fs: validate falsy openAsBlob type option

openAsBlob() and openAsBlobSync() read the MIME type as
options.type || '' before validating it, causing falsy non-string
values to be replaced with the default before reaching validateString().
As a result, { type: 0 }, { type: false }, { type: null }, and
{ type: NaN } are accepted as an empty type, while { type: 1 }
throws ERR_INVALID_ARG_TYPE.

Default the option only when it is undefined so all other values are
validated against the documented string type.

Signed-off-by: Christian Aurich Zanettini Martins <christian.aurichzm@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66125
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
This commit is contained in:
Christian Aurich Zanettini Martins authored and GitHub committed 2026-09-25 19:44:48 +00:00
1 parent 63a6ea26bb
commit cc610f1cfb
2 files changed
+10 -5

No files matched your search

+2 -2
View File
@@ -790,7 +790,7 @@ function openSync(path, flags, mode) {
*/
function openAsBlob(path, options = kEmptyObject) {
validateObject(options, 'options');
const type = options.type || '';
const { type = '' } = options;
validateString(type, 'options.type');
const h = vfsState.handlers;
@@ -816,7 +816,7 @@ function openAsBlob(path, options = kEmptyObject) {
*/
function openAsBlobSync(path, options = kEmptyObject) {
validateObject(options, 'options');
const type = options.type || '';
const { type = '' } = options;
validateString(type, 'options.type');
path = getValidatedPath(path);
+8 -3
View File
@@ -23,9 +23,14 @@ assert.throws(() => fs.openAsBlobSync(1), {
assert.throws(() => fs.openAsBlobSync(testfile, null), {
code: 'ERR_INVALID_ARG_TYPE',
});
assert.throws(() => fs.openAsBlobSync(testfile, { type: 1 }), {
code: 'ERR_INVALID_ARG_TYPE',
});
for (const type of [1, 0, false, null, NaN, {}]) {
assert.throws(() => fs.openAsBlobSync(testfile, { type }), {
code: 'ERR_INVALID_ARG_TYPE',
});
assert.throws(() => fs.openAsBlob(testfile, { type }), {
code: 'ERR_INVALID_ARG_TYPE',
});
}
assert.throws(() => fs.openAsBlobSync(missing), {
code: 'ENOENT',
syscall: 'stat',