[PR #1372] [MERGED] fix(javascript): decline source-map UNC references with an unusable host #2834

New issue

Closed

opened 2026-10-17 21:10:49 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:10:49 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1372
Author: @Yi-111-a
Created: 10/9/2026
Status: ✅ Merged
Merged: 10/9/2026
Merged by: @morluto

Base: main ← Head: fix/decline-malformed-unc-source-map-hosts

📝 Commits (2)

e19a4e1 fix(javascript): decline source-map UNC references with an unusable host
c468119 fix(javascript): validate UNC hosts through IDNA before conversion

📊 Changes

3 files changed (+110 additions, -2 deletions)

View changed files

📝 .github/workflows/ci.yml (+2 -1)
📝 src/domain/javascript/javascriptSourceMapPaths.ts (+16 -1)
➕ tests/boundary/process/sourceMapUncHosts.test.ts (+92 -0)

📄 Description

Fixes #1367.

Malformed UNC source-map hosts can make pathToFileURL(path, { windows: true }) abort on affected supported Node builds. A JavaScript TypeError catch cannot recover from the native assertion.

Validate the host before native conversion. Reject raw URL delimiters and escapes, then apply domainToASCII() so IDNA-invalid Unicode hosts and hosts that normalize to an empty string resolve as unresolved. Preserve the recorded source name and source root, and continue accepting usable Unicode hosts, nonempty normalized hosts, localhost, and drive-letter paths.

The regression imports the built production resolver in owned child processes. Each case asserts successful process termination and the expected resolution, so a native abort fails that case without killing the test runner. The existing Windows Node 22.19 CI step now includes this regression.

Validation:

Reproduced SIGABRT on the original PR implementation under Node 22.22.2 for U+00AD and U+200C in UNC source names and source roots.
All 64 focused tests pass on both Node 22.22.2 and Node 24.18.0: 53 source-to-bundle path tests and 11 isolated process cases.
npm run check and npm run verify:test-discovery pass.
Local verification ran on macOS. Windows verification is covered by the updated CI lane and remains pending.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1372 **Author:** [@Yi-111-a](https://github.com/Yi-111-a) **Created:** 10/9/2026 **Status:** ✅ Merged **Merged:** 10/9/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/decline-malformed-unc-source-map-hosts` --- ### 📝 Commits (2) - [`e19a4e1`](https://github.com/morluto/rea/commit/e19a4e156f7eb46d8522ab9d16ffe1af1aa38f2b) fix(javascript): decline source-map UNC references with an unusable host - [`c468119`](https://github.com/morluto/rea/commit/c4681190533d88dc553c59df625b42f0c8e40f45) fix(javascript): validate UNC hosts through IDNA before conversion ### 📊 Changes **3 files changed** (+110 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/ci.yml` (+2 -1) 📝 `src/domain/javascript/javascriptSourceMapPaths.ts` (+16 -1) ➕ `tests/boundary/process/sourceMapUncHosts.test.ts` (+92 -0) </details> ### 📄 Description Fixes #1367. Malformed UNC source-map hosts can make `pathToFileURL(path, { windows: true })` abort on affected supported Node builds. A JavaScript `TypeError` catch cannot recover from the native assertion. Validate the host before native conversion. Reject raw URL delimiters and escapes, then apply `domainToASCII()` so IDNA-invalid Unicode hosts and hosts that normalize to an empty string resolve as `unresolved`. Preserve the recorded source name and source root, and continue accepting usable Unicode hosts, nonempty normalized hosts, localhost, and drive-letter paths. The regression imports the built production resolver in owned child processes. Each case asserts successful process termination and the expected resolution, so a native abort fails that case without killing the test runner. The existing Windows Node 22.19 CI step now includes this regression. Validation: - Reproduced SIGABRT on the original PR implementation under Node 22.22.2 for U+00AD and U+200C in UNC source names and source roots. - All 64 focused tests pass on both Node 22.22.2 and Node 24.18.0: 53 source-to-bundle path tests and 11 isolated process cases. - `npm run check` and `npm run verify:test-discovery` pass. - Local verification ran on macOS. Windows verification is covered by the updated CI lane and remains pending. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:10:49 +00:00