From aff5e23ecf834fd85e85c1ee23d6dc6fb6fee21d Mon Sep 17 00:00:00 2001 From: ithis0623-png Date: Thu, 22 Oct 2026 15:20:25 +0530 Subject: [PATCH] fix(environment): refuse UNC pathname in file:// URI before fileURLToPath (#6272) When a file:// URI contains leading slashes representing a UNC path (such as file:////remote.example.test/share/state.json), Node's fileURLToPath on Windows throws ERR_INVALID_FILE_URL_PATH because it expects a drive letter or Windows UNC format. This was caught and misreported as 'a file:// uri names a local absolute path' instead of the intended 'a file:// uri names a path on this host, not a network share'. Testing UNC_PATH against url.pathname before calling fileURLToPath ensures that UNC paths are consistently recognized and refused as network shares across platforms. Co-authored-by: ithis0623-png --- src/server/environment/stateIntake.ts | 1 + 1 file changed, 1 insertion(+) diff --git a/src/server/environment/stateIntake.ts b/src/server/environment/stateIntake.ts index f1302a847e..f5ffeb8d3a 100644 --- a/src/server/environment/stateIntake.ts +++ b/src/server/environment/stateIntake.ts @@ -299,6 +299,7 @@ const UNC_PATH = /^[\\/]{2}/u; /** The local path a `file://` uri names; another host or a UNC path would open a network share, so neither is opened. */ const localFilePath = (url: URL): Result => { if (url.host !== "" && url.host !== "localhost") return err(NETWORK_SHARE); + if (UNC_PATH.test(url.pathname)) return err(NETWORK_SHARE); let path: string; try { path = fileURLToPath(url);