node/lib/internal/fs
Tobias Nießen a4edd22e30 fs: protect against modified Buffer internals in possiblyTransformPath
Use encodeUtf8String from the encoding_binding internal binding to
convert the result of path.resolve() to a Uint8Array instead of using
Buffer.from(), whose result can be manipulated by the user by
monkey-patching internals such as Buffer.prototype.utf8Write.

HackerOne report: https://hackerone.com/reports/2218653

PR-URL: https://github.com/nodejs-private/node-private/pull/497
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2024-21896
2024-02-07 10:45:36 -03:00
..
cp fs: do not throw error on cpSync internals 2023-11-11 20:37:42 +01:00
read fs: improve error performance of sync methods 2023-09-17 20:42:46 +00:00
dir.js fs: introduce dirent.parentPath 2023-12-04 11:15:05 +01:00
glob.js fs: fix glob returning duplicates 2023-11-29 09:46:36 -03:00
promises.js fs: fix fs.promises.realpath for long paths on Windows 2024-01-02 15:05:27 -03:00
recursive_watch.js fs: use kResistStopPropagation 2023-06-24 15:52:38 +00:00
rimraf.js fs: add trailing commas in source files 2023-02-20 01:58:32 +01:00
streams.js fs: add flush option to createWriteStream() 2023-10-11 16:25:05 +00:00
sync_write_stream.js fs: call the callback with an error if writeSync fails 2023-06-26 14:18:58 +00:00
utils.js fs: protect against modified Buffer internals in possiblyTransformPath 2024-02-07 10:45:36 -03:00
watchers.js errors: improve hideStackFrames 2023-11-14 09:18:05 +01:00