Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Commit c97fb91

Browse filesBrowse files
TimothyGutargos
authored andcommitted
worker: restrict supported extensions
Only allow `.js` and `.mjs` extensions to provide future-proofing for file type detection. Refs: ayojs/ayo#117 Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Olivia Hugger <olivia@fastmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> PR-URL: #20876 Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com> Reviewed-By: Shingo Inoue <leko.noor@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Tiancheng "Timothy" Gu <timothygu99@gmail.com> Reviewed-By: John-David Dalton <john.david.dalton@gmail.com> Reviewed-By: Gus Caplan <me@gus.host>
1 parent 93ce63c commit c97fb91
Copy full SHA for c97fb91

File tree

Expand file treeCollapse file tree

3 files changed

+40
-3
lines changed
Open diff view settings
Filter options
Expand file treeCollapse file tree

3 files changed

+40
-3
lines changed
Open diff view settings
Collapse file

‎lib/internal/errors.js‎

Copy file name to clipboardExpand all lines: lib/internal/errors.js
+3Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -856,4 +856,7 @@ E('ERR_WORKER_NEED_ABSOLUTE_PATH',
856856
TypeError);
857857
E('ERR_WORKER_UNSERIALIZABLE_ERROR',
858858
'Serializing an uncaught exception failed', Error);
859+
E('ERR_WORKER_UNSUPPORTED_EXTENSION',
860+
'The worker script extension must be ".js" or ".mjs". Received "%s"',
861+
TypeError);
859862
E('ERR_ZLIB_INITIALIZATION_FAILED', 'Initialization failed', Error);
Collapse file

‎lib/internal/worker.js‎

Copy file name to clipboardExpand all lines: lib/internal/worker.js
+10-3Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,8 @@ const util = require('util');
88
const {
99
ERR_INVALID_ARG_TYPE,
1010
ERR_WORKER_NEED_ABSOLUTE_PATH,
11-
ERR_WORKER_UNSERIALIZABLE_ERROR
11+
ERR_WORKER_UNSERIALIZABLE_ERROR,
12+
ERR_WORKER_UNSUPPORTED_EXTENSION,
1213
} = require('internal/errors').codes;
1314

1415
const { internalBinding } = require('internal/bootstrap/loaders');
@@ -136,8 +137,14 @@ class Worker extends EventEmitter {
136137
throw new ERR_INVALID_ARG_TYPE('filename', 'string', filename);
137138
}
138139

139-
if (!options.eval && !path.isAbsolute(filename)) {
140-
throw new ERR_WORKER_NEED_ABSOLUTE_PATH(filename);
140+
if (!options.eval) {
141+
if (!path.isAbsolute(filename)) {
142+
throw new ERR_WORKER_NEED_ABSOLUTE_PATH(filename);
143+
}
144+
const ext = path.extname(filename);
145+
if (ext !== '.js' && ext !== '.mjs') {
146+
throw new ERR_WORKER_UNSUPPORTED_EXTENSION(ext);
147+
}
141148
}
142149

143150
// Set up the C++ handle for the worker, as well as some internal wiring.
Collapse file
+27Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
// Flags: --experimental-worker
2+
'use strict';
3+
4+
const common = require('../common');
5+
const assert = require('assert');
6+
const { Worker } = require('worker');
7+
8+
{
9+
const expectedErr = common.expectsError({
10+
code: 'ERR_WORKER_NEED_ABSOLUTE_PATH',
11+
type: TypeError
12+
}, 4);
13+
assert.throws(() => { new Worker('a.js'); }, expectedErr);
14+
assert.throws(() => { new Worker('b'); }, expectedErr);
15+
assert.throws(() => { new Worker('c/d.js'); }, expectedErr);
16+
assert.throws(() => { new Worker('a.mjs'); }, expectedErr);
17+
}
18+
19+
{
20+
const expectedErr = common.expectsError({
21+
code: 'ERR_WORKER_UNSUPPORTED_EXTENSION',
22+
type: TypeError
23+
}, 3);
24+
assert.throws(() => { new Worker('/b'); }, expectedErr);
25+
assert.throws(() => { new Worker('/c.wasm'); }, expectedErr);
26+
assert.throws(() => { new Worker('/d.txt'); }, expectedErr);
27+
}

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.