Rafael Gonzaga e615b9e2f2 doc: clarify fileURLToPath security considerations ...

Add clarification that fileURLToPath() decodes encoded
dot-segments (%2e%2e) which are normalized as path traversal.
Applications must perform their own path validation to
prevent directory traversal attacks.

Also applies to fileURLToPathBuffer().

PR-URL: https://github.com/nodejs/node/pull/60887
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

2026-02-24 00:37:02 +01:00

..

addons.md

doc: fix c++ addon hello world sample

2025-01-05 13:05:24 -05:00

assert.md

2025-08-28, Version 22.19.0 'Jod' (LTS)

2025-08-27 00:06:26 +01:00

async_context.md

doc: fix AsyncLocalStorage example response changes after node v18

2025-05-19 12:14:09 +02:00

async_hooks.md

doc,tools: enforce use of node: prefix

2024-08-05 11:15:41 -03:00

buffer.md

doc: correct values/references for buffer.kMaxLength

2026-02-24 00:36:42 +01:00

child_process.md

doc: recommend events.once to manage 'close' event

2026-02-24 00:36:42 +01:00

cli.md

doc: clarify --use-system-ca support status

2026-02-24 00:36:26 +01:00

cluster.md

doc: fix typed list formatting

2025-08-04 13:29:03 +02:00

console.md

doc: add a note on console stream behavior

2025-01-05 12:57:20 -05:00

corepack.md

doc: clarify future Corepack removal in v25+

2025-06-10 10:39:39 +02:00

crypto.md

doc: rename x509.extKeyUsage to x509.keyUsage

2025-08-26 11:22:41 +02:00

debugger.md

inspector: introduce the --inspect-wait flag

2024-05-12 21:21:55 +02:00

deprecations.md

doc: add automated migration info to deprecations

2025-10-11 20:49:16 +02:00

dgram.md

dgram: support blocklist in udp

2025-01-05 13:05:31 -05:00

diagnostics_channel.md

http2: add diagnostics channels for client stream request body

2026-02-24 00:36:28 +01:00

dns.md

doc: add missing CAA type to dns.resolveAny() & dnsPromises.resolveAny()

2026-02-19 18:46:21 +01:00

documentation.md

doc: clarify release candidate stability index

2025-08-26 11:22:37 +02:00

domain.md

doc: domain.add() does not accept timer objects

2026-02-24 00:36:55 +01:00

embedding.md

doc: improve c++ embedder API doc

2024-11-27 11:03:27 -05:00

environment_variables.md

doc: mark .env files support as stable

2025-10-11 20:49:17 +02:00

errors.md

doc: correct description of error.stack accessor behavior

2026-02-17 15:39:30 +01:00

esm.md

doc: highlight module loading difference between import and require

2026-02-24 00:36:42 +01:00

events.md

doc: format safely for doc-kit

2025-08-25 17:02:57 +02:00

fs.md

doc: fix filehandle.read typo

2025-09-20 06:16:02 +00:00

globals.md

doc,src,lib: clarify experimental status of Web Storage support

2026-01-13 14:34:37 +01:00

http2.md

2025-09-24, Version 22.20.0 'Jod' (LTS)

2025-09-22 18:39:21 +00:00

http.md

doc: fix linter issues

2026-02-24 00:36:43 +01:00

https.md

doc: fix linter issues

2026-02-24 00:36:43 +01:00

index.md

doc: add new environment variables doc page

2025-09-20 03:32:45 +00:00

inspector.md

2025-08-28, Version 22.19.0 'Jod' (LTS)

2025-08-27 00:06:26 +01:00

intl.md

doc: improve documentation about ICU data fallback

2023-09-22 13:24:23 +00:00

module.md

doc: mark module.register as active development

2026-02-24 00:37:00 +01:00

modules.md

doc: fix pseudo code in modules.md

2026-02-24 00:36:42 +01:00

n-api.md

2025-10-20, Version 22.21.0 'Jod' (LTS)

2025-10-19 00:35:43 +02:00

net.md

2025-08-28, Version 22.19.0 'Jod' (LTS)

2025-08-27 00:06:26 +01:00

os.md

doc: fix typed list formatting

2025-08-04 13:29:03 +02:00

packages.md

doc: fix typed list formatting

2025-08-04 13:29:03 +02:00

path.md

2025-09-24, Version 22.20.0 'Jod' (LTS)

2025-09-22 18:39:21 +00:00

perf_hooks.md

doc: fix typed list formatting

2025-08-04 13:29:03 +02:00

permissions.md

permission: propagate permission model flags on spawn

2025-07-27 20:28:14 +02:00

process.md

doc: fix typo in process.unref documentation

2026-02-24 00:36:42 +01:00

punycode.md

doc: fix typed list formatting

2025-08-04 13:29:03 +02:00

querystring.md

doc: get rid of unnecessary eslint-skip comments

2023-11-22 19:03:33 +00:00

readline.md

doc: fix typed list formatting

2025-08-04 13:29:03 +02:00

repl.md

doc: fix typed list formatting

2025-08-04 13:29:03 +02:00

report.md

2025-01-07, Version 22.13.0 'Jod' (LTS)

2025-01-06 10:57:22 -05:00

single-executable-applications.md

doc: add missing word in single-executable-applications.md

2026-02-24 00:36:41 +01:00

sqlite.md

doc: add missing history entry for sqlite.md

2026-01-13 14:34:36 +01:00

stream.md

doc: instantiate resolver object

2026-02-24 00:36:28 +01:00

string_decoder.md

doc: add esm examples to node:string_decoder

2024-11-27 11:03:25 -05:00

synopsis.md

doc: clarify explaination text on how to run the example

2023-10-06 13:37:31 +00:00

test.md

doc: add fullName property to SuiteContext

2026-02-24 00:37:00 +01:00

timers.md

doc: add esm examples to node:timers

2025-01-05 12:57:23 -05:00

tls.md

doc: correct tls ALPNProtocols types

2026-02-24 00:36:56 +01:00

tracing.md

doc: fix typed list formatting

2025-08-04 13:29:03 +02:00

tty.md

doc: fix typed list formatting

2025-08-04 13:29:03 +02:00

typescript.md

doc: update decorator documentation to reflect actual policy

2026-02-19 18:46:02 +01:00

url.md

doc: clarify fileURLToPath security considerations

2026-02-24 00:37:02 +01:00

util.md

doc: replace column with columnNumber in example of util.getCallSites

2026-02-24 00:37:01 +01:00

v8.md

2025-06-24, Version 22.17.0 'Jod' (LTS)

2025-06-24 09:41:14 +02:00

vm.md

vm: make vm.Module.evaluate() conditionally synchronous

2026-02-19 18:46:01 +01:00

wasi.md

doc: fix typed list formatting

2025-08-04 13:29:03 +02:00

webcrypto.md

doc,crypto: update subtle.generateKey and subtle.importKey

2025-10-11 20:49:13 +02:00

webstreams.md

2025-09-24, Version 22.20.0 'Jod' (LTS)

2025-09-22 18:39:21 +00:00

worker_threads.md

doc: use any for worker_threads.Worker 'error' event argument err

2026-02-19 18:46:03 +01:00

zlib.md

doc: add missing Zstd strategy constants

2025-09-20 03:34:00 +00:00