GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — url: bounds-check short Windows file URL paths by Archkon · Pull Request #64788 · nodejs/node

Conversation

@Archkon

@Archkon Archkon commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

Check the decoded pathname length before reading the drive letter and colon. This prevents an out-of-bounds read for short URLs such as file:/// and reports ERR_INVALID_FILE_URL_PATH instead.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
@nodejs-github-bot

nodejs-github-bot commented Jul 27, 2026

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/url
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. whatwg-url Issues and PRs related to the WHATWG URL implementation. labels Jul 27, 2026
@codecov

codecov Bot commented Jul 27, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.14%. Comparing base (6a3d80f) to head (cf6d0d8).
⚠️ Report is 195 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main   #64788      +/-   ##
==========================================
- Coverage   90.16%   90.14%   -0.03%     
==========================================
  Files         744      744              
  Lines      242518   242542      +24     
  Branches    45705    45692      -13     
==========================================
- Hits       218670   218637      -33     
- Misses      15357    15401      +44     
- Partials     8491     8504      +13     
Files with missing lines Coverage Δ
src/node_url.cc 79.01% <ø> (ø)

... and 36 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@Archkon
Archkon force-pushed the url6 branch from acdea38 to 2a73474 Compare July 28, 2026 04:14
@Archkon
url: bounds-check short Windows file URL paths
cf6d0d8
Check the decoded pathname length before reading the drive letter and
colon. This prevents an out-of-bounds read for short URLs such as
file:/// and reports ERR_INVALID_FILE_URL_PATH instead.

Signed-off-by: Archkon <[email protected]>
@Archkon
Archkon force-pushed the url6 branch 4 times, most recently from c6af942 to cf6d0d8 Compare July 28, 2026 07:01
StefanStojanovic
StefanStojanovic approved these changes Jul 28, 2026
View reviewed changes
@Archkon

This comment was marked as spam.

Sign in to view
avivkeller
avivkeller approved these changes Aug 5, 2026
View reviewed changes
@avivkeller avivkeller added author ready PRs with CI started, the required approvals, and no outstanding review comments. request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. labels Aug 5, 2026
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Aug 5, 2026
@nodejs-github-bot

nodejs-github-bot commented Aug 5, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/75496/

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@Archkon

This comment was marked as spam.

Sign in to view
@Archkon

This comment was marked as spam.

Sign in to view
@nodejs-github-bot

nodejs-github-bot commented Aug 8, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/75646/

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@Archkon

This comment was marked as spam.

Sign in to view
avivkeller pushed a commit that referenced this pull request Aug 9, 2026
@Archkon @avivkeller
url: bounds-check short Windows file URL paths
ee5a070
Check the decoded pathname length before reading the drive letter and
colon. This prevents an out-of-bounds read for short URLs such as
file:/// and reports ERR_INVALID_FILE_URL_PATH instead.

Signed-off-by: Archkon <[email protected]>
PR-URL: #64788
Reviewed-By: Stefan Stojanovic <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>
@avivkeller

avivkeller commented Aug 9, 2026

Copy link
Copy Markdown
Member

Landed in ee5a070

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@avivkeller avivkeller closed this Aug 9, 2026
@Archkon
Archkon deleted the url6 branch August 9, 2026 14:25
aduh95 pushed a commit that referenced this pull request Aug 13, 2026
@Archkon @aduh95
url: bounds-check short Windows file URL paths
0bf6cfd
Check the decoded pathname length before reading the drive letter and
colon. This prevents an out-of-bounds read for short URLs such as
file:/// and reports ERR_INVALID_FILE_URL_PATH instead.

Signed-off-by: Archkon <[email protected]>
PR-URL: #64788
Reviewed-By: Stefan Stojanovic <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>
aduh95 pushed a commit that referenced this pull request Aug 25, 2026
@Archkon @aduh95
url: bounds-check short Windows file URL paths
001c37c
Check the decoded pathname length before reading the drive letter and
colon. This prevents an out-of-bounds read for short URLs such as
file:/// and reports ERR_INVALID_FILE_URL_PATH instead.

Signed-off-by: Archkon <[email protected]>
PR-URL: #64788
Reviewed-By: Stefan Stojanovic <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>
@github-actions github-actions Bot mentioned this pull request Aug 25, 2026
2026-08-26, Version 26.8.0 (Current) #65551
Merged
aduh95 pushed a commit that referenced this pull request Aug 27, 2026
@Archkon @aduh95
url: bounds-check short Windows file URL paths
8e2461d
Check the decoded pathname length before reading the drive letter and
colon. This prevents an out-of-bounds read for short URLs such as
file:/// and reports ERR_INVALID_FILE_URL_PATH instead.

Signed-off-by: Archkon <[email protected]>
PR-URL: #64788
Reviewed-By: Stefan Stojanovic <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>
@github-actions github-actions Bot mentioned this pull request Sep 7, 2026
2026-09-08, Version 24.21.0 'Krypton' (LTS) #65873
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@StefanStojanovic StefanStojanovic StefanStojanovic approved these changes
@avivkeller avivkeller avivkeller approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

author ready PRs with CI started, the required approvals, and no outstanding review comments. c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. whatwg-url Issues and PRs related to the WHATWG URL implementation.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@Archkon @nodejs-github-bot @avivkeller @StefanStojanovic
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.