GeezerVison is showing github.com — url: process crash via malformed UNC hostname in pathToFileURL() · nodejs/node@9a25fc8
File tree
Expand file treeCollapse file tree
Open diff view settings
Expand file treeCollapse file tree
Open diff view settings
Collapse file
Copy file name to clipboardExpand all lines: src/node_url.cc +5-2Lines changed: 5 additions & 2 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -93,7 +93,6 @@ constexpr auto lookup_table = []() consteval { |
93 | 93 | case CHAR: \ |
94 | 94 | result[i] = {{'%', HEX_DIGIT_2, HEX_DIGIT_1, 0}}; \ |
95 | 95 | break; |
96 | | - |
97 | 96 | ENCODE_CHAR('\0', '0', '0') // '\0' == 0x00 |
98 | 97 | ENCODE_CHAR('\t', '0', '9') // '\t' == 0x09 |
99 | 98 | ENCODE_CHAR('\n', '0', 'A') // '\n' == 0x0A |
@@ -169,7 +168,11 @@ void BindingData::PathToFileURL(const FunctionCallbackInfo<Value>& args) { |
169 | 168 | [[unlikely]] { |
170 | 169 | CHECK(args[2]->IsString()); |
171 | 170 | Utf8Value hostname(isolate, args[2]); |
172 | | - CHECK(out->set_hostname(hostname.ToStringView())); |
| 171 | + if (!out->set_hostname(hostname.ToStringView())) { |
| 172 | + return ThrowInvalidURL(realm->env(), |
| 173 | + input.ToStringView(), |
| 174 | + std::string(hostname.ToStringView())); |
| 175 | + } |
173 | 176 | } |
174 | 177 |
|
175 | 178 | binding_data->UpdateComponents(out->get_components(), out->type); |
|
Collapse file
Copy file name to clipboardExpand all lines: test/parallel/test-url-pathtofileurl.js +8Lines changed: 8 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -21,6 +21,14 @@ const url = require('url'); |
21 | 21 | assert.ok(fileURL.includes('%25')); |
22 | 22 | } |
23 | 23 |
|
| 24 | +{ |
| 25 | + assert.throws(() => { |
| 26 | + url.pathToFileURL('\\\\exa mple\\share\\file.txt', { windows: true }); |
| 27 | + }, { |
| 28 | + code: 'ERR_INVALID_URL', |
| 29 | + }); |
| 30 | +} |
| 31 | + |
24 | 32 | { |
25 | 33 | if (isWindows) { |
26 | 34 | // UNC path: \\server\share\resource |
|