process: passing -1 to setuid/setgid should not abort · nodejs/node@94afc3e · GitHub

nodejs / node Public

• Notifications You must be signed in to change notification settings
• Fork 36.6k
• Star 120k

• Code
• Issues 635
• Pull requests 754
• Actions
• Projects
• Security and quality
• Insights

Additional navigation options

Commit 94afc3e

Browse filesBrowse the repository at this point in the historyBrowse files

jasnell

authored and

danielleadams

committed

process: passing -1 to setuid/setgid should not abort

Fixes: #32750 Signed-off-by: James M Snell <jasnell@gmail.com> PR-URL: #36786 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Harshitha K P <harshitha014@gmail.com> Reviewed-By: Anto Aravinth <anto.aravinth.cse@gmail.com>

1 parent 1a4d34e commit 94afc3e
Copy full SHA for 94afc3e

2 files changed

+9Lines changed: 9 additions & 0 deletions

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

• lib/internal/bootstrap/switches
  • does_own_process_state.js
• test/parallel
  • test-process-uid-gid.js

Expand file treeCollapse file tree

Open diff view settings

Collapse file

‎lib/internal/bootstrap/switches/does_own_process_state.js‎

Copy file name to clipboardExpand all lines: lib/internal/bootstrap/switches/does_own_process_state.js

+1Lines changed: 1 addition & 0 deletions

Original file line number	Diff line number	Diff line change
@@ -80,6 +80,7 @@ function wrapPosixCredentialSetters(credentials) {
80	80	function wrapIdSetter(type, method) {
81	81	return function(id) {
82	82	validateId(id, 'id');
	83	+ if (typeof id === 'number') id |= 0;
83	84	// Result is 0 on success, 1 if credential is unknown.
84	85	const result = method(id);
85	86	if (result === 1) {

Collapse file

‎test/parallel/test-process-uid-gid.js‎

Copy file name to clipboardExpand all lines: test/parallel/test-process-uid-gid.js

+8Lines changed: 8 additions & 0 deletions

Original file line number	Diff line number	Diff line change
@@ -51,6 +51,13 @@ assert.throws(() => {
51	51	message: 'User identifier does not exist: fhqwhgadshgnsdhjsdbkhsdabkfabkveyb'
52	52	});
53	53
	54	+ // Passing -0 shouldn't crash the process
	55	+ // Refs: https://github.com/nodejs/node/issues/32750
	56	+ try { process.setuid(-0); } catch {}
	57	+ try { process.seteuid(-0); } catch {}
	58	+ try { process.setgid(-0); } catch {}
	59	+ try { process.setegid(-0); } catch {}
	60	+
54	61	// If we're not running as super user...
55	62	if (process.getuid() !== 0) {
56	63	// Should not throw.
@@ -79,6 +86,7 @@ try {
79	86	}
80	87	process.setgid('nogroup');
81	88	}
	89	+
82	90	const newgid = process.getgid();
83	91	assert.notStrictEqual(newgid, oldgid);
84	92

0 commit comments

Comments

0 (0)