Skip to content

fix: read file:/// custom toolset URLs as file URLs - #10504

Merged
mmaietta merged 2 commits into
electron-userland:masterfrom
b84330808:fix/custom-toolset-windows-file-url
Oct 31, 2026
Merged

mmaietta merged 2 commits into
electron-userland:masterfrom
b84330808:fix/custom-toolset-windows-file-url

Conversation

@b84330808

Copy link
Copy Markdown
Contributor

A custom toolset url like file:///C:/tools/nsis-bundle.zip doesn't work on Windows. validateCustomToolset and resolveFilePath turn the URL into a path by cutting off file://, which leaves /C:/tools/nsis-bundle.zip. Windows never finds that path, so the build stops with Invalid custom toolset: file:///C:/... Must be a valid https:// URL or a file:// path.

file:///C:/... is the form pathToFileURL gives on Windows, and the one the toolsets.executables docs use (file:///C:/Windows/System32/...). Percent-encoded characters weren't decoded either, so a URL such as file:///home/me/my%20tools/nsis.zip doesn't work on any platform.

The fix converts file:///... URLs with fileURLToPath, like executableUriToPath does for toolsets.executables. file://<relative path> and file://C:\... (what the existing tests use on Windows) aren't valid file URLs and keep the old handling.

Test: a file:// URL made with pathToFileURL resolves to the directory path in test/src/customToolsetTest.ts uses a directory with a space in its name, so it also covers the decoding on Linux and macOS. It fails without the change (Invalid custom toolset: file:///D:/.../my%20toolset) and passes with it. TEST_FILES="customToolsetTest,appImageToolsetTest,7zipToolsetTest,legacyConfigGuardTest" pnpm ci:test: 316 passed on Windows 11. oxlint (type-aware), oxfmt and tsc --build tsconfig.build.json pass. A changeset for app-builder-lib (patch) is included.

I used Claude Code to write this change.

A custom toolset URL was turned into a path by cutting off "file://".
For "file:///C:/tools/nsis-bundle.zip", the form pathToFileURL gives on
Windows, that leaves "/C:/tools/nsis-bundle.zip", which Windows never
finds, so the toolset was rejected as invalid. Percent-encoded
characters such as %20 were not decoded on any platform.

Convert "file:///..." URLs with fileURLToPath. "file://<relative path>"
and "file://C:\..." are not file URLs and keep the old handling.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
@changeset-bot

changeset-bot Bot commented Oct 30, 2026 •

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: b4f73c8

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 8 packages
Name Type
app-builder-lib Patch
dmg-builder Patch
electron-builder-squirrel-windows Patch
electron-builder Patch
electron-forge-maker-appimage Patch
electron-forge-maker-nsis-web Patch
electron-forge-maker-nsis Patch
electron-forge-maker-snap Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@mmaietta

Copy link
Copy Markdown
Collaborator

Thanks, the file:///C:/… fix looks right. One regression: on macOS/Linux, fileURLToPath treats # and ? as the start of a fragment or query. So file:///opt/toolsets/#3/nsis.zip now resolves to /opt/toolsets/, which is a folder. The folder branch in _resolveCustomToolsetPath returns it before the checksum is ever read. Could the guard keep the old handling for these characters?

if (p.startsWith("/") && !/[?#]/.test(p)) {
Per the repo's test rule, could you also add a test for each new path:

  • the catch fallback: e.g. a folder literally named a%2Fb, where fileURLToPath throws on the encoded slash;
  • the startsWith("/") guard: e.g. on Windows, file://C:\…\my%20dir resolving to that exact folder.

@mmaietta mmaietta left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Marking with request changes per previous comment.

On macOS and Linux, fileURLToPath reads "#" and "?" as the start of a
fragment or a query, so "file:///opt/toolsets/electron-userland#3/nsis.zip" became the
folder "/opt/toolsets/". That folder was returned as a directory toolset
before the archive's checksum was read. A path with "?" or "#" in it now
keeps the old handling.

Add tests for the "#" and "?" case and the fileURLToPath fallback (macOS
and Linux), and for a "file://C:\..." path being used as written
(Windows).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
@b84330808

Copy link
Copy Markdown
Contributor Author

Good catch, thanks! I went with your guard, so paths with ? or # keep the old handling now, and I added the tests you suggested plus one for the #3 case.

@mmaietta
mmaietta merged commit badab44 into electron-userland:master Oct 31, 2026
67 of 68 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants