fs: fix mkdtempDisposable with Buffer paths

fs.mkdtempDisposableSync() and fsPromises.mkdtempDisposable() pass the
path of the new directory to path.resolve(), which only accepts
strings. When that path is a Buffer, because the prefix is a Buffer or
`encoding` is 'buffer', both throw ERR_INVALID_ARG_TYPE after the
directory has been created, and nothing removes it.

On Windows, resolve a Buffer path as UTF-8 so win32 semantics stay
intact. On POSIX, keep an absolute Buffer as created and prepend the
cwd captured at creation to a relative one, so bytes that are not
valid UTF-8 are preserved.

Fixes: #66593
Refs: #64397
Signed-off-by: Jiawen Geng <technicalcute@gmail.com>
Assisted-by: claude:opus-5.5
Assisted-by: grok-4.7

Author: gengjiawen

lib/fs.js

@@ -115,6 +115,7 @@ const {
   getStatFsFromBinding,
   getStatsFromBinding,
   realpathCacheKey,
+  absoluteMkdtempPath,
   stringToFlags,
   stringToSymlinkType,
   toUnixTimestamp,
@@ -3759,7 +3760,7 @@ function mkdtempDisposableSync(prefix, options) {
 
   const path = binding.mkdtemp(prefix, options.encoding);
   // Stash the full path in case of process.chdir()
-  const fullPath = pathModule.resolve(process.cwd(), path);
+  const fullPath = absoluteMkdtempPath(process.cwd(), path);
 
   const remove = () => {
     binding.rmSync(fullPath, 0 /* maxRetries */, true /* recursive */, 100 /* retryDelay */);

lib/internal/fs/promises.js

@@ -73,6 +73,7 @@ const {
   getReadFileBuffer,
   getReadFileBufferByteLengthName,
   preprocessSymlinkDestination,
+  absoluteMkdtempPath,
   stringToFlags,
   stringToSymlinkType,
   toUnixTimestamp,
@@ -2109,7 +2110,7 @@ async function mkdtempDisposable(prefix, options) {
     handleErrorFromBinding,
   );
   // Stash the full path in case of process.chdir()
-  const fullPath = pathModule.resolve(cwd, path);
+  const fullPath = absoluteMkdtempPath(cwd, path);
 
   const remove = async () => {
     const rmrf = lazyRimRaf();

lib/internal/fs/utils.js

@@ -25,10 +25,12 @@ const {
   TypedArrayPrototypeAt,
   TypedArrayPrototypeIncludes,
   globalThis,
+  uncurryThis,
 } = primordials;
 
 const { Buffer } = require('buffer');
 const { isBuffer: BufferIsBuffer } = Buffer;
+const BufferToString = uncurryThis(Buffer.prototype.toString);
 const {
   UVException,
   codes: {
@@ -976,6 +978,31 @@ function warnOnNonPortableTemplate(template) {
   }
 }
 
+/**
+ * Path passed to rm() for a directory just created by mkdtemp().
+ * A relative path is made absolute against `cwd` captured at creation, so
+ * remove() still finds the directory after process.chdir().
+ * @param {string} cwd
+ * @param {string | Buffer} path
+ * @returns {string | Buffer}
+ */
+function absoluteMkdtempPath(cwd, path) {
+  if (typeof path === 'string') {
+    return pathModule.resolve(cwd, path);
+  }
+  // Windows Buffer paths are UTF-8. Resolve the string so root-relative
+  // (`\foo`) and drive-relative (`D:foo`) prefixes keep win32 semantics.
+  if (isWindows) {
+    return Buffer.from(pathModule.resolve(cwd, BufferToString(path, 'utf8')));
+  }
+  // POSIX names are bytes and may not be valid UTF-8. Keep an absolute
+  // result as it was created. Prepend cwd to a relative one.
+  if (path.length > 0 && path[0] === CHAR_FORWARD_SLASH) {
+    return Buffer.from(path);
+  }
+  return join(cwd, path);
+}
+
 const defaultCpOptions = {
   dereference: false,
   errorOnExist: false,
@@ -1216,6 +1243,7 @@ module.exports = {
   handleErrorFromBinding,
   preprocessSymlinkDestination,
   realpathCacheKey: Symbol('realpathCacheKey'),
+  absoluteMkdtempPath,
   getStatFsFromBinding,
   getStatsFromBinding,
   stringToFlags,

