Skip to content

vfs: validate ZipProvider parent directories - #65829

Open
trivikr wants to merge 1 commit into
nodejs:mainfrom
trivikr:vfs-zip-provider-non-dir-parents
Open

vfs: validate ZipProvider parent directories#65829
trivikr wants to merge 1 commit into
nodejs:mainfrom
trivikr:vfs-zip-provider-non-dir-parents

Conversation

@trivikr

@trivikr trivikr commented Sep 5, 2026

Copy link
Copy Markdown
Member

Fixes: #65828

Reject attempts to create archive entries beneath non-directory parents. Cover open, mkdir, and rename in the sync and async APIs.

Assisted-by: codex

@nodejs-github-bot nodejs-github-bot added needs-ci PRs that need a full CI run. vfs Issues and PRs related to the virtual filesystem subsystem. labels Sep 5, 2026
@codecov

codecov Bot commented Sep 5, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 91.66667% with 2 lines in your changes missing coverage. Please review.
βœ… Project coverage is 90.17%. Comparing base (bd9d82d) to head (3670ad3).
⚠️ Report is 48 commits behind head on main.

Files with missing lines Patch % Lines
lib/internal/vfs/providers/ziparchive.js 91.66% 2 Missing ⚠️
Additional details and impacted files 
@@           Coverage Diff           @@
##             main   #65829   +/-   ##
=======================================
  Coverage   90.16%   90.17%           
=======================================
  Files         771      771           
  Lines      265485   265509   +24     
  Branches    50466    50476   +10     
=======================================
+ Hits       239381   239416   +35     
+ Misses      17043    17030   -13     
- Partials     9061     9063    +2
Files with missing lines Coverage Ξ”
lib/internal/vfs/providers/ziparchive.js 97.88% <91.66%> (-0.26%) ⬇️

... and 45 files with indirect coverage changes

πŸš€ New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • πŸ“¦ JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@trivikr

trivikr commented Sep 6, 2026

Copy link
Copy Markdown
Member Author

FYI: @pipobscure

@trivikr trivikr added request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. author ready PRs with CI started, the required approvals, and no outstanding review comments. labels Sep 6, 2026
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Sep 6, 2026
@nodejs-github-bot

This comment was marked as outdated.

Sign in to view
@trivikr trivikr added the commit-queue PRs queued for automated landing through the Commit Queue. label Sep 6, 2026
@nodejs-github-bot nodejs-github-bot added lacks-second-approval Commit Queue PRs awaiting a second collaborator approval or completion of the required wait. commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. and removed commit-queue PRs queued for automated landing through the Commit Queue. lacks-second-approval Commit Queue PRs awaiting a second collaborator approval or completion of the required wait. labels Sep 7, 2026
@nodejs-github-bot

This comment was marked as outdated.

Sign in to view
@trivikr trivikr removed commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. author ready PRs with CI started, the required approvals, and no outstanding review comments. labels Sep 9, 2026
@jasnell

jasnell commented Sep 10, 2026

Copy link
Copy Markdown
Member

@trivikr ... this will need a rebase.

@trivikr
vfs: validate ZipProvider parent directories
3670ad3 
Reject attempts to create archive entries beneath non-directory
parents. Cover open, mkdir, and rename in the sync and async APIs.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex
@trivikr
trivikr force-pushed the vfs-zip-provider-non-dir-parents branch from 4a1f731 to 3670ad3 Compare September 10, 2026 01:00
@trivikr
trivikr requested a review from jasnell September 10, 2026 04:05
@trivikr

trivikr commented Sep 10, 2026

Copy link
Copy Markdown
Member Author

this will need a rebase.

Thanks for the reminder. Rebased and requested a re-review.

@trivikr trivikr added request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. and removed request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. labels Sep 10, 2026
@nodejs-github-bot

This comment was marked as outdated.

Sign in to view
@nodejs-github-bot

This comment was marked as outdated.

Sign in to view
@nodejs-github-bot

nodejs-github-bot commented Sep 11, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/77333/

@trivikr trivikr added author ready PRs with CI started, the required approvals, and no outstanding review comments. commit-queue PRs queued for automated landing through the Commit Queue. labels Sep 11, 2026
@nodejs-github-bot nodejs-github-bot added the lacks-second-approval Commit Queue PRs awaiting a second collaborator approval or completion of the required wait. label Sep 11, 2026
@pipobscure

pipobscure commented Sep 11, 2026

Copy link
Copy Markdown
Contributor

LGTM -> I would if I could

@nodejs-github-bot nodejs-github-bot added commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. and removed commit-queue PRs queued for automated landing through the Commit Queue. lacks-second-approval Commit Queue PRs awaiting a second collaborator approval or completion of the required wait. labels Sep 11, 2026
@nodejs-github-bot

nodejs-github-bot commented Sep 11, 2026

Copy link
Copy Markdown
Collaborator

Commit Queue failed

   ⚠  Could not retrieve the email or name of the PR author's from user's GitHub profile!
   βœ–  This PR needs to wait 24 more hours to land (or 0 minutes if there is one more approval)
   ⚠  This PR has conflicts that must be resolved

The pull request was removed from the Commit Queue and labeled commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. . After resolving the failure, remove that label and add commit-queue PRs queued for automated landing through the Commit Queue. to retry.

Full Commit Queue output 
- Loading data for nodejs/node/pull/65829
βœ”  Done loading data for nodejs/node/pull/65829
----------------------------------- PR info ------------------------------------
Title      vfs: validate ZipProvider parent directories (#65829)
   ⚠  Could not retrieve the email or name of the PR author's from user's GitHub profile!
Branch     trivikr:vfs-zip-provider-non-dir-parents -> nodejs:main
Labels     author ready, needs-ci, commit-queue, vfs, lacks-second-approval
Commits    1
 - vfs: validate ZipProvider parent directories
Committers 1
 - Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/65829
Fixes: https://github.com/nodejs/node/issues/65828
Reviewed-By: James M Snell <jasnell@gmail.com>
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/65829
Fixes: https://github.com/nodejs/node/issues/65828
Reviewed-By: James M Snell <jasnell@gmail.com>
--------------------------------------------------------------------------------
   β„Ή  This PR was created on Sat, 05 Sep 2026 20:44:23 GMT
   βœ”  Approvals: 1
   βœ”  - James M Snell (@jasnell) (TSC): https://github.com/nodejs/node/pull/65829#pullrequestreview-5174208091
   βœ–  This PR needs to wait 24 more hours to land (or 0 minutes if there is one more approval)
   ⚠  This PR has conflicts that must be resolved
   βœ”  Last GitHub CI successful
   β„Ή  Last Full PR CI on 2026-09-11T01:57:30Z: https://ci.nodejs.org/job/node-test-pull-request/77333/
- Querying data for job/node-test-pull-request/77333/
βœ”  Build data downloaded
   βœ”  Last Jenkins CI successful
--------------------------------------------------------------------------------
   βœ”  Aborted `git node land` session in /home/runner/work/node/node/.ncu

View workflow run

@github-actions github-actions Bot removed the author ready PRs with CI started, the required approvals, and no outstanding review comments. label Sep 12, 2026
@github-actions

github-actions Bot commented Sep 12, 2026

Copy link
Copy Markdown
Contributor

This pull request has conflicts with its base branch, removing the author ready label.
Please rebase your branch onto the latest base branch, resolve the conflicts locally, and force-push.
Afterwards the pull request needs a fresh collaborator approval, and a collaborator will add the label back once it is author ready again.

@panva panva removed the commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. label Sep 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jasnell jasnell jasnell approved these changes

Assignees

No one assigned

Labels

needs-ci PRs that need a full CI run. vfs Issues and PRs related to the virtual filesystem subsystem.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

vfs: ZipProvider allows creating entries beneath non-directory parents

5 participants

@trivikr @nodejs-github-bot @jasnell @pipobscure @panva