Apps can read and modify files outside the app directory

[sk1nzz]

Zepp OS API allows apps to access the file system. According to docs, apps can only access their data and assets directories. But if I pass a path argument with ../, I can access files outside the app directory.

For example, I can access the system settings file with

const file = readFileSync({
    path: "../../../sysprop_default"
})

So the API allows me to edit and even delete system files, which might brick the watch.
Is this a security issue? In a good way, 3rd party apps should be isolated from each other and FS API should be restricted to the app folder.

[htoooth]

@sk1nzz Zepp OS 1.0 has this bug. But Zepp OS 2.0 and 3.0 has fixed this bug.

[sk1nzz]

But a read-only access still remains, right? I can read sysprop_default file on my Zepp OS 2.0 watch using my app.