src: do not pass user input to format string

PR-URL: nodejs#48973 Reviewed-By: Darshan Sen <raisinten@gmail.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
RafaelGSS · Aug 15, 2023 · a6cdf09 · a6cdf09
1 parent 794a551
commit a6cdf09
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 3 deletions.
diff --git a/src/node_file.cc b/src/node_file.cc
@@ -3079,10 +3079,11 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
  return;
  }
 
- std::string err_module_message =
- "Cannot find package '" + module_path + "' imported from " + module_base;
  env->isolate()->ThrowException(
- ERR_MODULE_NOT_FOUND(env->isolate(), err_module_message.c_str()));
+ ERR_MODULE_NOT_FOUND(env->isolate(),
+ "Cannot find package '%s' imported from %s",
+ module_path,
+ module_base));
 }
 
 void BindingData::MemoryInfo(MemoryTracker* tracker) const {

diff --git a/test/es-module/test-cjs-legacyMainResolve.js b/test/es-module/test-cjs-legacyMainResolve.js
@@ -133,6 +133,14 @@ describe('legacyMainResolve', () => {
  );
  });
 
+ it('should not crash when cannot resolve to a file that contains special chars', () => {
+ const packageJsonUrl = pathToFileURL('/c/file%20with%20percents/package.json');
+ assert.throws(
+ () => legacyMainResolve(packageJsonUrl, { main: null }, packageJsonUrl),
+ { code: 'ERR_MODULE_NOT_FOUND' },
+ );
+ });
+
  it('should throw when cannot resolve to a file (base not defined)', () => {
  const packageJsonUrl = pathToFileURL(
  path.resolve(