vfs: reject a repeated --vfs-load

--vfs-load appends to the same list as --vfs-mount, so the parsed
options cannot say how often it was given, and a second one quietly won
over the first instead of being refused. The documentation already said
it may be given at most once.

Count it in the node options the command line yielded and error when
there is more than one. Repeating --vfs-mount stays allowed; only the
option that picks the entry point is limited.

Signed-off-by: Philipp Dunkel <pip@pipobscure.com>

Author: pipobscure

src/node.cc

@@ -1024,6 +1024,18 @@ static ExitCode InitializeNodeWithArgsInternal(
         errors->push_back("--vfs-load requires --experimental-vfs");
       }
     }
+    // --vfs-load shares vfs_mounts with --vfs-mount, so the options themselves
+    // cannot say how often it was given; count it in the node options the
+    // command line yielded. A second one would silently win over the first.
+    if (env_options->vfs_load && exec_argv != nullptr) {
+      size_t seen = 0;
+      for (const std::string& arg : *exec_argv) {
+        if (arg == "--vfs-load" || arg.starts_with("--vfs-load=")) seen++;
+      }
+      if (seen > 1) {
+        errors->push_back("--vfs-load may only be given once");
+      }
+    }
     if (!errors->empty()) return ExitCode::kInvalidCommandLineArgument;
   }
 

test/parallel/test-vfs-mount-load.js

@@ -211,6 +211,30 @@ require('worker_threads').parentPort.postMessage('hello from worker in mount');
   assert.notStrictEqual(first, second);
 }
 
+// --vfs-load may only be given once: it shares one list with --vfs-mount, so a
+// second one would otherwise quietly win over the first.
+{
+  const dirs = {};
+  for (const name of ['once-a', 'once-b']) {
+    dirs[name] = fixture(name);
+    fs.mkdirSync(dirs[name], { recursive: true });
+    fs.writeFileSync(path.join(dirs[name], 'index.js'),
+                     `console.log('ran:${name}');\n`);
+  }
+
+  const twice = run([`--vfs-load=${dirs['once-a']}`,
+                     `--vfs-load=${dirs['once-b']}`]);
+  assert.notStrictEqual(twice.status, 0);
+  assert.match(twice.stderr, /--vfs-load may only be given once/);
+
+  // Repeating --vfs-mount stays allowed; only the loading one is limited.
+  const many = run([`--vfs-mount=${dirs['once-a']}`,
+                    `--vfs-load=${dirs['once-b']}`,
+                    `--vfs-mount=${dirs['once-a']}`]);
+  assert.strictEqual(many.status, 0, many.stderr);
+  assert.match(many.stdout, /ran:once-b/);
+}
+
 // --vfs-load picks the entry point, so it is refused in NODE_OPTIONS: the
 // environment must not be able to redirect what a `node <args>` run executes.
 // Everything but the flag under test is passed on the command line, so a build
@@ -220,12 +244,25 @@ if (hasNodeOptions) {
   fs.mkdirSync(dir, { recursive: true });
   fs.writeFileSync(path.join(dir, 'index.js'), 'console.log("ran");\n');
 
-  const res = spawnSync(
-    process.execPath, ['--experimental-vfs'],
-    { encoding: 'utf8',
-      env: { ...process.env, NODE_OPTIONS: envArg('--vfs-load', dir) } });
-  assert.notStrictEqual(res.status, 0);
-  assert.match(res.stderr, /is not allowed in NODE_OPTIONS/);
+  // On its own, and alongside a --vfs-load the command line legitimately gave:
+  // the environment is refused either way rather than merged.
+  for (const args of [['--experimental-vfs'],
+                      ['--experimental-vfs', `--vfs-load=${dir}`]]) {
+    const res = spawnSync(process.execPath, args, {
+      encoding: 'utf8',
+      env: { ...process.env, NODE_OPTIONS: envArg('--vfs-load', dir) },
+    });
+    assert.notStrictEqual(res.status, 0);
+    assert.match(res.stderr, /--vfs-load.* is not allowed in NODE_OPTIONS/);
+  }
+
+  // --vfs-mount, by contrast, is accepted from the environment.
+  const mountFromEnv = spawnSync(
+    process.execPath, ['--experimental-vfs', `--vfs-load=${dir}`], {
+      encoding: 'utf8',
+      env: { ...process.env, NODE_OPTIONS: envArg('--vfs-mount', dir) },
+    });
+  assert.strictEqual(mountFromEnv.status, 0, mountFromEnv.stderr);
 }
 
 // --experimental-vfs and --vfs-mount may arrive from different places. The