Tobias Nießen 46ce278079 fs: protect against modified Buffer internals in possiblyTransformPath ...

Use encodeUtf8String from the encoding_binding internal binding to
convert the result of path.resolve() to a Uint8Array instead of using
Buffer.from(), whose result can be manipulated by the user by
monkey-patching internals such as Buffer.prototype.utf8Write.

HackerOne report: https://hackerone.com/reports/2218653

PR-URL: https://github.com/nodejs-private/node-private/pull/497
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2024-21896

2024-02-14 14:27:34 -03:00

..

cp

fs: do not throw error on cpSync internals

2023-10-23 17:22:28 +00:00

read

fs: improve error performance of sync methods

2023-09-17 20:42:46 +00:00

dir.js

fs: use private fields instead of symbols for Dir

2023-12-28 06:16:13 +00:00

glob.js

fs: fix glob returning duplicates

2023-11-26 07:31:58 +00:00

promises.js

fs: load rimraf lazily in fs/promises

2024-02-02 14:13:58 +00:00

recursive_watch.js

fs: remove race condition for recursive watch on Linux

2024-01-25 08:53:21 +00:00

rimraf.js

fs: add trailing commas in source files

2023-02-20 01:58:32 +01:00

streams.js

fs: add flush option to createWriteStream()

2023-10-11 16:25:05 +00:00

sync_write_stream.js

fs: call the callback with an error if writeSync fails

2023-06-26 14:18:58 +00:00

utils.js

fs: protect against modified Buffer internals in possiblyTransformPath

2024-02-14 14:27:34 -03:00

watchers.js

errors: improve hideStackFrames

2023-11-11 16:25:08 +00:00