Skip to content

url: bounds-check short Windows file URL paths - #64788

Open
Archkon wants to merge 1 commit into
nodejs:mainfrom
Archkon:url6
Open

url: bounds-check short Windows file URL paths#64788
Archkon wants to merge 1 commit into
nodejs:mainfrom
Archkon:url6

Conversation

@Archkon

@Archkon Archkon commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

Check the decoded pathname length before reading the drive letter and colon. This prevents an out-of-bounds read for short URLs such as file:/// and reports ERR_INVALID_FILE_URL_PATH instead.

Check the decoded pathname length before reading the drive letter and
colon. This prevents an out-of-bounds read for short URLs such as
file:/// and reports ERR_INVALID_FILE_URL_PATH instead.

Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/url

@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. whatwg-url Issues and PRs related to the WHATWG URL implementation. labels Jul 27, 2026
@codecov

codecov Bot commented Jul 27, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.15%. Comparing base (58795e9) to head (acdea38).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main   #64788      +/-   ##
==========================================
- Coverage   90.16%   90.15%   -0.02%     
==========================================
  Files         744      744              
  Lines      242518   242518              
  Branches    45692    45690       -2     
==========================================
- Hits       218663   218638      -25     
- Misses      15349    15366      +17     
- Partials     8506     8514       +8     
Files with missing lines Coverage Δ
src/node_url.cc 78.74% <ø> (-0.28%) ⬇️

... and 23 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. whatwg-url Issues and PRs related to the WHATWG URL implementation.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants