child_process: ensure message sanity at send source #24787

gireeshpunathil · 2018-12-02T14:34:07Z

Error messages coming out of de-serialization at the send target is not consumable. So detect the scenario and fix it at the send source.

Ref: #20314

existing error message (sample code in the linked issue):

SUBPROCESS error: SyntaxError: Unexpected token u in JSON at position 0
    at JSON.parse (<anonymous>)
    at Pipe.channel.onread (internal/child_process.js:492:28)

with this change:

PARENT error: TypeError [ERR_INVALID_ARG_TYPE]: The "message" argument must be of type serializable objects. Received type symbol
    at ChildProcess.target._send (internal/child_process.js:664:13)
    at ChildProcess.target.send (internal/child_process.js:641:19)
    at Object.<anonymous> (/home/gireesh/node/parent.js:6:14)
    at Module._compile (internal/modules/cjs/loader.js:723:30)
    at Object.Module._extensions..js (internal/modules/cjs/loader.js:734:10)
    at Module.load (internal/modules/cjs/loader.js:620:32)
    at tryModuleLoad (internal/modules/cjs/loader.js:560:12)
    at Function.Module._load (internal/modules/cjs/loader.js:552:3)
    at Function.Module.runMain (internal/modules/cjs/loader.js:776:12)
    at executeUserCode (internal/bootstrap/node.js:343:17)

/cc @vsemozhetbyt @joyeecheung @nodejs/child_process

Checklist

make -j4 test (UNIX), or vcbuild test (Windows) passes
tests and/or benchmarks are included
documentation is changed or added
commit message follows commit guidelines

nodejs-github-bot · 2018-12-02T14:34:09Z

@gireeshpunathil build started: https://ci.nodejs.org/blue/organizations/jenkins/node-test-pull-request-lite-pipeline/detail/node-test-pull-request-lite-pipeline/1796/pipeline

lib/internal/child_process.js

bnoordhuis · 2018-12-02T15:17:11Z

lib/internal/child_process.js

+    // end point; as any failure in the strinfication there
+    // will result in error message that is weekly consumable.
+    // So perform a sanity check on message prior to sending.
+    const ret = JSON.stringify(message);


Calling JSON.stringify() twice is wasteful. Cache the result and use it on line 730.

unfortunately, the message undergoes change in all the possible control flows between here and line 730, so cached value is unusable.

Another alternative is to delay this sanity check to as late as line 730 where there is already a stringification, don't know whether it can have side effects or not - thoughts please?

This will only guard against three input types: undefined, function and symbol. All other values either throw (e.g., any input that includes a BigInt) or the non-serializable part would be omitted or replaced with the string 'null' (with the exception of the object containing an toJSON function which returns undefined).

There are lots of inputs which would also be problematic which would not be caught here. I actually doubt that we really have to guard against anything else than undefined. So let's just use a simple type check instead of using JSON.stringify:

if (typeof message !== 'string' && typeof message !== 'object' && typeof message !== 'number' && typeof message !== 'boolean') { throw new ERR_INVALID_ARG_TYPE( 'message', ['string', 'object', 'number', 'boolean'], message); }

The reason why I would do the check like this is that in the default case the message is either a string or an object. Other type checks would not be necessary anymore. While doing it the other way around would require to always check for undefined, bigint, symbol and function. The error message is also a bit clearer that way.

This will not guard against a weird toJSON function but that should be fine.

@BridgeAR - I followed your suggestions, PTAL.

lib/internal/child_process.js

gireeshpunathil · 2018-12-03T11:42:43Z

CI: https://ci.nodejs.org/job/node-test-pull-request/19146/

gireeshpunathil · 2019-01-20T13:14:37Z

more than a month with no reviews and approvals; can I have one please!

BridgeAR · 2019-01-20T13:45:36Z

lib/internal/child_process.js

+    // end point; as any failure in the strinfication there
+    // will result in error message that is weekly consumable.
+    // So perform a sanity check on message prior to sending.
+    const ret = JSON.stringify(message);


This will only guard against three input types: undefined, function and symbol. All other values either throw (e.g., any input that includes a BigInt) or the non-serializable part would be omitted or replaced with the string 'null' (with the exception of the object containing an toJSON function which returns undefined).

There are lots of inputs which would also be problematic which would not be caught here. I actually doubt that we really have to guard against anything else than undefined. So let's just use a simple type check instead of using JSON.stringify:

if (typeof message !== 'string' && typeof message !== 'object' && typeof message !== 'number' && typeof message !== 'boolean') { throw new ERR_INVALID_ARG_TYPE( 'message', ['string', 'object', 'number', 'boolean'], message); }

The reason why I would do the check like this is that in the default case the message is either a string or an object. Other type checks would not be necessary anymore. While doing it the other way around would require to always check for undefined, bigint, symbol and function. The error message is also a bit clearer that way.

