github/electron
1
1
Fork 0
mirror of https://github.com/electron/electron.git synced 2026-01-09 15:38:08 -05:00
Code Issues Packages Projects Releases Wiki Activity

fix: crash on windows when UTF-8 is in path (#48898)

Browse Source 
In 6399527761 we changed the path strings
that `node_modules.cc` operates on from single-byte to wide strings.
Unfortunately this means that `generic_path()` that the
"fix: ensure TraverseParent bails on resource path exit" patch was
calling was no longer a safe method to call on Windows if the underlying
string has unicode characters in it.

Here we fix it by using `ConvertGenericPathToUTF8` from the Node.js
internal utilities.
This commit is contained in:
Fedor Indutny
2025-11-13 10:09:34 -08:00
committed by GitHub
parent 8ecd064d2c
commit b9d3f15265
5 changed files with 19 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
patches/node/.patches
View File

@@ -26,7 +26,6 @@ build_allow_unbundling_of_node_js_dependencies.patch
build_change_crdtp_protocoltypetraits_signatures_to_avoid_conflict.patch
fix_adjust_wpt_and_webidl_tests_for_enabled_float16array.patch
refactor_attach_cppgc_heap_on_v8_isolate_creation.patch
fix_ensure_traverseparent_bails_on_resource_path_exit.patch
fix_cppgc_initializing_twice.patch
fix_expose_readfilesync_override_for_modules.patch
fix_array_out-of-bounds_read_in_boyer-moore_search.patch
@@ -42,4 +41,5 @@ chore_handle_support_for_import_defer_as_ns_and_import_defer.patch
api_delete_deprecated_fields_on_v8_isolate.patch
api_promote_deprecation_of_v8_context_and_v8_object_api_methods.patch
src_use_cp_utf8_for_wide_file_names_on_win32.patch
fix_ensure_traverseparent_bails_on_resource_path_exit.patch
reland_temporal_unflag_temporal.patch

4
patches/node/api_remove_deprecated_getisolate.patch
View File

@@ -586,7 +586,7 @@ index 57e068ae249d618c2658638f9f3b03e1fedb6524..8c51ae4e0a435971c6d0288af8781087
data_.Reset();
return ret;
diff --git a/src/node_modules.cc b/src/node_modules.cc
index bdbc511ef3f680bbac6770b89f47acaee95d56a2..d8477191efafba3c41c06d765f4b03bd00b8573c 100644
index eea4ba313d8dbcf7b88b79f5a3e9ba2eb39d7c3e..529b7cfc15536c3fe5e7798c0f82698121751f2a 100644
--- a/src/node_modules.cc
+++ b/src/node_modules.cc
@@ -69,7 +69,7 @@ void BindingData::Deserialize(v8::Local<v8::Context> context,
@@ -598,7 +598,7 @@ index bdbc511ef3f680bbac6770b89f47acaee95d56a2..d8477191efafba3c41c06d765f4b03bd
Realm* realm = Realm::GetCurrent(context);
BindingData* binding = realm->AddBindingData<BindingData>(holder);
CHECK_NOT_NULL(binding);
@@ -735,7 +735,7 @@ void BindingData::CreatePerContextProperties(Local<Object> target,
@@ -696,7 +696,7 @@ void BindingData::CreatePerContextProperties(Local<Object> target,
Realm* realm = Realm::GetCurrent(context);
realm->AddBindingData<BindingData>(target);

16
patches/node/fix_ensure_traverseparent_bails_on_resource_path_exit.patch
View File

@@ -8,10 +8,10 @@ resource path. This commit ensures that the TraverseParent function
bails out if the parent path is outside of the resource path.
diff --git a/src/node_modules.cc b/src/node_modules.cc
index 9eec93f52f0d0b2e45ae04ff357b4ced0770782f..b93ccedaf703f86ae2092c304785394c471d520c 100644
index cbc3283fc2d511cce2eae0048cc9bf0fa917d38a..3b4d82da2ad30cafa96611eaa2d68ddf1badeac0 100644
--- a/src/node_modules.cc
+++ b/src/node_modules.cc
@@ -284,8 +284,41 @@ const BindingData::PackageConfig* BindingData::TraverseParent(
@@ -320,8 +320,41 @@ const BindingData::PackageConfig* BindingData::TraverseParent(
Realm* realm, const std::filesystem::path& check_path) {
std::filesystem::path current_path = check_path;
auto env = realm->env();
@@ -47,22 +47,22 @@ index 9eec93f52f0d0b2e45ae04ff357b4ced0770782f..b93ccedaf703f86ae2092c304785394c
+ });
+ };
+
+ bool did_original_path_start_with_resources_path = starts_with(check_path.
+ generic_string(), resources_path);
+ bool did_original_path_start_with_resources_path = starts_with(
+ ConvertGenericPathToUTF8(check_path), resources_path);
+
do {
current_path = current_path.parent_path();
@@ -304,6 +337,12 @@ const BindingData::PackageConfig* BindingData::TraverseParent(
return nullptr;
@@ -341,6 +374,12 @@ const BindingData::PackageConfig* BindingData::TraverseParent(
}
}
+ // If current path is outside the resources path, bail.
+ if (did_original_path_start_with_resources_path &&
+ !starts_with(current_path.generic_string(), resources_path)) {
+ !starts_with(ConvertGenericPathToUTF8(current_path), resources_path)) {
+ return nullptr;
+ }
+
// Check if the path ends with `/node_modules`
if (current_path.generic_string().ends_with("/node_modules")) {
if (current_path.filename() == "node_modules") {
return nullptr;

