fix(unstable): vendor cache override should handle forbidden windows …

…directory names (denoland#20069)

Meant to do this earlier.

cli/cache/http_cache/local.rs

@@ -332,6 +332,19 @@ fn url_to_local_sub_path(
  static FORBIDDEN_CHARS: Lazy<HashSet<char>> = Lazy::new(|| {
  HashSet::from(['?', '<', '>', ':', '*', '|', '\\', ':', '"', '\'', '/'])
  });
+ // https://learn.microsoft.com/en-us/windows/win32/fileio/naming-a-file
+ static FORBIDDEN_WINDOWS_NAMES: Lazy<HashSet<&'static str>> =
+ Lazy::new(|| {
+ let set = HashSet::from([
+ "con", "prn", "aux", "nul", "com0", "com1", "com2", "com3", "com4",
+ "com5", "com6", "com7", "com8", "com9", "lpt0", "lpt1", "lpt2", "lpt3",
+ "lpt4", "lpt5", "lpt6", "lpt7", "lpt8", "lpt9",
+ ]);
+ // ensure everything is lowercase because we'll be comparing
+ // lowercase filenames against this
+ debug_assert!(set.iter().all(|s| s.to_lowercase() == *s));
+ set
+ });
 
  fn has_forbidden_chars(segment: &str) -> bool {
  segment.chars().any(|c| {
@@ -405,7 +418,11 @@ fn url_to_local_sub_path(
  };
 
  // the hash symbol at the start designates a hash for the url part
- hash_context_specific || part.starts_with('#') || has_forbidden_chars(part)
+ hash_context_specific
+ || part.starts_with('#')
+ || has_forbidden_chars(part)
+ || last_ext.is_none() && FORBIDDEN_WINDOWS_NAMES.contains(part)
+ || part.ends_with('.')
  }
 
  // get the base url
@@ -811,6 +828,19 @@ mod test {
  &[("content-type", "application/javascript")],
  "deno.land/x/#mod.ts_e8c36.js",
  );
+ run_test(
+ // not allowed windows folder name
+ "https://deno.land/x/con/con.ts",
+ &[],
+ "deno.land/x/#con_1143d/con.ts",
+ );
+ run_test(
+ // disallow ending a directory with a period
+ // https://learn.microsoft.com/en-us/windows/win32/fileio/naming-a-file
+ "https://deno.land/x/test./main.ts",
+ &[],
+ "deno.land/x/#test._4ee3d/main.ts",
+ );
 
  #[track_caller]
  fn run_test(url: &str, headers: &[(&str, &str)], expected: &str) {