This will not guard against a weird toJSON function but that should be fine.

BridgeAR · 2019-01-20T14:31:58Z

lib/internal/child_process.js

+    // will result in error message that is weakly consumable.
+    // So perform a sanity check on message prior to sending.
+    const ret = JSON.stringify(message);
+    if (ret == null) {


ret can never be null. If null is passed through as message JSON.stringify() would return the string 'null'.

JSON.stringify() either returns undefined or a string or it throws.

gireeshpunathil · 2019-01-25T03:51:25Z

ping @BridgeAR

gireeshpunathil · 2019-02-08T11:21:11Z

can I get a review here pls?

lpinca · 2019-03-11T07:04:08Z

CI: https://ci.nodejs.org/job/node-test-pull-request/21419/

Error messages coming out of de-serialization at the send target is not consumable. So detect the scenario and fix it at the send source Ref: nodejs#20314 PR-URL: nodejs#24787 Reviewed-By: Luigi Pinca <[email protected]>

gireeshpunathil · 2019-03-18T04:54:39Z

landed as daa97df

Error messages coming out of de-serialization at the send target is not consumable. So detect the scenario and fix it at the send source Ref: nodejs#20314 PR-URL: nodejs#24787 Reviewed-By: Luigi Pinca <[email protected]>

Error messages coming out of de-serialization at the send target is not consumable. So detect the scenario and fix it at the send source Ref: #20314 PR-URL: #24787 Reviewed-By: Luigi Pinca <[email protected]>

nodejs-github-bot added the child_process Issues and PRs related to the child_process subsystem. label Dec 2, 2018

bnoordhuis reviewed Dec 2, 2018

View reviewed changes

vsemozhetbyt reviewed Dec 2, 2018

View reviewed changes

lib/internal/child_process.js Outdated Show resolved Hide resolved

BridgeAR reviewed Jan 20, 2019

View reviewed changes

lpinca approved these changes Mar 11, 2019

View reviewed changes

gireeshpunathil force-pushed the sub_process branch from 65ac601 to 8b981fa Compare March 18, 2019 04:51

child_process: ensure message sanity at source

daa97df

Error messages coming out of de-serialization at the send target is not consumable. So detect the scenario and fix it at the send source Ref: nodejs#20314 PR-URL: nodejs#24787 Reviewed-By: Luigi Pinca <[email protected]>

gireeshpunathil force-pushed the sub_process branch from 8b981fa to daa97df Compare March 18, 2019 04:54

gireeshpunathil merged commit daa97df into nodejs:master Mar 18, 2019

targos mentioned this pull request Mar 27, 2019

v11.13.0 release proposal #26949

Merged

BethGriggs mentioned this pull request May 1, 2019

v10.16.0 proposal #27514

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

child_process: ensure message sanity at send source #24787

child_process: ensure message sanity at send source #24787

gireeshpunathil commented Dec 2, 2018

nodejs-github-bot commented Dec 2, 2018

bnoordhuis Dec 2, 2018

gireeshpunathil Dec 2, 2018

BridgeAR Jan 20, 2019

gireeshpunathil Jan 21, 2019

gireeshpunathil commented Dec 3, 2018

gireeshpunathil commented Jan 20, 2019

BridgeAR Jan 20, 2019

BridgeAR Jan 20, 2019

gireeshpunathil commented Jan 25, 2019

gireeshpunathil commented Feb 8, 2019

lpinca commented Mar 11, 2019

gireeshpunathil commented Mar 18, 2019

child_process: ensure message sanity at send source #24787

child_process: ensure message sanity at send source #24787

Conversation

gireeshpunathil commented Dec 2, 2018

Checklist

nodejs-github-bot commented Dec 2, 2018

bnoordhuis Dec 2, 2018

Choose a reason for hiding this comment

gireeshpunathil Dec 2, 2018

Choose a reason for hiding this comment

BridgeAR Jan 20, 2019

Choose a reason for hiding this comment

gireeshpunathil Jan 21, 2019

Choose a reason for hiding this comment

gireeshpunathil commented Dec 3, 2018

gireeshpunathil commented Jan 20, 2019

BridgeAR Jan 20, 2019

Choose a reason for hiding this comment

BridgeAR Jan 20, 2019

Choose a reason for hiding this comment

gireeshpunathil commented Jan 25, 2019

gireeshpunathil commented Feb 8, 2019

lpinca commented Mar 11, 2019

gireeshpunathil commented Mar 18, 2019