module: improve resolve paths validation

cjihrig · targos · commit 119a590f844f · 2019-05-11T11:14:15.000+02:00
This commit adds input validation to require.resolve()'s paths option. Prior to this change, passing in a non-array value lead to a misleading 'module not found' error. Refs: #27583 PR-URL: #27613 Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
diff --git a/lib/internal/modules/cjs/loader.js b/lib/internal/modules/cjs/loader.js
@@ -53,6 +53,7 @@ const { compileFunction } = internalBinding('contextify');
 
 const {
   ERR_INVALID_ARG_VALUE,
+  ERR_INVALID_OPT_VALUE,
   ERR_REQUIRE_ESM
 } = require('internal/errors').codes;
 const { validateString } = require('internal/validators');
@@ -573,28 +574,33 @@ Module._resolveFilename = function(request, parent, isMain, options) {
 
   var paths;
 
-  if (typeof options === 'object' && options !== null &&
-      Array.isArray(options.paths)) {
-    const isRelative = request.startsWith('./') || request.startsWith('../') ||
-        (isWindows && request.startsWith('.\\') || request.startsWith('..\\'));
+  if (typeof options === 'object' && options !== null) {
+    if (Array.isArray(options.paths)) {
+      const isRelative = request.startsWith('./') ||
+          request.startsWith('../') ||
+          (isWindows && request.startsWith('.\\') ||
+          request.startsWith('..\\'));
 
-    if (isRelative) {
-      paths = options.paths;
-    } else {
-      const fakeParent = new Module('', null);
+      if (isRelative) {
+        paths = options.paths;
+      } else {
+        const fakeParent = new Module('', null);
 
-      paths = [];
+        paths = [];
 
-      for (var i = 0; i < options.paths.length; i++) {
-        const path = options.paths[i];
-        fakeParent.paths = Module._nodeModulePaths(path);
-        const lookupPaths = Module._resolveLookupPaths(request, fakeParent);
+        for (var i = 0; i < options.paths.length; i++) {
+          const path = options.paths[i];
+          fakeParent.paths = Module._nodeModulePaths(path);
+          const lookupPaths = Module._resolveLookupPaths(request, fakeParent);
 
-        for (var j = 0; j < lookupPaths.length; j++) {
-          if (!paths.includes(lookupPaths[j]))
-            paths.push(lookupPaths[j]);
+          for (var j = 0; j < lookupPaths.length; j++) {
+            if (!paths.includes(lookupPaths[j]))
+              paths.push(lookupPaths[j]);
+          }
         }
       }
+    } else if (options.paths !== undefined) {
+      throw new ERR_INVALID_OPT_VALUE('options.paths', options.paths);
     }
   } else {
     paths = Module._resolveLookupPaths(request, parent);
diff --git a/test/fixtures/require-resolve.js b/test/fixtures/require-resolve.js
@@ -84,3 +84,11 @@ assert.throws(() => {
     );
   }
 }
+
+// Test paths option validation
+common.expectsError(() => {
+  require.resolve('.\\three.js', { paths: 'foo' })
+}, {
+  code: 'ERR_INVALID_OPT_VALUE',
+  type: TypeError,
+});

Original file line number	Diff line number	Diff line change
`@@ -84,3 +84,11 @@ assert.throws(() => {`
`84`	`84`	`);`
`85`	`85`	`}`
`86`	`86`	`}`
	`87`	`+`
	`88`	`+// Test paths option validation`
	`89`	`+common.expectsError(() => {`
	`90`	`+ require.resolve('.\\three.js', { paths: 'foo' })`
	`91`	`+}, {`
	`92`	`+ code: 'ERR_INVALID_OPT_VALUE',`
	`93`	`+ type: TypeError,`
	`94`	`+});`