test/parallel/test-fs-mkdtempDisposableSync.js

@@ -66,6 +66,97 @@ if (isMainThread) {
   process.chdir(originalCwd);
 }
 
+// Buffer paths
+{
+  const prefix = tmpdir.resolve('foo.');
+  for (const result of [
+    fs.mkdtempDisposableSync(Buffer.from(prefix)),
+    fs.mkdtempDisposableSync(prefix, { encoding: 'buffer' }),
+  ]) {
+    assert(Buffer.isBuffer(result.path));
+    assert.strictEqual(path.dirname(result.path.toString()), tmpdir.path);
+    assert(fs.existsSync(result.path));
+
+    result.remove();
+
+    assert(!fs.existsSync(result.path));
+  }
+}
+
+// `chdir` does not affect removal of a relative Buffer path
+// Can't use chdir in workers
+if (isMainThread) {
+  const originalCwd = process.cwd();
+
+  process.chdir(tmpdir.path);
+  const result = fs.mkdtempDisposableSync(Buffer.from('buffer.'));
+  const fullPath = path.join(tmpdir.path, result.path.toString());
+
+  assert(fs.existsSync(fullPath));
+
+  process.chdir(originalCwd);
+  result.remove();
+
+  assert(!fs.existsSync(fullPath));
+}
+
+// Buffer paths that are not valid UTF-8 are removed as is
+// macOS rejects such file names, and Windows converts paths from UTF-8
+if (common.isLinux) {
+  const prefix = Buffer.concat([Buffer.from(tmpdir.resolve('foo')), Buffer.from([0xff, 0x2e])]);
+  const result = fs.mkdtempDisposableSync(prefix);
+
+  assert.deepStrictEqual(result.path.subarray(0, prefix.length), prefix);
+  assert(fs.existsSync(result.path));
+
+  result.remove();
+
+  assert(!fs.existsSync(result.path));
+}
+
+// Relative Buffer path under a non-ASCII cwd
+// Can't use chdir in workers
+if (isMainThread) {
+  const originalCwd = process.cwd();
+  const nonAscii = fs.mkdtempSync(path.join(tmpdir.path, '\u7528\u6237-'));
+
+  process.chdir(nonAscii);
+  const result = fs.mkdtempDisposableSync(Buffer.from('buffer.'));
+  const fullPath = path.join(nonAscii, result.path.toString());
+
+  assert(fs.existsSync(fullPath));
+
+  process.chdir(originalCwd);
+  result.remove();
+
+  assert(!fs.existsSync(fullPath));
+  fs.rmSync(nonAscii, { recursive: true });
+}
+
+// `..` after a symlink is resolved by the OS at creation. remove() has to
+// use those bytes; lexical normalization points at a directory that was
+// never created. Windows normalizes `..` before following the symlink.
+if (!common.isWindows) {
+  const outside = fs.mkdtempSync(path.join(tmpdir.path, 'outside-'));
+  const parent = fs.mkdtempSync(path.join(tmpdir.path, 'parent-'));
+  const link = path.join(parent, 'link');
+  fs.symlinkSync(outside, link);
+
+  const prefix = Buffer.from(`${link}/../foo.`);
+  const result = fs.mkdtempDisposableSync(prefix);
+  const baseName = path.basename(result.path.toString());
+  const createdPath = path.join(path.dirname(outside), baseName);
+
+  assert(fs.existsSync(createdPath));
+  assert(!fs.existsSync(path.join(parent, baseName)));
+
+  result.remove();
+
+  assert(!fs.existsSync(createdPath));
+  fs.rmSync(outside, { recursive: true });
+  fs.rmSync(parent, { recursive: true });
+}
+
 // Errors from cleanup are thrown
 // It is difficult to arrange for rmdir to fail on windows
 if (!common.isWindows && process.getuid() !== 0) {

test/parallel/test-fs-promises-mkdtempDisposable.js

@@ -66,6 +66,98 @@ async function chdirDoesNotAffectRemoval() {
   process.chdir(originalCwd);
 }
 
