Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

child_process: check array readability in spawn #56625

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

jazelly
Copy link
Member

@jazelly jazelly commented Jan 16, 2025

With previous example issues caused by prototype pollution, I don't think we should add a test, as this PR fixes it from hard crash, but does not guarantee a defined behaviour. For example,

const {exec} = require('node:child_process');

Object.defineProperty(Array.prototype, "2", {
  set: function () {},
});

(async function () {
  exec('pwd', (err, stdout, stderr) => {
    console.log(stdout);
  });
})();

gives

node:internal/util/inspect:2063
      totalLength += output[i].length;
                               ^

TypeError: Cannot read properties of undefined (reading 'length')
    at isBelowBreakLength (node:internal/util/inspect:2063:32)
    at reduceToSingleString (node:internal/util/inspect:2106:13)
    at formatRaw (node:internal/util/inspect:1138:15)
    at formatValue (node:internal/util/inspect:883:10)
    at Object.inspect (node:internal/util/inspect:386:10)
    at TypeError.<anonymous> (node:internal/errors:1441:45)
    at getMessage (node:internal/errors:598:12)
    at new NodeError (node:internal/errors:470:20)
    at stdioStringToArray (node:internal/child_process:253:13)
    at getValidStdio (node:internal/child_process:997:13)

Node.js v24.0.0-pre

In case we does check if array is readable in some other modules, the error would likely be different.

Fixes: #56531

@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. child_process Issues and PRs related to the child_process subsystem. needs-ci PRs that need a full CI run. labels Jan 16, 2025
Copy link

codecov bot commented Jan 16, 2025

Codecov Report

Attention: Patch coverage is 57.14286% with 3 lines in your changes missing coverage. Please review.

Project coverage is 89.21%. Comparing base (9230f22) to head (e9296b7).
Report is 53 commits behind head on main.

Files with missing lines Patch % Lines
lib/internal/child_process.js 57.14% 3 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main   #56625      +/-   ##
==========================================
+ Coverage   89.17%   89.21%   +0.03%     
==========================================
  Files         662      662              
  Lines      191761   191890     +129     
  Branches    36905    36934      +29     
==========================================
+ Hits       171006   171190     +184     
+ Misses      13620    13545      -75     
- Partials     7135     7155      +20     
Files with missing lines Coverage Δ
lib/internal/child_process.js 94.74% <57.14%> (-0.24%) ⬇️

... and 73 files with indirect coverage changes

lib/internal/child_process.js Outdated Show resolved Hide resolved
src/process_wrap.cc Outdated Show resolved Hide resolved
src/process_wrap.cc Outdated Show resolved Hide resolved
@jazelly jazelly changed the title src: check process wrap type emptiness in ParseStdioOptions child_process: check array readability in spawn Jan 18, 2025
@jazelly jazelly removed the c++ Issues and PRs that require attention from people who are familiar with C++. label Jan 18, 2025
@jakecastelli jakecastelli added the request-ci Add this label to start a Jenkins CI on a PR. label Jan 18, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
child_process Issues and PRs related to the child_process subsystem. needs-ci PRs that need a full CI run. request-ci Add this label to start a Jenkins CI on a PR.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

FATAL ERROR: v8::ToLocalChecked Empty MaybeLocal
5 participants