windows: recognize reserved DOS device names before NtCreateFile

src/paths/lib.rs

@@ -105,6 +105,133 @@ pub fn is_absolute_windows_wtf16(p: &[u16]) -> bool {
     is_absolute_windows_t::<u16>(p)
 }
 
+/// Recognise a reserved Win32 DOS device name (`NUL`, `CON`, `PRN`, `AUX`,
+/// `COM1`-`COM9`, `LPT1`-`LPT9`) in a single path component and return its
+/// canonical uppercase spelling, or `None`. Mirrors `RtlIsDosDeviceName_U`
+/// enough that every spelling Win32's `CreateFileW` would redirect is caught:
+/// trailing `.`/` ` are ignored and the match is ASCII-case-insensitive.
+/// Unlike the Win32 routine no extension/stream suffix is stripped, so
+/// `nul.txt` is not a device; modern Windows and Node agree on that.
+pub fn windows_reserved_device_name_t<T: PathChar>(component: &[T]) -> Option<&'static [u8]> {
+    let mut end = component.len();
+    while end > 0 && (component[end - 1].eq_ascii(b'.') || component[end - 1].eq_ascii(b' ')) {
+        end -= 1;
+    }
+    let up = |i: usize| component[i].to_ascii_upper().to_ascii();
+    match end {
+        3 => match [up(0)?, up(1)?, up(2)?] {
+            [b'N', b'U', b'L'] => Some(b"NUL"),
+            [b'C', b'O', b'N'] => Some(b"CON"),
+            [b'P', b'R', b'N'] => Some(b"PRN"),
+            [b'A', b'U', b'X'] => Some(b"AUX"),
+            _ => None,
+        },
+        4 => {
+            let d = up(3)?;
+            if !d.is_ascii_digit() || d == b'0' {
+                return None;
+            }
+            const COM: [&[u8]; 9] = [
+                b"COM1", b"COM2", b"COM3", b"COM4", b"COM5", b"COM6", b"COM7", b"COM8", b"COM9",
+            ];
+            const LPT: [&[u8]; 9] = [
+                b"LPT1", b"LPT2", b"LPT3", b"LPT4", b"LPT5", b"LPT6", b"LPT7", b"LPT8", b"LPT9",
+            ];
+            let i = (d - b'1') as usize;
+            match [up(0)?, up(1)?, up(2)?] {
+                [b'C', b'O', b'M'] => Some(COM[i]),
+                [b'L', b'P', b'T'] => Some(LPT[i]),
+                _ => None,
+            }
+        }
+        _ => None,
+    }
+}
+
+#[cfg(test)]
+mod windows_reserved_device_name_tests {
+    use super::windows_reserved_device_name_t as check;
+
+    #[track_caller]
+    fn both(s: &str, want: Option<&[u8]>) {
+        assert_eq!(check(s.as_bytes()), want, "{s:?} (u8)");
+        let w: Vec<u16> = s.encode_utf16().collect();
+        assert_eq!(check::<u16>(&w), want, "{s:?} (u16)");
+    }
+
+    #[test]
+    fn three_char_devices() {
+        for (s, want) in [
+            ("nul", b"NUL" as &[u8]),
+            ("NUL", b"NUL"),
+            ("Nul", b"NUL"),
+            ("nUl", b"NUL"),
+            ("con", b"CON"),
+            ("CoN", b"CON"),
+            ("prn", b"PRN"),
+            ("aux", b"AUX"),
+            ("AUX", b"AUX"),
+        ] {
+            both(s, Some(want));
+        }
+    }
+
+    #[test]
+    fn numbered_devices() {
+        both("com1", Some(b"COM1"));
+        both("COM9", Some(b"COM9"));
+        both("Com5", Some(b"COM5"));
+        both("lpt1", Some(b"LPT1"));
+        both("LpT9", Some(b"LPT9"));
+        both("com0", None);
+        both("lpt0", None);
+        both("com10", None);
+        both("comA", None);
+        both("coma", None);
+    }
+
+    #[test]
+    fn trailing_dots_and_spaces_ignored() {
+        both("nul.", Some(b"NUL"));
+        both("nul ", Some(b"NUL"));
+        both("nul. ", Some(b"NUL"));
+        both("nul .", Some(b"NUL"));
+        both("Nul .. ", Some(b"NUL"));
+        both("com1  ", Some(b"COM1"));
+        both("aux.", Some(b"AUX"));
+    }
+
+    #[test]
+    fn near_misses() {
+        for s in [
+            "",
+            "n",
+            "nu",
+            "null",
+            "nul1",
+            "nu1",
+            "nula",
+            "anul",
+            " nul",
+            ".nul",
+            "con1",
+            "conn",
+            "nul.txt",
+            "nul:stream",
+            "aux1",
+            "co",
+            "com",
+            "lpt",
+            "c:nul",
+        ] {
+            both(s, None);
+        }
+        // Non-ASCII in a would-be match position.
+        let w: Vec<u16> = "n\u{00fc}l".encode_utf16().collect();
+        assert_eq!(check::<u16>(&w), None);
+    }
+}
+
 /// Returns the leading drive
 /// designator (e.g. `C:` or `\\server\share`) or empty.
 ///

