René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"node:vfs MemoryProvider: backslash in path allows directory traversal","articleBody":"## Environment\n- Node.js: v27.0.0-nightly20260625c5635b82c9\n- Flag: `--experimental-vfs`\n- OS: Linux\n\n## Description\n\n`MemoryProvider#normalizePath()` in `lib/internal/vfs/providers/memory.js` converts backslashes to forward slashes before calling `pathPosix.normalize()`. This allows `..` traversal via backslash-encoded paths, bypassing directory isolation within the VFS virtual tree.\n\n**Root cause** (`lib/internal/vfs/providers/memory.js`):\n```js\nlet normalized = StringPrototypeReplaceAll(path, '\\\\', '/');\nreturn pathPosix.normalize(normalized); // resolves .. after backslash→/ conversion\n```\n\n## Reproducer\n\n```js\n// node --experimental-vfs poc.js\nconst vfs = require('node:vfs');\nconst fs = vfs.create(new vfs.MemoryProvider());\n\nfs.mkdirSync('/admin');\nfs.writeFileSync('/admin/secret', 'CONFIDENTIAL');\nfs.mkdirSync('/user/data', { recursive: true });\nfs.writeFileSync('/user/data/public.txt', 'public');\n\n// Read traversal: /user/data\\..\\..\\admin/secret → /admin/secret\nconsole.log(fs.readFileSync('/user/data\\\\..\\\\..\\\\admin/secret', 'utf8'));\n// Output: CONFIDENTIAL\n\n// Write traversal\nfs.writeFileSync('/user/data\\\\..\\\\..\\\\admin/secret', 'OVERWRITTEN');\nconsole.log(fs.readFileSync('/admin/secret', 'utf8'));\n// Output: OVERWRITTEN\n```\n\n## Expected behavior\nPaths containing backslashes should either be rejected or treated as literal filename characters (as Linux does), not converted to path separators.\n\n## Suggested fix\nRemove the backslash-to-slash conversion in `#normalizePath()`, or reject paths containing backslashes with an `EINVAL` error.","author":{"url":"https://github.com/jojin1709","@type":"Person","name":"jojin1709"},"datePublished":"2026-06-25T12:00:14.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/64129/node/issues/64129"}