Skip to content

Commit 8c0b723

Browse files
authored
fs,permission: make handling of buffers consistent
Commit 2000c26 added explicit handling of Buffers to fs.symlink, but not to fs.symlinkSync or fs.promises.symlink. This change adapts the latter two functions to behave like fs.symlink. Refs: #49156 Refs: #51212 PR-URL: #52348 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
1 parent 3f5ff8d commit 8c0b723

File tree

2 files changed

+13
-2
lines changed

2 files changed

+13
-2
lines changed

lib/fs.js

+5-1
Original file line numberDiff line numberDiff line change
@@ -1793,7 +1793,11 @@ function symlinkSync(target, path, type) {
17931793
if (permission.isEnabled()) {
17941794
// The permission model's security guarantees fall apart in the presence of
17951795
// relative symbolic links. Thus, we have to prevent their creation.
1796-
if (typeof target !== 'string' || !isAbsolute(toPathIfFileURL(target))) {
1796+
if (BufferIsBuffer(target)) {
1797+
if (!isAbsolute(BufferToString(target))) {
1798+
throw new ERR_ACCESS_DENIED('relative symbolic link target');
1799+
}
1800+
} else if (typeof target !== 'string' || !isAbsolute(toPathIfFileURL(target))) {
17971801
throw new ERR_ACCESS_DENIED('relative symbolic link target');
17981802
}
17991803
}

lib/internal/fs/promises.js

+8-1
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ const {
1717
SymbolAsyncDispose,
1818
Uint8Array,
1919
FunctionPrototypeBind,
20+
uncurryThis,
2021
} = primordials;
2122

2223
const { fs: constants } = internalBinding('constants');
@@ -30,6 +31,8 @@ const {
3031

3132
const binding = internalBinding('fs');
3233
const { Buffer } = require('buffer');
34+
const { isBuffer: BufferIsBuffer } = Buffer;
35+
const BufferToString = uncurryThis(Buffer.prototype.toString);
3336

3437
const {
3538
codes: {
@@ -985,7 +988,11 @@ async function symlink(target, path, type_) {
985988
if (permission.isEnabled()) {
986989
// The permission model's security guarantees fall apart in the presence of
987990
// relative symbolic links. Thus, we have to prevent their creation.
988-
if (typeof target !== 'string' || !isAbsolute(toPathIfFileURL(target))) {
991+
if (BufferIsBuffer(target)) {
992+
if (!isAbsolute(BufferToString(target))) {
993+
throw new ERR_ACCESS_DENIED('relative symbolic link target');
994+
}
995+
} else if (typeof target !== 'string' || !isAbsolute(toPathIfFileURL(target))) {
989996
throw new ERR_ACCESS_DENIED('relative symbolic link target');
990997
}
991998
}

0 commit comments

Comments
 (0)