6
patches/node/fix_expose_readfilesync_override_for_modules.patch
View File

@@ -20,7 +20,7 @@ index 2884149d82d180e0d2ecfa7ac8fd92f201f1cb55..dded4bf3d7106d127efbad81087f0c37
V(performance_entry_callback, v8::Function) \
V(prepare_stack_trace_callback, v8::Function) \
diff --git a/src/node_modules.cc b/src/node_modules.cc
index b93ccedaf703f86ae2092c304785394c471d520c..bdbc511ef3f680bbac6770b89f47acaee95d56a2 100644
index 9eec93f52f0d0b2e45ae04ff357b4ced0770782f..eea4ba313d8dbcf7b88b79f5a3e9ba2eb39d7c3e 100644
--- a/src/node_modules.cc
+++ b/src/node_modules.cc
@@ -23,6 +23,7 @@ namespace modules {
@@ -90,7 +90,7 @@ index b93ccedaf703f86ae2092c304785394c471d520c..bdbc511ef3f680bbac6770b89f47acae
void BindingData::ReadPackageJSON(const FunctionCallbackInfo<Value>& args) {
CHECK_GE(args.Length(), 1); // path, [is_esm, base, specifier]
CHECK(args[0]->IsString()); // path
@@ -674,6 +710,8 @@ void SaveCompileCacheEntry(const FunctionCallbackInfo<Value>& args) {
@@ -635,6 +671,8 @@ void SaveCompileCacheEntry(const FunctionCallbackInfo<Value>& args) {
void BindingData::CreatePerIsolateProperties(IsolateData* isolate_data,
Local<ObjectTemplate> target) {
Isolate* isolate = isolate_data->isolate();
@@ -99,7 +99,7 @@ index b93ccedaf703f86ae2092c304785394c471d520c..bdbc511ef3f680bbac6770b89f47acae
SetMethod(isolate, target, "readPackageJSON", ReadPackageJSON);
SetMethod(isolate,
target,
@@ -733,6 +771,8 @@ void BindingData::CreatePerContextProperties(Local<Object> target,
@@ -694,6 +732,8 @@ void BindingData::CreatePerContextProperties(Local<Object> target,
void BindingData::RegisterExternalReferences(
ExternalReferenceRegistry* registry) {

14
patches/node/src_use_cp_utf8_for_wide_file_names_on_win32.patch
View File

@@ -1,6 +1,6 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Fedor Indutny <238531+indutny@users.noreply.github.com>
Date: Fri, 7 Nov 2025 19:41:44 -0800
From: Fedor Indutny <indutny@signal.org>
Date: Tue, 11 Nov 2025 13:43:01 -0800
Subject: src: use CP_UTF8 for wide file names on win32
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
@@ -136,10 +136,10 @@ index 969e7d08086f8442bed476feaf15599b8c79db7c..e7459654401c275dfb86207831016ed7
std::make_error_code(std::errc::file_exists),
"cp",
diff --git a/src/node_modules.cc b/src/node_modules.cc
index d8477191efafba3c41c06d765f4b03bd00b8573c..5444e556b89ba5b71739753eaafa706cd9727013 100644
index 529b7cfc15536c3fe5e7798c0f82698121751f2a..cbc3283fc2d511cce2eae0048cc9bf0fa917d38a 100644
--- a/src/node_modules.cc
+++ b/src/node_modules.cc
@@ -365,12 +365,13 @@ const BindingData::PackageConfig* BindingData::TraverseParent(
@@ -332,22 +332,24 @@ const BindingData::PackageConfig* BindingData::TraverseParent(
// Stop the search when the process doesn't have permissions
// to walk upwards
@@ -158,10 +158,6 @@ index d8477191efafba3c41c06d765f4b03bd00b8573c..5444e556b89ba5b71739753eaafa706c
+ }
}
// If current path is outside the resources path, bail.
@@ -380,13 +381,14 @@ const BindingData::PackageConfig* BindingData::TraverseParent(
}
// Check if the path ends with `/node_modules`
- if (current_path.generic_string().ends_with("/node_modules")) {
+ if (current_path.filename() == "node_modules") {
@@ -176,7 +172,7 @@ index d8477191efafba3c41c06d765f4b03bd00b8573c..5444e556b89ba5b71739753eaafa706c
if (package_json != nullptr) {
return package_json;
}
@@ -408,20 +410,12 @@ void BindingData::GetNearestParentPackageJSONType(
@@ -369,20 +371,12 @@ void BindingData::GetNearestParentPackageJSONType(
ToNamespacedPath(realm->env(), &path_value);