Skip to content

lib: fix validatePort to reject string '0' when allowZero is false#62836

Open
deepview-autofix wants to merge 1 commit intonodejs:mainfrom
deepview-autofix:deepview/392e7ccc97
Open

lib: fix validatePort to reject string '0' when allowZero is false#62836
deepview-autofix wants to merge 1 commit intonodejs:mainfrom
deepview-autofix:deepview/392e7ccc97

Conversation

@deepview-autofix
Copy link
Copy Markdown

The port === 0 && !allowZero check used strict equality, so the string '0' (and other numeric-zero string forms like '0x0') slipped through because '0' === 0 is false. As a result, validatePort('0', name, false) returned 0, contradicting the allowZero=false contract and letting callers such as dgram.Socket#connect('0', ...) proceed past the validator and fail deep in the stack with EADDRNOTAVAIL while leaking the handle.

Compare the numeric coercion (+port === 0) so all numeric-zero forms are rejected consistently.

The `port === 0 && !allowZero` check used strict equality, so the
string `'0'` (and other numeric-zero string forms like `'0x0'`) slipped
through because `'0' === 0` is `false`. As a result,
`validatePort('0', name, false)` returned `0`, contradicting the
`allowZero=false` contract and letting callers such as
`dgram.Socket#connect('0', ...)` proceed past the validator and fail
deep in the stack with `EADDRNOTAVAIL` while leaking the handle.

Compare the numeric coercion (`+port === 0`) so all numeric-zero forms
are rejected consistently.

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: DeepView Autofix <276251120+deepview-autofix@users.noreply.github.com>
Co-Authored-By: Nikita Skovoroda <chalkerx@gmail.com>
Signed-off-by: Nikita Skovoroda <chalkerx@gmail.com>
@nodejs-github-bot nodejs-github-bot added the needs-ci PRs that need a full CI run. label Apr 20, 2026
Copy link
Copy Markdown
Member

@ChALkeR ChALkeR left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is mine (code scanner + autofix)

I also validated the issue in dgram Socket.prototype.connect

@ChALkeR ChALkeR marked this pull request as ready for review April 20, 2026 02:59
Comment thread lib/internal/validators.js
@ChALkeR ChALkeR added the dgram Issues and PRs related to the dgram subsystem / UDP. label Apr 20, 2026
@codecov
Copy link
Copy Markdown

codecov bot commented Apr 20, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.62%. Comparing base (14e16db) to head (3796b48).

Additional details and impacted files
@@            Coverage Diff             @@
##             main   #62836      +/-   ##
==========================================
- Coverage   89.62%   89.62%   -0.01%     
==========================================
  Files         706      706              
  Lines      219136   219136              
  Branches    41987    41984       -3     
==========================================
- Hits       196404   196395       -9     
- Misses      14611    14619       +8     
- Partials     8121     8122       +1     
Files with missing lines Coverage Δ
lib/internal/validators.js 98.25% <100.00%> (ø)

... and 36 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dgram Issues and PRs related to the dgram subsystem / UDP. needs-ci PRs that need a full CI run.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants