Skip to content

Commit f35bd86

Browse files
mhdawsontargos
authored andcommitted
doc: add additional caveat for fs.watch
Add clarification based on discussion with security researcher. Signed-off-by: Michael Dawson <midawson@redhat.com> PR-URL: #57150 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
1 parent e10ef27 commit f35bd86

File tree

1 file changed

+6
-0
lines changed

1 file changed

+6
-0
lines changed

doc/api/fs.md

+6
Original file line numberDiff line numberDiff line change
@@ -4764,6 +4764,12 @@ unavailable in some situations.
47644764
On Windows, no events will be emitted if the watched directory is moved or
47654765
renamed. An `EPERM` error is reported when the watched directory is deleted.
47664766
4767+
The `fs.watch` API does not provide any protection with respect
4768+
to malicious actions on the file system. For example, on Windows it is
4769+
implemented by monitoring changes in a directory versus specific files. This
4770+
allows substitution of a file and fs reporting changes on the new file
4771+
with the same filename.
4772+
47674773
##### Availability
47684774
47694775
<!--type=misc-->

0 commit comments

Comments
 (0)