Skip to content

Calling require with null char as first char of the path component causes crash #13788

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
zimbabao wants to merge 4 commits into from
Closed

Calling require with null char as first char of the path component causes crash #13788

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
0419b14
module: ignore module path after null character
zimbabao Jun 17, 2017
96cbbea
module: ignore module path after null character
zimbabao Jun 19, 2017
0861c3b
module: ignore module path after null character
zimbabao Jun 20, 2017
01c5127
module: ignore module path after null character
zimbabao Jun 20, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
module: ignore module path after null character 
Null char as the first char as the path component
of first argument of require causes a node crash.
Ignoring null and all chars after that in require path.

Fixes: #13787
  • Loading branch information
@zimbabao
zimbabao committed Jun 20, 2017
commit 0861c3bfab5098d6b4e895e3a7f1166fa740a1ac
4 changes: 3 additions & 1 deletion lib/module.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -511,7 +511,9 @@ Module.prototype.require = function(path) {
assert(path, 'missing path');
assert(typeof path === 'string', 'path must be a string');
// Ignore part of the path after null character if it exists
path = path.split('\u0000')[0];
if (path.indexOf('\u0000') != -1) {
Copy link
Member

@gibfahn gibfahn Jun 20, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we just do:

if (path.includes('\u0000') {

Copy link
Contributor

@mscdex mscdex Jun 20, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I just ran a simple benchmark to compare the two on master and it seems indexOf() is still quite a bit faster overall.

Copy link
Contributor

@mscdex mscdex Jun 20, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

However, we should use double equals here: !== -1

path = path.split('\u0000')[0];
}
return Module._load(path, this, /* isMain */ false);
};

Expand Down