You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Implement the following test (written in TS/Jest; not sure what your stack looks like but it shouldn't be too hard to adapt):
it('should allow directories named __proto__',async()=>{constdirName='/__proto__';expect(awaitdirExists(dirName)).toBe(false);awaitmemfs.fs.promises.mkdir(dirName);try{expect(awaitdirExists(dirName)).toBe(true);}finally{awaitmemfs.fs.promises.rmdir(dirName);}});functiondirExists(path: string): Promise<boolean>{returnmemfs.fs.promises.access(path,memfs.fs.promises.constants.R_OK).then(()=>true).catch(()=>false);}
Result:
Error: ENOENT: no such file or directory, rmdir '/__proto__'
at createError (C:\Users\d\IdeaProjects\big-shuffle\node_modules\memfs\src\node\util.ts:138:17)
at Volume.getLinkOrThrow (C:\Users\d\IdeaProjects\big-shuffle\node_modules\memfs\src\volume.ts:404:33)
at Volume.getLinkAsDirOrThrow (C:\Users\d\IdeaProjects\big-shuffle\node_modules\memfs\src\volume.ts:453:23)
at Volume.rmdirBase (C:\Users\d\IdeaProjects\big-shuffle\node_modules\memfs\src\volume.ts:1628:23)
at Immediate.<anonymous> (C:\Users\d\IdeaProjects\big-shuffle\node_modules\memfs\src\volume.ts:516:25)
at processImmediate (node:internal/timers:478:21)
The analogous test on the real fs/promises is passing.
This was only tested with /__proto__ as the directory name, but there may be other affected names and functions.
I expect __proto__ is probably the only one, and it'll be because we're using a plain object to track the filesystem which ignores assignments to __proto__.
It might just be a matter of using Object.create(null) instead of {} 🤔
Implement the following test (written in TS/Jest; not sure what your stack looks like but it shouldn't be too hard to adapt):
Result:
The analogous test on the real
fs/promises
is passing.This was only tested with
/__proto__
as the directory name, but there may be other affected names and functions.Thanks to fast-check for finding this bug.
The text was updated successfully, but these errors were encountered: