Urgent.News

What's breaking now, across thousands of outlets.

Tech

One Extra Slash: Hunting a Windows Path Bug Down to a Single Formatter

This is my entry for DEV's Summer Bug Smash — Smash Stories. Not every good bug is an epic. Some of them are one character long, and the interesting part is entirely in the hunt. I was consuming the JSON output of a developer CLI — machine-readable mode, the structured projection you're supposed to build tooling against. My code was doing something completely ordinary: taking a file path out of…

This is the account of a bug discovered during DEV's Summer Bug Smash. The issue was a single extra slash in a Windows file path, caused by a formatter in a CLI tool. The bug was initially missed because it did not cause an error in the path handling process. The issue was identified after comparing the raw bytes emitted by the CLI tool with the code that processed them.

The bug was found to be in a single point of path construction, specifically when a drive root was used. The cause was that a trailing separator was added to a string that already ended with one, resulting in a doubled slash. This bug can lead to issues downstream, such as duplicate entries in caches or incorrect comparisons between files.

To properly report the issue, a minimal reproduction, scoping evidence, and a proposed mechanism were provided. The bug was reported upstream with all necessary details to help the maintainers identify and fix the issue.

Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.

Read the original at dev.to →

More in Tech

The Synth Sounded Fine When Nobody Was Listening

This is my entry for DEV's Summer Bug Smash — Smash Stories. There is a specific kind of bug that makes you doubt your own ears.

  • Browser-based audio engine muffled in real-time playback
  • Live playback path ran on scheduler, offline render had none
  • Fix increased backward-seek threshold to prevent node cancellation

7 JWT Security Mistakes I See in Almost Every Auth Implementation

Most JWT security problems don't come from a broken library. They come from a handful of small decisions made once during setup and never revisited: which algorithm to trust, where to store the token…

  • Trusting the algorithm header can lead to algorithm confusion attacks like "alg: none" bypass.
  • Storing tokens in localStorage exposes them to unauthorized access via scripts.
  • Skipping claim validation beyond signature checks leaves tokens unchecked for expiration and issuer.

More from Thursday 6 August →