url: process crash via malformed UNC hostname in pathToFileURL()

NickNaso · web-flow · commit 80e0f14f8eaf · 2026-04-30T18:52:48.000+02:00
Fixes: #62546 PR-URL: #62574 Reviewed-By: René <contact.9a5d6388@renegade334.me.uk> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Claudio Wunder <cwunder@gnome.org>
diff --git a/src/node_url.cc b/src/node_url.cc
@@ -93,7 +93,6 @@ constexpr auto lookup_table = []() consteval {
   case CHAR:                                                                   \
     result[i] = {{'%', HEX_DIGIT_2, HEX_DIGIT_1, 0}};                          \
     break;
-
       ENCODE_CHAR('\0', '0', '0')  // '\0' == 0x00
       ENCODE_CHAR('\t', '0', '9')  // '\t' == 0x09
       ENCODE_CHAR('\n', '0', 'A')  // '\n' == 0x0A
@@ -169,7 +168,11 @@ void BindingData::PathToFileURL(const FunctionCallbackInfo<Value>& args) {
       [[unlikely]] {
     CHECK(args[2]->IsString());
     Utf8Value hostname(isolate, args[2]);
-    CHECK(out->set_hostname(hostname.ToStringView()));
+    if (!out->set_hostname(hostname.ToStringView())) {
+      return ThrowInvalidURL(realm->env(),
+                             input.ToStringView(),
+                             std::string(hostname.ToStringView()));
+    }
   }
 
   binding_data->UpdateComponents(out->get_components(), out->type);
diff --git a/test/parallel/test-url-pathtofileurl.js b/test/parallel/test-url-pathtofileurl.js
@@ -21,6 +21,14 @@ const url = require('url');
   assert.ok(fileURL.includes('%25'));
 }
 
+{
+  assert.throws(() => {
+    url.pathToFileURL('\\\\exa mple\\share\\file.txt', { windows: true });
+  }, {
+    code: 'ERR_INVALID_URL',
+  });
+}
+
 {
   if (isWindows) {
     // UNC path: \\server\share\resource

Original file line number	Diff line number	Diff line change
`@@ -21,6 +21,14 @@ const url = require('url');`
`21`	`21`	`assert.ok(fileURL.includes('%25'));`
`22`	`22`	`}`
`23`	`23`
	`24`	`+{`
	`25`	`+ assert.throws(() => {`
	`26`	`+ url.pathToFileURL('\\\\exa mple\\share\\file.txt', { windows: true });`
	`27`	`+ }, {`
	`28`	`+ code: 'ERR_INVALID_URL',`
	`29`	`+ });`
	`30`	`+}`
	`31`	`+`
`24`	`32`	`{`
`25`	`33`	`if (isWindows) {`
`26`	`34`	`// UNC path: \\server\share\resource`