fix(view): handle view names ending with "." to avoid require("")#7351
Open
webdevelopersrinu wants to merge 1 commit into
Open
fix(view): handle view names ending with "." to avoid require("")#7351webdevelopersrinu wants to merge 1 commit into
webdevelopersrinu wants to merge 1 commit into
Conversation
A view name ending in "." (e.g. res.render('index.')) produced a bare "."
from path.extname(), which skipped the default-engine fallback and led to
require("") — throwing an opaque TypeError [ERR_INVALID_ARG_VALUE] that
bypassed the render callback. Treat a bare-dot extension as no extension so
a normal "Failed to lookup view" error is delivered instead.
Ziiyodullayevv
left a comment
Ziiyodullayevv
left a comment
There was a problem hiding this comment.
Good fix for view names ending with dot. This prevents potential security issues with require() receiving empty strings. The validation is simple and effective.
Author
|
Thanks for taking a look and for the feedback, @Ziiyodullayevv |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
A view name ending in "." (e.g.
res.render('index.')orapp.render('index.', cb)) makes the View constructor callrequire(""), throwingTypeError [ERR_INVALID_ARG_VALUE]: The argument 'id' must be a non-empty string. Withapp.render()this throws past the callback; withres.render()it surfaces as an opaque 500.Cause
path.extname('index.')returns'.'(truthy), so the default-engine fallback inlib/view.jsis skipped,this.extstays'.', andthis.ext.slice(1)is''— leading torequire('').Fix
Treat a bare
'.'extension as no extension, so the normal default-engine path runs and an unresolved view yields the usualFailed to lookup viewerror via the callback.Tests
Added a regression test in
test/app.render.js. It fails without the fix (with theERR_INVALID_ARG_VALUEcrash) and passes with it. Full suite (1250 tests) and lint pass.Fixes #7350