src: do not pass user input to format string

aduh95 · web-flow · commit af4cdcde154b · 2023-08-01T20:05:51.000Z
PR-URL: #48973 Reviewed-By: Darshan Sen <raisinten@gmail.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
diff --git a/src/node_file.cc b/src/node_file.cc
@@ -3042,10 +3042,11 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
-  std::string err_module_message =
-      "Cannot find package '" + module_path + "' imported from " + module_base;
   env->isolate()->ThrowException(
-      ERR_MODULE_NOT_FOUND(env->isolate(), err_module_message.c_str()));
+      ERR_MODULE_NOT_FOUND(env->isolate(),
+                           "Cannot find package '%s' imported from %s",
+                           module_path,
+                           module_base));
 }
 
 void BindingData::MemoryInfo(MemoryTracker* tracker) const {
diff --git a/test/es-module/test-cjs-legacyMainResolve.js b/test/es-module/test-cjs-legacyMainResolve.js
@@ -133,6 +133,14 @@ describe('legacyMainResolve', () => {
     );
   });
 
+  it('should not crash when cannot resolve to a file that contains special chars', () => {
+    const packageJsonUrl = pathToFileURL('/c/file%20with%20percents/package.json');
+    assert.throws(
+      () => legacyMainResolve(packageJsonUrl, { main: null }, packageJsonUrl),
+      { code: 'ERR_MODULE_NOT_FOUND' },
+    );
+  });
+
   it('should throw when cannot resolve to a file (base not defined)', () => {
     const packageJsonUrl = pathToFileURL(
       path.resolve(

Original file line number	Diff line number	Diff line change
`@@ -3042,10 +3042,11 @@ void BindingData::LegacyMainResolve(const FunctionCallbackInfo<Value>& args) {`
`3042`	`3042`	`return;`
`3043`	`3043`	`}`
`3044`	`3044`
`3045`		`- std::string err_module_message =`
`3046`		`- "Cannot find package '" + module_path + "' imported from " + module_base;`
`3047`	`3045`	`env->isolate()->ThrowException(`
`3048`		`- ERR_MODULE_NOT_FOUND(env->isolate(), err_module_message.c_str()));`
	`3046`	`+ ERR_MODULE_NOT_FOUND(env->isolate(),`
	`3047`	`+ "Cannot find package '%s' imported from %s",`
	`3048`	`+ module_path,`
	`3049`	`+ module_base));`
`3049`	`3050`	`}`
`3050`	`3051`
`3051`	`3052`	`void BindingData::MemoryInfo(MemoryTracker* tracker) const {`