src/sys/lib.rs

@@ -6644,56 +6644,96 @@
     opts: NormalizePathWindowsOpts,
 ) -> Maybe<&'a bun_core::WStr> {
     use bun_core::WStr;
+    use bun_paths::is_sep_any_t as is_sep;
     let too_long = || Error::from_code(E::ENAMETOOLONG, Tag::open);
 
     let mut path = path;
+
+    // `\\?\`, `\\.\`, `\??\` — namespaces Win32 does not apply DOS-path
+    // normalization to; exempt from the trailing-dot/space strip below.
+    let verbatim = path.len() >= 4
+        && is_sep(path[0])
+        && is_sep(path[3])
+        && ((is_sep(path[1]) && (path[2] == b'?' as u16 || path[2] == b'.' as u16))
+            || (path[1] == b'?' as u16 && path[2] == b'?' as u16));
+
+    // Locate the final path component: after the last separator, or after a
+    // leading `C:` when no separator is present.
+    let comp_start = path
+        .iter()
+        .rposition(|&c| is_sep(c))
+        .map(|i| i + 1)
+        .unwrap_or_else(|| {
+            if path.len() >= 2
+                && bun_paths::resolve_path::is_drive_letter_t::<u16>(path[0])
+                && path[1] == b':' as u16
+            {
+                2
+            } else {
+                0
+            }
+        });
+
+    // (a) Reserved DOS device names (`NUL`, `CON`, `PRN`, `AUX`, `COM1-9`,
+    // `LPT1-9`) name a device regardless of any directory prefix and
+    // case-insensitively; `NtCreateFile` does not know about them, so a bare
+    // `nul` otherwise creates a literal file that Explorer/cmd cannot remove.
+    if let Some(device) = bun_paths::windows_reserved_device_name_t(&path[comp_start..]) {
+        let prefix: &[u16] = if opts.add_nt_prefix {
+            bun_core::w!("\\??\\")
+        } else {
+            bun_core::w!("\\\\.\\")
+        };
+        let total = prefix.len() + device.len();
+        if buf.len() <= total {
+            return Err(too_long());
+        }
+        buf[..prefix.len()].copy_from_slice(prefix);
+        for (i, &b) in device.iter().enumerate() {
+            buf[prefix.len() + i] = b as u16;
+        }
+        buf[total] = 0;
+        return Ok(WStr::from_buf(&buf[..], total));
+    }
+
+    // (b) Win32 strips trailing `.` and ` ` from the final component; NT does
+    // not. Doing the strip here keeps both open paths agreeing on the same
+    // file and avoids creating names Explorer/cmd cannot address. Verbatim
+    // inputs keep their bytes. The strip only applies when the component has
+    // a non-`.`/` ` character to anchor on, so `.`/`..` reach the normalizer
+    // unchanged.
+    if !verbatim {
+        if let Some(last) = path[comp_start..]
+            .iter()
+            .rposition(|&c| c != b'.' as u16 && c != b' ' as u16)
+        {
+            path = &path[..comp_start + last + 1];
+        }
+    }
+
     if bun_paths::is_absolute_windows_wtf16(path) {
-        // Three special-cases that must run BEFORE
+        // Two special-cases that must run BEFORE
         // `normalizeStringGenericTZ`, otherwise device paths get mangled:
-        if path.len() >= 4 {
-            // (a) `…\nul` / `…\NUL` → literal NT object path `\??\NUL`.
-            const BS_NUL_LO: [u16; 4] = [b'\\' as u16, b'n' as u16, b'u' as u16, b'l' as u16];
-            const BS_NUL_UP: [u16; 4] = [b'\\' as u16, b'N' as u16, b'U' as u16, b'L' as u16];
-            let tail = &path[path.len() - 4..];
-            if tail == BS_NUL_LO || tail == BS_NUL_UP {
-                const NT_NUL: [u16; 7] = [
-                    b'\\' as u16,
-                    b'?' as u16,
-                    b'?' as u16,
-                    b'\\' as u16,
-                    b'N' as u16,
-                    b'U' as u16,
-                    b'L' as u16,
-                ];
-                if buf.len() <= NT_NUL.len() {
+        if path.len() >= 4 && is_sep(path[1]) && is_sep(path[3]) {
+            // `\\.\…` device path → preserve verbatim so `\\.\pipe\foo`
+            // is not collapsed to `\pipe\foo` by the normalizer.
+            if path[2] == b'.' as u16 {
+                if path.len() >= buf.len() {
                     return Err(too_long());
                 }
-                buf[..NT_NUL.len()].copy_from_slice(&NT_NUL);
-                buf[NT_NUL.len()] = 0;
-                return Ok(WStr::from_buf(&buf[..], NT_NUL.len()));
+                buf[0] = b'\\' as u16;
+                buf[1] = b'\\' as u16;
+                buf[2] = b'.' as u16;
+                buf[3] = b'\\' as u16;
+                let rest = &path[4..];
+                buf[4..4 + rest.len()].copy_from_slice(rest);
+                buf[path.len()] = 0;
+                return Ok(WStr::from_buf(&buf[..], path.len()));
             }
-            use bun_paths::is_sep_any_t as is_sep;
-            if is_sep(path[1]) && is_sep(path[3]) {
-                // (b) `\\.\…` device path → preserve verbatim so `\\.\pipe\foo`
-                // is not collapsed to `\pipe\foo` by the normalizer.
-                if path[2] == b'.' as u16 {
-                    if path.len() >= buf.len() {
-                        return Err(too_long());
-                    }
-                    buf[0] = b'\\' as u16;
-                    buf[1] = b'\\' as u16;
-                    buf[2] = b'.' as u16;
-                    buf[3] = b'\\' as u16;
-                    let rest = &path[4..];
-                    buf[4..4 + rest.len()].copy_from_slice(rest);
-                    buf[path.len()] = 0;
-                    return Ok(WStr::from_buf(&buf[..], path.len()));
-                }
-                // (c) `\??\…` / `\\?\…` already prefixed → strip the 4-u16
-                // prefix before re-normalizing to avoid a double `\??\`.
-                if path[2] == b'?' as u16 {
-                    path = &path[4..];
-                }
+            // `\??\…` / `\\?\…` already prefixed → strip the 4-u16
+            // prefix before re-normalizing to avoid a double `\??\`.
+            if path[2] == b'?' as u16 {
+                path = &path[4..];
             }
         }
         if opts.add_nt_prefix {
@@ -9890,6 +9930,75 @@
         }
     }
 
+    #[test]
+    fn dos_device_names_resolve_to_nt_device() {
+        let cwd = Fd::cwd();
+        // Bare, mixed case, relative, absolute, forward-slash, drive-relative,
+        // `\\?\`-prefixed (the prefix does not suppress device recognition
+        // here; node:fs hands every absolute path through with that prefix).
+        for input in [
+            "nul",
+            "NUL",
+            "Nul",
+            "nUl",
+            "nul.",
+            "nul ",
+            "nul. ",
+            "C:nul",
+            "sub\\nul",
+            "sub/nul",
+            "./nul",
+            "C:\\a\\Nul",
+            "C:\\a\\nul ",
+            "\\\\?\\C:\\a\\nul",
+            "\\\\?\\C:\\a\\NUL",
+        ] {
+            assert_eq!(normalize(cwd, input), "\\??\\NUL", "{input:?}");
+            assert_eq!(normalize_opts(cwd, input, false), "\\\\.\\NUL", "{input:?}");
+        }
+        assert_eq!(normalize(cwd, "con"), "\\??\\CON");
+        assert_eq!(normalize(cwd, "pRn"), "\\??\\PRN");
+        assert_eq!(normalize(cwd, "Aux"), "\\??\\AUX");
+        assert_eq!(normalize(cwd, "com1"), "\\??\\COM1");
+        assert_eq!(normalize(cwd, "LPT9"), "\\??\\LPT9");
+        assert_eq!(normalize(cwd, "\\\\.\\nul"), "\\??\\NUL");
+        // Near-misses take the ordinary file path.
+        for input in ["nul.txt", "nula", "null", "com0", "com10", "nul\\x"] {
+            let got = normalize(cwd, input);
+            assert!(!got.starts_with("\\??\\NUL"), "{input:?} -> {got}");
+            assert!(!got.starts_with("\\??\\COM"), "{input:?} -> {got}");
+        }
+    }
+
+    #[test]
+    fn trailing_dots_and_spaces_stripped() {
+        let cwd = Fd::cwd();
+        // Bare relative: the stripped name is returned verbatim for
+        // `NtCreateFile` against `RootDirectory`.
+        for (input, want) in [
+            ("foo.", "foo"),
+            ("foo ", "foo"),
+            ("foo. ", "foo"),
+            ("foo..", "foo"),
+            ("foo . ", "foo"),
+            (".foo.", ".foo"),
+            ("foo.bar.", "foo.bar"),
+            ("foo", "foo"),
+        ] {
+            assert_eq!(normalize(cwd, input), want, "{input:?}");
+        }
+        // `.` / `..` and all-dot/all-space names are left for the normalizer.
+        assert_ne!(normalize(cwd, ".."), ".");
+        assert!(normalize(cwd, ".").starts_with("\\Device\\"));
+        assert_eq!(normalize(cwd, "sub\\.."), normalize(cwd, "."));
+        // Absolute: only the final component is touched.
+        assert_eq!(normalize(cwd, "C:\\a\\b. "), "\\??\\C:\\a\\b");
+        assert_eq!(normalize(cwd, "C:\\a \\b"), "\\??\\C:\\a \\b");
+        // Verbatim prefixes keep their trailing characters.
+        assert_eq!(normalize(cwd, "\\\\?\\C:\\a\\b. "), "\\??\\C:\\a\\b. ");
+        assert_eq!(normalize(cwd, "\\\\.\\pipe\\name."), "\\\\.\\pipe\\name.");
+    }
+
     #[test]
     fn relative_resolves_to_nt_device_name() {
         let _g = crate::file::tests::FD_TEST_LOCK.lock();