GeezerVisonThe World Wide Web, restored to 800 pixels of glory. | |||||||||||||||||||||||||||||
| Home|About|Gaming cabinet|Archives|How it works|Starter sites | |||||||||||||||||||||||||||||
GeezerVison is showing github.com — module: exports check hasOwnProperty by guybedford · Pull Request #31427 · nodejs/node Conversation
Contributor
This is a possible fix for the issues discussed in #31001 (comment), ensuring a strict property check. I suspect the bug may be prototype pollution although I haven't been able to test this. I'm 80% sure this should resolve the issue though given the information. I haven't included a test as this is more of a correctness feature... testing object pollution sounds more like something that could be covered by some kind of general JS pollution fuzz testing approach than something to be unit tested case-by-case. I will be away for the next 8 hours, please feel free to merge if this works, or to revert the conditional exports unflagging PR if it doesn't. //cc @Trott @richardlau @codebytere Checklist
Sorry, something went wrong. Uh oh!
There was an error while loading. Please reload this page. All reactions
2 tasks done
This comment has been minimized.
richardlau
requested changes
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Tried this locally and it didn't fix the issue. I've run CITGM on
Sorry, something went wrong. Uh oh!
There was an error while loading. Please reload this page. All reactions
Contributor
Author
All reactions
Sorry, something went wrong. Uh oh!
There was an error while loading. Please reload this page.
|
There was an error while loading. Please reload this page.
Yes, I just double checked. CITGM (bluebird only on our fastest platform (s390x)): https://ci.nodejs.org/view/Node.js-citgm/job/citgm-smoker/2231/ |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
@richardlau Do you mind please providing specific steps to reproduce? |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
😅 I have git clones of
|
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
It may be possible to reduce what
So I'm guessing that it used to "work" by falling back to the version of |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
Thanks @richardlau for the replication instructions there - I managed to finally track this down and have updated the PR with the fix. Basically, for some reason, all package.json files are being detected as containing an undefined "exports" field in these cases. So shifting the check to be based on "exports" not being undefined instead of being a property fixes the issue. Tracking down why "exports" is being set as an undefined property on the internally loaded package.json objects is likely a good idea - and entirely unrelated to this PR. I'm not sure if it's due to userland code or internal code. Either way we are good to land with this fix if we can get this fast tracked now. |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
Assuming @richardlau can verify that this PR fixes the issue, I propose we fast-track. |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
|
CITGM (bluebird only): https://ci.nodejs.org/view/Node.js-citgm/job/citgm-smoker/2232/ |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
this still would pass if an inherited exports property existed.
| if (!pkg || pkg.exports === undefined) return false; | |
| if (!pkg || !HasOwnProperty(pkg, 'exports')) return false; |
(also bring in HasOwnProperty from primordials at the top)
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
Isn't that similar to the first commit (d3f5674) which doesn't work (pkg.exports does exist but has an undefined value)?
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
in that case you'd want both checks.
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
Can confirm locally that this appears to fix the issue (and the results so far in https://ci.nodejs.org/view/Node.js-citgm/job/citgm-smoker/2232/ are in agreement). For posterity I also came to a similar discovery about With the following hacky debug (on top of d3f5674): diff --git a/lib/internal/modules/cjs/loader.js b/lib/internal/modules/cjs/loader.js index 01d96a4..7c256e0 100644 --- a/lib/internal/modules/cjs/loader.js +++ b/lib/internal/modules/cjs/loader.js @@ -435,9 +435,9 @@ function resolveBasePath(basePath, exts, isMain, trailingSlash, request) { function trySelf(parentPath, isMain, request) { const { data: pkg, path: basePath } = readPackageScope(parentPath) || {}; - if (!pkg || 'exports' in pkg === false) return false; + if (!pkg || !ObjectPrototypeHasOwnProperty(pkg, 'exports')) return false; if (typeof pkg.name !== 'string') return false; - + if (pkg.name === 'bluebird') console.warn(pkg); let expansion; if (request === pkg.name) { expansion = ''; I got this out of the CITGM output: warn: | { warn: | name: 'bluebird', warn: | main: './js/release/bluebird.js', warn: | exports: undefined, warn: | type: undefined warn: | } |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
What is supposed to happen if someone does |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
|
@guybedford the reason is that |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
@ljharb PTAL - do you still think this needs both checks? i'm gonna land this in a bit otherwise :) |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
@codebytere if the only reason for the bug was #31427 (comment) - and if |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
|
Would be good to see a test added for this. |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
I took the liberty of adding a test. Hope that's OK. Feel free to remote it or modify it or whatever. |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
@Trott do you not feel this should be backported to #31382 then? My other option was to take out the offending unflag commit but i was planning to pick this back if possible |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
I support putting this in the release rather than taking out the unflagging. But I'm fine with pulling out the unflagging and waiting until the next semver minor if you or anyone else is concerned. If it causes widespread breakage, the burden will fall to the releasers to get out a quick fix, so I'll defer to you on what the best thing to do here is. But I'm +1 on getting this into the release. |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
Unflagging conditional exports is very important for ESM adoption. Many package maintainers are waiting for conditional exports before they add ESM support to their packages, especially conditional exports in LTS; so I would err on the side of keeping the unflagging if it all possible. |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
@Trott We can (should?) probably cut out a lot of stuff from the two |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
Agreed, that should happen (and probably rename it from something other than "bluebird") and also someone should follow up on @ljharb's observation and see if the other check is necessary or not. |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
Sorry, something went wrong.
There was an error while loading. Please reload this page.
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
https://ci.nodejs.org/job/node-test-pull-request/28525/ is green. Landing. |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
Landed in 343ddff...dcba128 |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
Refs: nodejs#31001 (comment) PR-URL: nodejs#31427 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Shelley Vohr <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Rich Trott <[email protected]>
Refs: #31001 (comment) PR-URL: #31427 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Shelley Vohr <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Rich Trott <[email protected]>
9cb334a to
dcba128
Compare
Refs: #31001 (comment) PR-URL: #31427 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Shelley Vohr <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Rich Trott <[email protected]>
Refs: #31001 (comment) PR-URL: #31427 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Shelley Vohr <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Rich Trott <[email protected]>
|
Thanks all for the help getting this one sorted. |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
Refs: #31001 (comment) PR-URL: #31427 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Shelley Vohr <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Rich Trott <[email protected]>
Refs: #31001 (comment) PR-URL: #31427 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Shelley Vohr <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Rich Trott <[email protected]>
Refs: nodejs#31001 (comment) PR-URL: nodejs#31427 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Shelley Vohr <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Rich Trott <[email protected]>
Refs: nodejs#31001 (comment) PR-URL: nodejs#31427 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Shelley Vohr <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Rich Trott <[email protected]>
Refs: #31001 (comment) PR-URL: #31427 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Shelley Vohr <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Rich Trott <[email protected]>
Refs: #31001 (comment) PR-URL: #31427 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Shelley Vohr <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Rich Trott <[email protected]>
Refs: #31001 (comment) PR-URL: #31427 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Shelley Vohr <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Rich Trott <[email protected]>
Refs: #31001 (comment) PR-URL: #31427 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Shelley Vohr <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Rich Trott <[email protected]>
There was an error while loading. Please reload this page.
Successfully merging this pull request may close these issues.
There was an error while loading. Please reload this page.