fix(view): handle view names ending with "." to avoid require("") - #7351
fix(view): handle view names ending with "." to avoid require("")#7351webdevelopersrinu wants to merge 1 commit into
Conversation
A view name ending in "." (e.g. res.render('index.')) produced a bare "."
from path.extname(), which skipped the default-engine fallback and led to
require("") — throwing an opaque TypeError [ERR_INVALID_ARG_VALUE] that
bypassed the render callback. Treat a bare-dot extension as no extension so
a normal "Failed to lookup view" error is delivered instead.
Ziiyodullayevv
left a comment
There was a problem hiding this comment.
Good fix for view names ending with dot. This prevents potential security issues with require() receiving empty strings. The validation is simple and effective.
|
Thanks for taking a look and for the feedback, @Ziiyodullayevv |
|
Hi @webdevelopersrinu — your fix is correct (and received positive feedback), but the PR has been stalled without maintainer review for a while. I picked it up and re-implemented it on current |
|
Following up on the duplicate (#7420) — I verified this fix against current @krzysdz would it be possible to review/merge this? Happy to help with anything needed (rebase, additional edge cases, etc.). |
Problem
A view name ending in "." (e.g.
res.render('index.')orapp.render('index.', cb)) makes the View constructor callrequire(""), throwingTypeError [ERR_INVALID_ARG_VALUE]: The argument 'id' must be a non-empty string. Withapp.render()this throws past the callback; withres.render()it surfaces as an opaque 500.Cause
path.extname('index.')returns'.'(truthy), so the default-engine fallback inlib/view.jsis skipped,this.extstays'.', andthis.ext.slice(1)is''— leading torequire('').Fix
Treat a bare
'.'extension as no extension, so the normal default-engine path runs and an unresolved view yields the usualFailed to lookup viewerror via the callback.Tests
Added a regression test in
test/app.render.js. It fails without the fix (with theERR_INVALID_ARG_VALUEcrash) and passes with it. Full suite (1250 tests) and lint pass.Fixes #7350