permission: store resolved path in worker fs allowlist intersection

FilterPathListToParentSubset validated resolved paths but pushed the raw
input into the filtered allowlist. Store ResolveForCompare output so the
checked and granted strings match.

Drop unreachable empty-list fallback gated on w->permission after callers
already force permission true.

Signed-off-by: yunshingng <yunshingng25@gmail.com>

Author: yunshingng

src/node_worker.cc

@@ -595,10 +595,10 @@ void FilterPathListToParentSubset(Environment* env,
                                   const std::vector<std::string>& parent) {
   if (worker == nullptr) return;
 
-  // Worker enabled permission but listed no paths → keep empty (restrict).
+  // Worker listed no fs paths → keep empty (restrict).
+  // Callers set w->permission = true before this runs, so inheriting the
+  // parent list via w->permission here is unreachable.
   if (worker->empty()) {
-    if (w->permission || w->permission_audit) return;
-    *worker = parent;
     return;
   }
 
@@ -613,9 +613,11 @@ void FilterPathListToParentSubset(Environment* env,
       saw_star = true;
       continue;
     }
+    // Store the resolved form validated against the parent, not raw input.
+    const std::string resolved_wpath = ResolveForCompare(env, wpath);
     for (const std::string& entry : parent) {
       if (PathCoveredByParentEntry(env, entry, wpath)) {
-        out.push_back(wpath);
+        out.push_back(resolved_wpath);
         break;
       }
     }