Skip to content

vfs: validate ZipProvider parent directories - #65829

Merged
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
trivikr:vfs-zip-provider-non-dir-parents
Sep 22, 2026
Merged

vfs: validate ZipProvider parent directories#65829
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
trivikr:vfs-zip-provider-non-dir-parents

Conversation

@trivikr

@trivikr trivikr commented Sep 5, 2026

Copy link
Copy Markdown
Member

Fixes: #65828

Reject attempts to create archive entries beneath non-directory parents. Cover open, mkdir, and rename in the sync and async APIs.

Assisted-by: codex

@nodejs-github-bot nodejs-github-bot added needs-ci PRs that need a full CI run. vfs Issues and PRs related to the virtual filesystem subsystem. labels Sep 5, 2026
@codecov

codecov Bot commented Sep 5, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 91.66667% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.29%. Comparing base (20b3a69) to head (246c3bf).
⚠️ Report is 21 commits behind head on main.

Files with missing lines Patch % Lines
lib/internal/vfs/providers/ziparchive.js 91.66% 2 Missing ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##             main   #65829      +/-   ##
==========================================
- Coverage   90.30%   90.29%   -0.02%     
==========================================
  Files         790      790              
  Lines      272044   272068      +24     
  Branches    51934    51945      +11     
==========================================
- Hits       245671   245655      -16     
- Misses      16875    16914      +39     
- Partials     9498     9499       +1
Files with missing lines Coverage Δ
lib/internal/vfs/providers/ziparchive.js 96.83% <91.66%> (-0.20%) ⬇️

... and 28 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@trivikr

trivikr commented Sep 6, 2026

Copy link
Copy Markdown
Member Author

FYI: @pipobscure

@trivikr trivikr added request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. author ready PRs with CI started, the required approvals, and no outstanding review comments. labels Sep 6, 2026
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Sep 6, 2026
@nodejs-github-bot

This comment was marked as outdated.

Sign in to view
@trivikr trivikr added the commit-queue PRs queued for automated landing through the Commit Queue. label Sep 6, 2026
@nodejs-github-bot nodejs-github-bot added lacks-second-approval Commit Queue PRs awaiting a second collaborator approval or completion of the required wait. commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. and removed commit-queue PRs queued for automated landing through the Commit Queue. lacks-second-approval Commit Queue PRs awaiting a second collaborator approval or completion of the required wait. labels Sep 7, 2026
@nodejs-github-bot

This comment was marked as outdated.

Sign in to view
@trivikr trivikr removed commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. author ready PRs with CI started, the required approvals, and no outstanding review comments. labels Sep 9, 2026
@jasnell

jasnell commented Sep 10, 2026

Copy link
Copy Markdown
Member

@trivikr ... this will need a rebase.

@trivikr
trivikr force-pushed the vfs-zip-provider-non-dir-parents branch from 4a1f731 to 3670ad3 Compare September 10, 2026 01:00
@trivikr
trivikr requested a review from jasnell September 10, 2026 04:05
@trivikr

trivikr commented Sep 10, 2026

Copy link
Copy Markdown
Member Author

this will need a rebase.

Thanks for the reminder. Rebased and requested a re-review.

@trivikr trivikr added request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. and removed request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. labels Sep 10, 2026
@nodejs-github-bot

This comment was marked as outdated.

Sign in to view
@nodejs-github-bot

This comment was marked as outdated.

Sign in to view
@nodejs-github-bot

nodejs-github-bot commented Sep 11, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/77333/

@trivikr trivikr added author ready PRs with CI started, the required approvals, and no outstanding review comments. commit-queue PRs queued for automated landing through the Commit Queue. labels Sep 11, 2026
@nodejs-github-bot nodejs-github-bot added the lacks-second-approval Commit Queue PRs awaiting a second collaborator approval or completion of the required wait. label Sep 11, 2026
@pipobscure

pipobscure commented Sep 11, 2026

Copy link
Copy Markdown
Contributor

LGTM -> I would if I could

@nodejs-github-bot nodejs-github-bot added commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. and removed commit-queue PRs queued for automated landing through the Commit Queue. lacks-second-approval Commit Queue PRs awaiting a second collaborator approval or completion of the required wait. labels Sep 11, 2026
@nodejs-github-bot

This comment was marked as outdated.

Sign in to view
@github-actions github-actions Bot removed the author ready PRs with CI started, the required approvals, and no outstanding review comments. label Sep 12, 2026
@github-actions

This comment was marked as outdated.

Sign in to view
@panva panva removed the commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. label Sep 12, 2026
@trivikr
vfs: validate ZipProvider parent directories
246c3bf 
Reject attempts to create archive entries beneath non-directory
parents. Cover open, mkdir, and rename in the sync and async APIs.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex
@trivikr
trivikr force-pushed the vfs-zip-provider-non-dir-parents branch from 3670ad3 to 246c3bf Compare September 22, 2026 01:10
@nodejs-github-bot

nodejs-github-bot commented Sep 22, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/77733/

@trivikr
trivikr requested a review from jasnell September 22, 2026 05:56
@trivikr

trivikr commented Sep 22, 2026

Copy link
Copy Markdown
Member Author

Rebased to resolve conflicts.

@jasnell can you re-approve?

@trivikr trivikr added the commit-queue PRs queued for automated landing through the Commit Queue. label Sep 22, 2026
@nodejs-github-bot
nodejs-github-bot merged commit dd5cf4c into nodejs:main Sep 22, 2026
68 checks passed
@nodejs-github-bot

nodejs-github-bot commented Sep 22, 2026

Copy link
Copy Markdown
Collaborator

Landed in dd5cf4c

@nodejs-github-bot nodejs-github-bot removed the commit-queue PRs queued for automated landing through the Commit Queue. label Sep 22, 2026
@trivikr
trivikr deleted the vfs-zip-provider-non-dir-parents branch September 23, 2026 01:29
aduh95 pushed a commit that referenced this pull request Sep 27, 2026
@trivikr @aduh95
vfs: validate ZipProvider parent directories
d5b65c3 
Reject attempts to create archive entries beneath non-directory
parents. Cover open, mkdir, and rename in the sync and async APIs.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex
PR-URL: #65829
Fixes: #65828
Reviewed-By: James M Snell <jasnell@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jasnell jasnell jasnell approved these changes

Assignees

No one assigned

Labels

needs-ci PRs that need a full CI run. vfs Issues and PRs related to the virtual filesystem subsystem.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

vfs: ZipProvider allows creating entries beneath non-directory parents

5 participants

@trivikr @nodejs-github-bot @jasnell @pipobscure @panva