Skip to content

lib: Fix infinite loop on paths with nested links #61391

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mattskel wants to merge 4 commits into
base: main
Choose a base branch
from
+58 −6
Open

lib: Fix infinite loop on paths with nested links #61391

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
2914f1e
lib: fix infinite loop in fs.realpathSync
mattskel Dec 15, 2025
44be9f0
lib: fix infinite loop in fs.realpathSync
mattskel Jan 16, 2026
654e216
lib: fix infinite loop in fs.realpathSync
mattskel Jan 18, 2026
4350cca
lib: fix infinite loop in fs.realpathSync
mattskel Jan 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 28 additions & 6 deletions lib/fs.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2730,17 +2730,29 @@ function realpathSync(p, options) {
// Walk down the path, swapping out linked path parts for their real
// values
// NB: p.length changes.
while (pos < p.length) {
// find the next part
const result = nextPart(p, pos);
let unresolvedTail = '';
while (true) {
if (pos >= p.length) {
if (unresolvedTail === '') {
break;
}

p = pathModule.resolve(p + unresolvedTail);
unresolvedTail = '';
current = base = splitRoot(p);
pos = current.length;
continue;
}

const result = nextPart(p + unresolvedTail, pos);
Comment on lines -2735 to +2747
Copy link
Author

@mattskel mattskel Jan 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Previously, the loop terminated once pos >= p.length. With the introduction of unresolvedTail, reaching the end of p does not necessarily mean resolution is complete. If the path has been fully scanned but deferred segments remain, the traversal state is reset and the unresolved tail is applied so resolution can continue.

Otherwise, path segmentation is performed on p + unresolvedTail, allowing deferred symlink target segments to be traversed as a continuation of the original path.

previous = current;
if (result === -1) {
const last = StringPrototypeSlice(p, pos);
current += last;
base = previous + last;
pos = p.length;
} else {
current += StringPrototypeSlice(p, pos, result + 1);
current += StringPrototypeSlice(p + unresolvedTail, pos, result + 1);
base = previous + StringPrototypeSlice(p, pos, result);
pos = result + 1;
}
Expand All @@ -2761,7 +2773,6 @@ function realpathSync(p, options) {
} else {
// Use stats array directly to avoid creating an fs.Stats instance just
// for our internal use.

const stats = binding.lstat(base, true, undefined, true /* throwIfNoEntry */);
if (stats === undefined) {
return;
Expand All @@ -2770,6 +2781,11 @@ function realpathSync(p, options) {
if (!isFileType(stats, S_IFLNK)) {
knownHard.add(base);
cache?.set(base, base);
if (unresolvedTail !== '') {
p = pathModule.resolve(p + unresolvedTail);
unresolvedTail = '';
}
Comment on lines +2784 to +2787
Copy link
Author

@mattskel mattskel Jan 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

flush the deferred tail as soon as it’s safe


continue;
}

Expand All @@ -2789,8 +2805,14 @@ function realpathSync(p, options) {
binding.stat(base, false, undefined, true);
linkTarget = binding.readlink(base, undefined);
}
resolvedLink = pathModule.resolve(previous, linkTarget);

const nextPathDelimiterIndex = nextPart(linkTarget, 0);
if (nextPathDelimiterIndex >= 1) {
unresolvedTail = StringPrototypeSlice(linkTarget, nextPathDelimiterIndex) + unresolvedTail;
linkTarget = StringPrototypeSlice(linkTarget, 0, nextPathDelimiterIndex);
}
Comment on lines +2809 to +2813
Copy link
Author

@mattskel mattskel Jan 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This code splits a symlink target into two parts: the first path segment, which is resolved immediately, and the remaining path segments, which are deferred.


resolvedLink = pathModule.resolve(previous, linkTarget);
cache?.set(base, resolvedLink);
if (!isWindows) seenLinks.set(id, linkTarget);
}
Expand Down
30 changes: 30 additions & 0 deletions test/parallel/test-fs-realpath-dotdot-symlink.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
'use strict';

const fs = require('fs');
const path = require('path');
const assert = require('assert');

const common = require('../common');
const tmpdir = require('../common/tmpdir');

if (common.isWindows) {
common.skip('symlink semantics differ on Windows');
}

tmpdir.refresh();

const cwd = path.join(tmpdir.path, 'test');
fs.mkdirSync(path.join(cwd, 'a', 'b', 'c'), { recursive: true });
fs.mkdirSync(path.join(cwd, 'a', 'b', 'd'), { recursive: true });

process.chdir(cwd);

// ln -s a/b/c c
fs.symlinkSync('a/b/c', 'c', 'dir');
// ln -s "c/../d" d
fs.symlinkSync('c/../d', 'd', 'dir');

const expected = path.resolve(path.join(cwd, 'a', 'b', 'd'));

// sync
assert.strictEqual(fs.realpathSync('d'), expected);