+async function bufferPaths() {
+  const prefix = tmpdir.resolve('foo.');
+  for (const result of [
+    await fsPromises.mkdtempDisposable(Buffer.from(prefix)),
+    await fsPromises.mkdtempDisposable(prefix, { encoding: 'buffer' }),
+  ]) {
+    assert(Buffer.isBuffer(result.path));
+    assert.strictEqual(path.dirname(result.path.toString()), tmpdir.path);
+    assert(fs.existsSync(result.path));
+
+    await result.remove();
+
+    assert(!fs.existsSync(result.path));
+  }
+}
+
+async function chdirDoesNotAffectRemovalOfBufferPath() {
+  // Can't use chdir in workers
+  if (!isMainThread) return;
+
+  const originalCwd = process.cwd();
+
+  process.chdir(tmpdir.path);
+  const result = await fsPromises.mkdtempDisposable(Buffer.from('buffer.'));
+  const fullPath = path.join(tmpdir.path, result.path.toString());
+
+  assert(fs.existsSync(fullPath));
+
+  process.chdir(originalCwd);
+  await result.remove();
+
+  assert(!fs.existsSync(fullPath));
+}
+
+async function nonUtf8BufferPath() {
+  // macOS rejects such file names, and Windows converts paths from UTF-8
+  if (!common.isLinux) return;
+  const prefix = Buffer.concat([Buffer.from(tmpdir.resolve('foo')), Buffer.from([0xff, 0x2e])]);
+  const result = await fsPromises.mkdtempDisposable(prefix);
+
+  assert.deepStrictEqual(result.path.subarray(0, prefix.length), prefix);
+  assert(fs.existsSync(result.path));
+
+  await result.remove();
+
+  assert(!fs.existsSync(result.path));
+}
+
+async function relativeBufferPathInNonAsciiCwd() {
+  // Can't use chdir in workers
+  if (!isMainThread) return;
+
+  const originalCwd = process.cwd();
+  const nonAscii = fs.mkdtempSync(path.join(tmpdir.path, '\u7528\u6237-'));
+
+  process.chdir(nonAscii);
+  const result = await fsPromises.mkdtempDisposable(Buffer.from('buffer.'));
+  const fullPath = path.join(nonAscii, result.path.toString());
+
+  assert(fs.existsSync(fullPath));
+
+  process.chdir(originalCwd);
+  await result.remove();
+
+  assert(!fs.existsSync(fullPath));
+  fs.rmSync(nonAscii, { recursive: true });
+}
+
+async function symlinkDotDotKeepsCreatedDirectory() {
+  // Windows normalizes `..` before following the symlink.
+  if (common.isWindows) return;
+
+  const outside = fs.mkdtempSync(path.join(tmpdir.path, 'outside-'));
+  const parent = fs.mkdtempSync(path.join(tmpdir.path, 'parent-'));
+  const link = path.join(parent, 'link');
+  fs.symlinkSync(outside, link);
+
+  const prefix = Buffer.from(`${link}/../foo.`);
+  const result = await fsPromises.mkdtempDisposable(prefix);
+  const baseName = path.basename(result.path.toString());
+  const createdPath = path.join(path.dirname(outside), baseName);
+
+  assert(fs.existsSync(createdPath));
+  assert(!fs.existsSync(path.join(parent, baseName)));
+
+  await result.remove();
+
+  assert(!fs.existsSync(createdPath));
+  fs.rmSync(outside, { recursive: true });
+  fs.rmSync(parent, { recursive: true });
+}
+
 async function errorsAreReThrown() {
   // It is difficult to arrange for rmdir to fail on windows
   if (common.isWindows || process.getuid() === 0) return;
@@ -93,5 +185,10 @@ async function errorsAreReThrown() {
   await basicUsage();
   await symbolAsyncDispose();
   await chdirDoesNotAffectRemoval();
+  await bufferPaths();
+  await chdirDoesNotAffectRemovalOfBufferPath();
+  await nonUtf8BufferPath();
+  await relativeBufferPathInNonAsciiCwd();
+  await symlinkDotDotKeepsCreatedDirectory();
   await errorsAreReThrown();
 })().then(common.mustCall());