fix(browser): check fs access in builtin commands by hi-ogawa · Pull Request #10674 · vitest-dev/vitest

hi-ogawa · 2026-06-29T09:54:36Z

Description

Resolves #issue-number

TODO

move webdriverio provider patch to https://github.com/vitest-community/vitest-webdriverio

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

It's really useful if your PR references an issue where it is discussed ahead of time. If the feature is substantial or introduces breaking changes without a discussion, PR might be closed.
Ideally, include a test that fails without this PR but passes with it.
Please, don't make changes to pnpm-lock.yaml unless you introduce a new test example.
Please check Allow edits by maintainers to make review process faster. Note that this option is not available for repositories that are owned by Github organizations.

Tests

Run the tests with pnpm test:ci.

Documentation

If you introduce new functionality, document it. You can run documentation with pnpm run docs command.

Changesets

Changes in changelog are generated from PR name. Please, make sure that it explains your changes in an understandable manner. Please, prefix changeset messages with feat:, fix:, perf:, docs:, or chore:.

…cess Provider commands dispatched through `triggerCommand` (takeScreenshot, stopChunkTrace, deleteTracing, screenshotMatcher writes, and file upload) bypassed the `allowWrite` permission gate and Vite's `server.fs` path validation. Add shared `assertBrowserApiWrite`/`assertBrowserFileAccess` helpers, apply them to those commands, and reuse them from the existing `fs` commands so all file-touching commands share one gate. Co-authored-by: OpenCode (claude-opus-4-8) <[email protected]>

Add browser tests asserting that `upload` and `takeScreenshot` are blocked when the target file is denied via `server.fs.deny`, and that `takeScreenshot` is blocked when `allowWrite` is disabled. Normalize the project root in `errorTree` messages so the assertions are deterministic. Co-authored-by: OpenCode (claude-opus-4-8) <[email protected]>

`screenshot` defaults `save` to `true`, so the explicit option is unnecessary. Co-authored-by: OpenCode (claude-opus-4-8) <[email protected]>

netlify · 2026-06-30T02:16:37Z

✅ Deploy Preview for vitest-dev ready!

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`0848115`
🔍 Latest deploy log	https://app.netlify.com/projects/vitest-dev/deploys/6a438188fa48050008969ec0
😎 Deploy Preview	https://deploy-preview-10674--vitest-dev.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

A screenshot writes a PNG, so deny/target a `.png` path rather than a `.txt`, which also avoids relying on Playwright's mime rejection. Co-authored-by: OpenCode (claude-opus-4-8) <[email protected]>

…-write-gate # Conflicts: # packages/browser-webdriverio/src/commands/screenshot.ts # packages/browser-webdriverio/src/commands/upload.ts

These tests run against a single project, so keying the error tree by project name made the snapshot provider-dependent (chromium vs chrome). Use `errorTree()` without `project` for provider-agnostic snapshots. Co-authored-by: OpenCode (claude-opus-4-8) <[email protected]>

`annotateTraces` recorded a client-supplied trace path as an attachment without any gate, and `onTaskArtifactRecord` only stripped attachments when `allowWrite` was false — neither confined the path. Since attachments are copied into `attachmentsDir`, an arbitrary path (e.g. `/etc/passwd`) could be disclosed. Gate `annotateTraces` like the other trace commands and add `checkFileAccess` for attachment paths in `onTaskArtifactRecord`. Co-authored-by: OpenCode (claude-opus-4-8) <[email protected]>

sheremet-va · 2026-06-30T10:09:59Z

Windows is failing:

 FAIL  specs/errors.test.ts > cannot use fs commands if write is disabled
AssertionError: expected [] to have a length of 6 but got +0

- Expected
+ Received

- 6
+ 0

 ❯ specs/errors.test.ts:125:18
    123|
    124|   const errors = stderr.split('\n').filter(line => line.includes('Cann…
    125|   expect(errors).toHaveLength(2 * instances.length)
       |                  ^
    126|
    127|   expect(stderr).toContain(

(Similar to v4 backport)

`path.resolve(root, "/test-file.txt")` prepends the current drive and uses backslashes on Windows, which changed the "Cannot modify file" message and broke the cross-platform command-permission test. Restore the upstream ordering so the raw client path is passed to the write check while the resolved path is still used for the fs-access check. Co-authored-by: OpenCode (claude-opus-4-8) <[email protected]>

…into fix/browser-command-write-gate

hi-ogawa · 2026-07-01T04:04:41Z

CI is fixed by preserving previous error message on main and v4.
v3 had some windows path issue so quick fix by converting path.

hi-ogawa and others added 3 commits June 29, 2026 18:49

test(browser): drop redundant save: true from screenshot fixtures

ec65cc7

`screenshot` defaults `save` to `true`, so the explicit option is unnecessary. Co-authored-by: OpenCode (claude-opus-4-8) <[email protected]>

test(browser): use .png target for screenshot fs.deny fixture

8492b6f

A screenshot writes a PNG, so deny/target a `.png` path rather than a `.txt`, which also avoids relying on Playwright's mime rejection. Co-authored-by: OpenCode (claude-opus-4-8) <[email protected]>

This was referenced Jun 30, 2026

fix(browser): check fs access in builtin commands [backport to v3] #10679

Merged

fix(browser): check fs access in builtin commands [backport to v4] #10680

Merged

fix: check fs access in builtin commands vitest-community/vitest-webdriverio#1

Merged

hi-ogawa and others added 3 commits June 30, 2026 12:01

Merge remote-tracking branch 'upstream/main' into fix/browser-command…

ff2f2f2

…-write-gate # Conflicts: # packages/browser-webdriverio/src/commands/screenshot.ts # packages/browser-webdriverio/src/commands/upload.ts

hi-ogawa marked this pull request as ready for review June 30, 2026 08:41

Merge branch 'main' into fix/browser-command-write-gate

0848115

hi-ogawa and others added 2 commits July 1, 2026 12:21

Merge remote-tracking branch 'origin/fix/browser-command-write-gate' …

a315848

…into fix/browser-command-write-gate

hi-ogawa requested a review from sheremet-va July 1, 2026 04:04

sheremet-va approved these changes Jul 1, 2026

View reviewed changes

sheremet-va merged commit 33f96a1 into vitest-dev:main Jul 1, 2026
15 of 18 checks passed

hi-ogawa deleted the fix/browser-command-write-gate branch July 1, 2026 07:03

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(browser): check fs access in builtin commands#10674

fix(browser): check fs access in builtin commands#10674
sheremet-va merged 10 commits into
vitest-dev:mainfrom
hi-ogawa:fix/browser-command-write-gate

hi-ogawa commented Jun 29, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Jun 30, 2026 •

edited

Loading

Uh oh!

sheremet-va commented Jun 30, 2026

Uh oh!

hi-ogawa commented Jul 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

hi-ogawa commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

Tests

Documentation

Changesets

Uh oh!

netlify Bot commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for vitest-dev ready!

Uh oh!

sheremet-va commented Jun 30, 2026

Uh oh!

hi-ogawa commented Jul 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

hi-ogawa commented Jun 29, 2026 •

edited

Loading

netlify Bot commented Jun 30, 2026 •

edited

Loading