Mastodawn

“Virtual File System” PR for Node.js comes with a disclaimer:

"Disclaimer: I've used a significant amount of Claude Code tokens to create this PR. I've reviewed all changes myself.”

LoC added: +18945

Thankfully it hasn't been merged yet. The changes are all over the place and this makes me uncomfortable about running Node.js long term.

https://github.com/nodejs/node/pull/61478

Virtual File System for Node.js by mcollina · Pull Request #61478 · nodejs/node

A first-class virtual file system module (node:vfs) with a provider-based architecture that integrates with Node.js's fs module and module loader. Key Features Provider Architecture - Extensi...

GitHub

Show thread

cthos 🐱Mar 18

@indutny what are the odds that, given the first several reviews are “can we use path.join” on a bunch of lines that are using string concatination for constructing paths, they have introduced several directory traversal attacks in this thing?

Show thread

Niels Abildgaard

@cthos @indutny I was thinking about the same thing, also vis-a-vis other replies here about how large and one-shot the PR is.

Claude has gotten really good at producing code that *looks* right (that is, hides errors well), and trying to find them in 19k lines is just...