Repository navigation
Revert: [flutter_tools] Fix local CanvasKit asset paths on Windows - #195635
Merged
jtmcdole merged 1 commit intoOct 29, 2026
Merged
Conversation
…lutter#193776)" This reverts commit 91ffada.
11 tasks done
github-actions
Bot
added
the
tool
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request refactors CanvasKit asset serving in FlutterWebPlatform by introducing the _canvasKitFile helper and simplifying path resolution from URIs, while deleting the corresponding test file. A security review highlights that this simplified path resolution introduces a path traversal vulnerability, as it lacks validation to ensure the resolved file path remains strictly within the designated CanvasKit directory.
| } | ||
|
|
||
| final File canvasKitFile = _fileSystem.file(filePath); | ||
| final File canvasKitFile = _canvasKitFile(relativePath); |
Contributor
There was a problem hiding this comment.
Reverting this commit re-introduces a Path Traversal vulnerability. By using _fileSystem.path.fromUri(request.url) and only checking if the path starts with canvaskit/, a request with directory traversal sequences (e.g., canvaskit/../../etc/passwd) can escape the CanvasKit directory and access arbitrary files on the host system.
To mitigate this, validate that the resolved canvasKitFile path is strictly within the expected CanvasKit directory using _fileSystem.path.isWithin before serving the file.
Suggested change
| final File canvasKitFile = _canvasKitFile(relativePath); | |
| final File canvasKitFile = _canvasKitFile(relativePath); | |
| final String canvasKitPath = _fileSystem.path.join( | |
| _artifacts.getHostArtifact(HostArtifact.flutterWebSdk).path, | |
| 'canvaskit', | |
| ); | |
| if (!_fileSystem.path.isWithin(canvasKitPath, canvasKitFile.path)) { | |
| return shelf.Response.notFound('Not a CanvasKit file request'); | |
| } |
hellohuanlin
approved these changes
Oct 29, 2026
hellohuanlin
added
the
autosubmit
b-luk
added
the
emergency
|
Detected the If you add the The "Merge" button is also unlocked. To bypass presubmits as well as the tree status, press the GitHub "Add to Merge Queue". |
flutter-dashboard
Bot
removed
the
autosubmit
11 tasks done
molchanovia
added a commit
to molchanovia/flutter
that referenced
this pull request
Nov 1, 2026
Reland flutter#193776, reverted by flutter#195635. Match CanvasKit requests by URI path segments before constructing filesystem paths, preserving containment checks and POSIX/Windows regression coverage. Pass MustacheTemplateRenderer to FlutterWebPlatform.start in the regression tests to satisfy the required templateRenderer parameter added by flutter#194062.
jpohhhh
pushed a commit
to Telosnex/flutter
that referenced
this pull request
Nov 5, 2026
…flutter#195770) <!-- Thanks for filing a pull request! Reviewers are typically assigned within a week of filing a request. To learn more about code review, see our documentation on Tree Hygiene: https://github.com/flutter/flutter/blob/main/docs/contributing/Tree-hygiene.md --> Relands flutter#193776, reverted by flutter#195635. On Windows, converting a CanvasKit request URI to a filesystem path before matching `canvaskit/` causes valid asset requests to return HTTP 404. Match URI path segments first, then construct and validate the filesystem path. Restore regression coverage for POSIX and Windows paths, including JavaScript/Wasm assets, response bodies and headers, and invalid paths. The regression tests now pass `MustacheTemplateRenderer` to `FlutterWebPlatform.start`, addressing the required `templateRenderer` parameter introduced by flutter#194062 that caused the original tree breakage. Fixes flutter#193505. ## Pre-launch Checklist - [x] I read the [Contributor Guide] and followed the process outlined there for submitting PRs. - [x] I read the [AI contribution guidelines] and understand my responsibilities, or I am not using AI tools. - [x] I read the [Tree Hygiene] wiki page, which explains my responsibilities. - [x] I read and followed the [Flutter Style Guide], including [Features we expect every widget to implement]. - [x] I signed the [CLA]. - [x] I listed at least one issue that this PR fixes in the description above. - [x] I updated/added relevant in-code documentation (doc comments with `///`). - [x] If this PR introduces a new feature or capability, I created and linked a website documentation issue or PR in [flutter/website] (or verified none is needed). - [x] I added new tests to check the change I am making, or this PR is [test-exempt]. - [x] I followed the [breaking change policy] and added [Data Driven Fixes] where supported. - [x] All existing and new tests are passing. If you need help, consider asking for advice on the #hackers-new channel on [Discord]. If this change needs to override an active code freeze, provide a comment explaining why. The code freeze workflow can be overridden by code reviewers. See pinned issues for any active code freezes with guidance. **Note**: The Flutter team is currently trialing the use of [Gemini Code Assist for GitHub](https://developers.google.com/gemini-code-assist/docs/review-github-code). Comments from the `gemini-code-assist` bot should not be taken as authoritative feedback from the Flutter team. If you find its comments useful you can update your code accordingly, but if you are unsure or disagree with the feedback, please feel free to wait for a Flutter team member's review for guidance on which automated comments should be addressed. <!-- Links --> [Contributor Guide]: https://github.com/flutter/flutter/blob/main/docs/contributing/Tree-hygiene.md#overview [AI contribution guidelines]: https://github.com/flutter/flutter/blob/main/CONTRIBUTING.ai.md [Tree Hygiene]: https://github.com/flutter/flutter/blob/main/docs/contributing/Tree-hygiene.md [test-exempt]: https://github.com/flutter/flutter/blob/main/docs/contributing/Tree-hygiene.md#tests [Flutter Style Guide]: https://github.com/flutter/flutter/blob/main/docs/contributing/Style-guide-for-Flutter-repo.md [Features we expect every widget to implement]: https://github.com/flutter/flutter/blob/main/docs/contributing/Style-guide-for-Flutter-repo.md#features-we-expect-every-widget-to-implement [CLA]: https://cla.developers.google.com/ [flutter/tests]: https://github.com/flutter/tests [flutter/website]: https://github.com/flutter/website [breaking change policy]: https://github.com/flutter/flutter/blob/main/docs/contributing/Tree-hygiene.md#handling-breaking-changes [Discord]: https://github.com/flutter/flutter/blob/main/docs/contributing/Chat.md [Data Driven Fixes]: https://github.com/flutter/flutter/blob/main/docs/contributing/Data-driven-Fixes.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reverts: [flutter_tools] Fix local CanvasKit asset paths on Windows
Initiated by: @hellohuanlin
Reason for reverting: This is the first commit that breaks the tree
Original PR Author: @meg4cyberc4t
Reviewed By: @mdebbar
Pre-launch Checklist
///).If you need help, consider asking for advice on the #hackers-new channel on Discord.
If this change needs to override an active code freeze, provide a comment explaining why. The code freeze workflow can be overridden by code reviewers. See pinned issues for any active code freezes with guidance.
Note: The Flutter team is currently trialing the use of Gemini Code Assist for GitHub. Comments from the
gemini-code-assistbot should not be taken as authoritative feedback from the Flutter team. If you find its comments useful you can update your code accordingly, but if you are unsure or disagree with the feedback, please feel free to wait for a Flutter team member's review for guidance on which automated comments should be addressed.