Build: Make middleware-mockserver not crash on reading nonexistent files #5579
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
`fs.readFileSync` crashes when a non-existing file is passed to it. Some APIs of `middleware-mockserver` read a file the path of which depends on query parameters, making it possible to crash it by providing such a parameter. The old PHP server doesn't have these issues. To fix this, wrap all `fs.readFileSync` occurrences with a function that falls back to the string `"ERROR"`.
|
I'm curious what prompted this. |
@timmywil I was testing whether you can abuse the param-based jquery/test/middleware-mockserver.cjs Lines 263 to 264 in 329661f external or globaleval, it will crash the server.
I felt it's a good property of even a dev server to not crash on a simple GET request like that. |
timmywil
approved these changes
Nov 5, 2024
mgol
added a commit
that referenced
this pull request
Nov 5, 2024
`fs.readFileSync` crashes when a non-existing file is passed to it. Some APIs of `middleware-mockserver` read a file the path of which depends on query parameters, making it possible to crash it by providing such a parameter. The old PHP server doesn't have these issues. To fix this, wrap all `fs.readFileSync` occurrences with a function that falls back to the string `"ERROR"`. Closes gh-5579 (cherry picked from commit d5ebb46)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
fs.readFileSynccrashes when a non-existing file is passed to it. Some APIs ofmiddleware-mockserverread a file the path of which depends on query parameters, making it possible to crash it by providing such a parameter. The old PHP server doesn't have these issues.To fix this, wrap all
fs.readFileSyncoccurrences with a function that falls back to the string"ERROR".Checklist
New tests have been added to show the fix or feature worksIf needed, a docs issue/PR was created at https://github.com/jquery/api.jquery.com