Skip to content

Commit 2524d00

Browse files
committed
src,permission: fix UNC path resolution
PR-URL: nodejs-private/node-private#581 CVE-ID: CVE-2024-37372
1 parent 60e184a commit 2524d00

File tree

2 files changed

+21
-9
lines changed

2 files changed

+21
-9
lines changed

src/permission/fs_permission.cc

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -57,15 +57,18 @@ bool is_tree_granted(
5757
const std::string_view& param) {
5858
std::string resolved_param = node::PathResolve(env, {param});
5959
#ifdef _WIN32
60-
// is UNC file path
61-
if (resolved_param.rfind("\\\\", 0) == 0) {
62-
// return lookup with normalized param
63-
size_t starting_pos = 4; // "\\?\"
64-
if (resolved_param.rfind("\\\\?\\UNC\\") == 0) {
65-
starting_pos += 4; // "UNC\"
66-
}
67-
auto normalized = param.substr(starting_pos);
68-
return granted_tree->Lookup(normalized, true);
60+
// Remove leading "\\?\" from UNC path
61+
if (resolved_param.substr(0, 4) == "\\\\?\\") {
62+
resolved_param.erase(0, 4);
63+
}
64+
65+
// Remove leading "UNC\" from UNC path
66+
if (resolved_param.substr(0, 4) == "UNC\\") {
67+
resolved_param.erase(0, 4);
68+
}
69+
// Remove leading "//" from UNC path
70+
if (resolved_param.substr(0, 2) == "//") {
71+
resolved_param.erase(0, 2);
6972
}
7073
#endif
7174
return granted_tree->Lookup(resolved_param, true);

test/parallel/test-permission-fs-windows-path.js

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,3 +38,12 @@ if (!common.isWindows) {
3838
assert.strictEqual(stdout.toString(), 'true\n', stderr.toString());
3939
assert.strictEqual(status, 0);
4040
}
41+
42+
{
43+
const { stdout, status, stderr } = spawnSync(process.execPath, [
44+
'--experimental-permission', '--allow-fs-write', 'C:\\*', '-e',
45+
"console.log(process.permission.has('fs.write', '\\\\\\\\A\\\\C:\\Users'))",
46+
]);
47+
assert.strictEqual(stdout.toString(), 'false\n', stderr.toString());
48+
assert.strictEqual(status, 0);
49+
}

0 commit comments

Comments
 (0)