src: do not pass user input to format string

PR-URL: nodejs#48973 Reviewed-By: Darshan Sen <raisinten@gmail.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Ceres6 · Aug 14, 2023 · 3eee719 · 3eee719
1 parent 5e4f469
commit 3eee719
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 3 deletions.
diff --git a/src/node_file.cc b/src/node_file.cc
@@ -3042,10 +3042,11 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
-  std::string err_module_message =
-      "Cannot find package '" + module_path + "' imported from " + module_base;
   env->isolate()->ThrowException(
-      ERR_MODULE_NOT_FOUND(env->isolate(), err_module_message.c_str()));
+      ERR_MODULE_NOT_FOUND(env->isolate(),
+                           "Cannot find package '%s' imported from %s",
+                           module_path,
+                           module_base));
 }
 
 void BindingData::MemoryInfo(MemoryTracker* tracker) const {

diff --git a/test/es-module/test-cjs-legacyMainResolve.js b/test/es-module/test-cjs-legacyMainResolve.js
@@ -133,6 +133,14 @@ describe('legacyMainResolve', () => {
     );
   });
 
+  it('should not crash when cannot resolve to a file that contains special chars', () => {
+    const packageJsonUrl = pathToFileURL('/c/file%20with%20percents/package.json');
+    assert.throws(
+      () => legacyMainResolve(packageJsonUrl, { main: null }, packageJsonUrl),
+      { code: 'ERR_MODULE_NOT_FOUND' },
+    );
+  });
+
   it('should throw when cannot resolve to a file (base not defined)', () => {
     const packageJsonUrl = pathToFileURL(
       path.resolve(