VSCode can still create "invalid" files/folders on Windows

[CherryDT]

Issue Type: Bug

This references #1579 which was about the same problem already (originally in the save dialog, but further down also about special filenames from the command line).

I'm still able to accidentally create hard-to-delete files and folders with VSCode in Windows, which I believe is bad UX and I see an effort to prevent this (e.g. trying to save NUL or abc?* is actively prevented), so I think this counts as a bug.

1. Creating invalid folders: Start code.exe/code.bat with a parameter like C:\nope...\wtf.txt. Good luck getting rid of the folder nope... afterwards (worse with ... alone of course which can end up deleting the whole drive instead if you are not careful). Reason: Seems like you are not validating the directories in the given path.

2. Creating invalid files: Either start code.exe/code.bat with a parameter like NUL.txt or create such a file in the project explorer sidebar. Note that you cannot delete the file even in the sidebar when you created it there! While doing so, by the way, you will notice that upon entering NUL an error is shown, but NUL.txt is accepted. Reason: Seems like you are comparing against a known list of invalid names and not applying the actual rules.

A good read about these problems is this article.

A solution could be calling fs.realpath.native, which uses GetFullPathName to get the resolved path (instead of path.resolve) and further verifying that the result...

• ...does not start with \\.\ or \\?\ (rules out most cases, since for example C:\abc\COM1.txt would have become \\.\COM1 at that point)
• ...does not start with X:\??\ where X can be any character (rules out the case incorrectly handled by GetFullPathName where Windows accepts \??\ as alias for \\?\)
• ...does not contain forbidden characters (:;\/|<>?*")
  ...and additionally check that after removing one path segment after another, the above conditions still hold.

(But yeah I know that this probably won't be worth the effort. It's up to you to decide about that though.)

VS Code version: Code - Insiders 1.28.0-insider (60db21f, 2018-10-02T13:26:37.890Z)
OS version: Windows_NT x64 10.0.17134

System Info

Item	Value
CPUs	Intel(R) Core(TM) i7-6600U CPU @ 2.60GHz (4 x 2808)
GPU Status	2d_canvas: enabled checker_imaging: disabled_off flash_3d: enabled flash_stage3d: enabled flash_stage3d_baseline: enabled gpu_compositing: enabled multiple_raster_threads: enabled_on native_gpu_memory_buffers: disabled_software rasterization: enabled video_decode: enabled video_encode: enabled webgl: enabled webgl2: enabled
Memory (System)	15.83GB (6.73GB free)
Process Argv
Screen Reader	no
VM	0%

Extensions (85)

Extension	Author (truncated)	Version
language-x86-64-assembly	13x	2.2.11
rebound-delete	aar	1.1.0
paste-fixer	aar	1.0.0
calculate	aca	2.1.0
vscode-caniuse	aka	0.5.3
Bookmarks	ale	9.1.0
read-only-indicator	ale	2.1.0
vscode-lcov	ale	0.2.0
vscode-color	ans	0.4.5
code-gnu-global	aus	0.2.2
Doxygen	bbe	1.0.0
solidity-extended	bea	3.0.2
htmltagwrap	bra	0.0.7
vscode-standardjs-snippets	cap	0.7.10
vscode-standardjs	che	1.2.3
npm-intellisense	chr	1.3.0
jsrefactor	cms	2.15.1
gitignore	cod	0.5.0
compulim-vscode-closetag	Com	1.2.0
riot-tag	cri	0.1.7
autoit	Dam	0.2.0
vscode-markdownlint	Dav	0.20.0
jshint	dba	0.10.20
vscode-eslint	dba	1.6.0
vscode-new-file	dku	4.0.2
vscode-npm-source	dku	1.0.0
xml	Dot	2.3.2
gitlens	eam	8.5.6
EditorConfig	Edi	0.12.4
vscode-npm-script	eg2	0.3.5
LogFileHighlighter	emi	2.4.1
gc-excelviewer	Gra	2.1.26
JSDocTagComplete	Hoo	0.0.2
minify	Hoo	0.3.0
RelativePath	jak	1.4.0
hungry-delete	jas	1.5.0
docthis	joe	0.7.1
join-comment-aware	joh	0.0.3
typings-autoinstaller	jvi	1.2.0
format-indent	Kas	1.3.0
Lua	key	0.0.9
vscode-nsis	Kry	0.0.1
VBScript	lug	0.0.2
edge	luo	0.3.1
rainbow-csv	mec	0.6.0
dotenv	mik	1.0.1
ecdc	mit	0.12.0
HTMLHint	mka	0.5.0
find-jump	mks	1.2.4
prettify-json	moh	0.0.3
python	ms-	2018.8.0
cpptools	ms-	0.19.0
PowerShell	ms-	1.9.0
wordcount	ms-	0.1.0
debugger-for-chrome	msj	4.10.2
node-modules-resolve	nau	1.0.2
createGUID	nwa	0.0.2
ejs-language-support	Qas	0.0.1
quicktype	qui	12.0.46
java	red	0.31.0
json-organizer	rin	0.0.3
LiveServer	rit	5.1.1
ActiveFileInStatusBar	Ros	1.0.3
vscode-paste-and-indent	Rub	0.0.8
vscode-coverage-gutters	rya	2.2.0
bracket-jumper	sas	1.1.8
trailing-spaces	sha	0.2.11
vscode-autohotkey	sle	0.2.2
rewrap	stk	1.9.1
code-spell-checker	str	1.6.10
ignore-gitignore	stu	1.0.1
ReactSnippetsStandard	Tim	1.1.0
language-pde	Tob	1.2.2
js-complexity-analysis	Tom	2.0.0
sort-lines	Tyr	1.7.0
bracket-padder	via	0.0.1
vscode-java-debug	vsc	0.13.0
vscode-java-test	vsc	0.9.0
vscode-maven	vsc	0.11.0
vscode-devdocs	ben	0.1.0
quokka-vscode	Wal	1.0.151
vscode-todo-highlight	way	1.0.4
change-case	wma	1.0.0
FilterText	yhi	0.0.11
html-css-class-completion	Zig	1.17.1

[markdall]

FWIW, VSCode (CLI) allowed me to open (but then wouldn't save) c:\projects\foo.txt\filename.txt because f<tab> auto-completed to foo.txt instead of fun_project or whatever. It was "my bad" but it would have been nice if VSCode had realized that you can't use a file name as part of a path. I'm leaving this comment here as proof that someone somewhere searched for existing bugs before opening a new one. I think this fits here but if you don't, feel free to open a separate bug.