+      "deny-write bypass via ß/ss equivalence"+    );++    // NFC é (U+00E9) vs NFD e + combining accent (U+0065 U+0301)

 winapi = { workspace = true, features = ["commapi", "knownfolders", "mswsock", "objbase", "psapi", "shlobj", "tlhelp32", "winbase", "winerror", "winuser", "winsock2", "processenv", "wincon", "wincontypes"] } windows-sys = { workspace = true, features = ["Win32_Storage_FileSystem"] }

 winapi = { workspace = true, features = ["commapi", "handleapi", "knownfolders", "mswsock", "objbase", "processthreadsapi", "psapi", "shlobj", "tlhelp32", "winbase", "winerror", "winnt", "winuser", "winsock2"] } ntapi = "0.4.0"