fs module's file watching is not restricted by --allow-fs-read

How it was found

Summary: [add summary of the vulnerability] The --allow-fs-read flag of the permission system does not prevent file watching.

Description: [add more details about this vulnerability] Attackers can watch files that they don't have read access to.

Steps To Reproduce:

Run the following code with --experimental-permission and do not grant read access to file.txt. Modify file.txt in another process. Information is leaked to the attacker about a file they should not have access to.

'use strict';
const fs = require('node:fs');

async function main() {
	fs.watchFile(__dirname + '/file.txt', () => {
		console.log('able to watch a file without any permissions');
	});
}

main();

Impact: [add why this issue matters]

The permission system is bypassed. Attackers can receive events related to files they do not have access to.

Supporting Material/References:

None

Impact

The permission system is bypassed.