Skip to content

Do not leak Object.prototype when checking for core modules #203

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Nov 25, 2019
Merged

Do not leak Object.prototype when checking for core modules #203

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f6f2a46
[Tests] fix symlink tests for windows
ljharb Nov 25, 2019
c448d08
[Fix] `sync`/`async` Do not leak Object.prototype when checking for c…
nicolo-ribaudo Nov 25, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
var core = require('./lib/core');
var async = require('./lib/async');
async.core = core;
async.isCore = function isCore(x) { return core[x]; };
async.core = require('./lib/core');
async.isCore = require('./lib/is-core');
async.sync = require('./lib/sync');

exports = async;
Expand Down
4 changes: 2 additions & 2 deletions lib/async.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
var core = require('./core');
var fs = require('fs');
var path = require('path');
var caller = require('./caller.js');
var nodeModulesPaths = require('./node-modules-paths.js');
var normalizeOptions = require('./normalize-options.js');
var isCore = require('./is-core');

var defaultIsFile = function isFile(file, cb) {
fs.stat(file, function (err, stat) {
Expand Down Expand Up @@ -98,7 +98,7 @@ module.exports = function resolve(x, options, callback) {
} else loadAsFile(res, opts.package, onfile);
} else loadNodeModules(x, basedir, function (err, n, pkg) {
if (err) cb(err);
else if (core[x]) return cb(null, x);
else if (isCore(x)) return cb(null, x);
else if (n) {
return maybeUnwrapSymlink(n, opts, function (err, realN) {
if (err) {
Expand Down
5 changes: 5 additions & 0 deletions lib/is-core.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
var core = require('./core');

module.exports = function isCore(x) {
return Object.prototype.hasOwnProperty.call(core, x);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

unfortunately this introduced a bug into v1.13.0 (see #231), by changing this from a "truthy" check, to a "presence" check - and the "core" object relies on true/false to differentiate between a core module in some version of node, versus a core module in the current version of node. This was inadvertently fixed when I extracted this logic into https://npmjs.com/is-core-module.

};
6 changes: 3 additions & 3 deletions lib/sync.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
var core = require('./core');
var isCore = require('./is-core');
var fs = require('fs');
var path = require('path');
var caller = require('./caller.js');
Expand Down Expand Up @@ -68,14 +68,14 @@ module.exports = function (x, options) {
if (x === '..' || x.slice(-1) === '/') res += '/';
var m = loadAsFileSync(res) || loadAsDirectorySync(res);
if (m) return maybeUnwrapSymlink(m, opts);
} else if (core[x]) {
} else if (isCore(x)) {
return x;
} else {
var n = loadNodeModulesSync(x, absoluteStart);
if (n) return maybeUnwrapSymlink(n, opts);
}

if (core[x]) return x;
if (isCore(x)) return x;

var err = new Error("Cannot find module '" + x + "' from '" + parent + "'");
err.code = 'MODULE_NOT_FOUND';
Expand Down
3 changes: 3 additions & 0 deletions test/core.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,9 @@ test('core modules', function (t) {

st.ok(!resolve.isCore('seq'));
st.ok(!resolve.isCore('../'));

st.ok(!resolve.isCore('toString'));

st.end();
});

Expand Down
20 changes: 12 additions & 8 deletions test/symlinks.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,6 +101,10 @@ test('async symlink from node_modules to other dir when preserveSymlinks = false
});

test('packageFilter', function (t) {
function relative(x) {
return path.relative(__dirname, x);
}

function testPackageFilter(preserveSymlinks) {
return function (st) {
st.plan(5);
Expand All @@ -120,13 +124,13 @@ test('packageFilter', function (t) {
}
});
st.equal(
actualPath.replace(__dirname + '/', ''),
preserveSymlinks ? destMain : sourceMain,
relative(actualPath),
path.normalize(preserveSymlinks ? destMain : sourceMain),
'sync: actual path is correct'
);
st.deepEqual(
map(packageFilterPath, function (x) { return x.replace(__dirname + '/', ''); }),
preserveSymlinks ? [destPkg, destPkg] : [sourcePkg, sourcePkg],
map(packageFilterPath, relative),
map(preserveSymlinks ? [destPkg, destPkg] : [sourcePkg, sourcePkg], path.normalize),
'sync: packageFilter pkgfile arg is correct'
);

Expand All @@ -143,13 +147,13 @@ test('packageFilter', function (t) {
function (err, actualPath) {
st.error(err, 'no error');
st.equal(
actualPath.replace(__dirname + '/', ''),
preserveSymlinks ? destMain : sourceMain,
relative(actualPath),
path.normalize(preserveSymlinks ? destMain : sourceMain),
'async: actual path is correct'
);
st.deepEqual(
map(asyncPackageFilterPath, function (x) { return x.replace(__dirname + '/', ''); }),
preserveSymlinks ? [destPkg, destPkg, destPkg] : [sourcePkg, sourcePkg, sourcePkg],
map(packageFilterPath, relative),
map(preserveSymlinks ? [destPkg, destPkg] : [sourcePkg, sourcePkg], path.normalize),
'async: packageFilter pkgfile arg is correct'
);
}
Expand Down