launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

@@ -67,6 +67,14 @@ function launchEditor(file, specifiedEditor, onErrorCallback) {
   let { fileName } = parsed
   const { lineNumber, columnNumber } = parsed
 
+  if (process.platform === 'win32' && path.resolve(fileName).startsWith('\\\\')) {
+    return onErrorCallback(
+      fileName,
+      'UNC paths are not supported on Windows to avoid security issues. ' +
+        'See https://github.com/vitejs/launch-editor/tree/main/packages/launch-editor#unc-paths-on-windows for details.',
+    )
+  }
+
   if (!fs.existsSync(fileName)) {
     return
   }

@@ -0,0 +1,50 @@
+const assert = require('node:assert/strict')
+const { describe, test, mock } = require('node:test')
+
+const launchEditor = require('./index.js')
+
+const UNC_ERROR = 'UNC paths are not supported on Windows to avoid security issues.'
+
+describe('launchEditor UNC path guard', () => {
+  if (process.platform === 'win32') {
+    test('rejects UNC paths on Windows via the error callback', () => {
+      const onError = mock.fn()
+
+      launchEditor('\\\\server\\share\\file.js', 'vim', onError)
+
+      assert.equal(onError.mock.callCount(), 1)
+      const [fileName, message] = onError.mock.calls[0].arguments
+      assert.equal(fileName, '\\\\server\\share\\file.js')
+      assert.ok(message.includes(UNC_ERROR))
+    })
+
+    test('strips the position suffix before reporting the rejected UNC path', () => {
+      const onError = mock.fn()
+
+      launchEditor('\\\\server\\share\\file.js:10:5', 'vim', onError)
+
+      assert.equal(onError.mock.callCount(), 1)
+      const [fileName, message] = onError.mock.calls[0].arguments
+      assert.equal(fileName, '\\\\server\\share\\file.js')
+      assert.ok(message.includes(UNC_ERROR))
+    })
+
+    test('does not treat a normal absolute Windows path as UNC', () => {
+      const onError = mock.fn()
+
+      // Non-existent file: without the UNC guard firing, launchEditor returns
+      // silently at the `fs.existsSync` check without invoking the callback.
+      launchEditor('C:\\Users\\me\\does-not-exist-xyz.js', 'vim', onError)
+
+      assert.equal(onError.mock.callCount(), 0)
+    })
+  } else {
+    test('does not apply the UNC guard on non-Windows platforms', () => {
+      const onError = mock.fn()
+
+      launchEditor('\\\\server\\share\\does-not-exist-xyz.js', 'vim', onError)
+
+      assert.equal(onError.mock.callCount(), 0)
+    })
+  }
+})

@@ -109,3 +109,15 @@ column=$3
 # call your editor with whatever args it expects
 my-editor -l $line -c $column -f $filename
 ```
+
+## UNC paths on Windows
+
+On Windows, `launch-editor` refuses to open files whose resolved path is a [UNC path](https://learn.microsoft.com/en-us/dotnet/standard/io/file-path-formats#unc-paths), that is, a path that starts with `\\`, such as `\\server\share\file.js`.
+
+When a UNC path points at a remote host, any filesystem operation `launch-editor` performs on it (such as the `fs.existsSync` check used to verify the file before launching the editor) causes Windows to connect to that host over SMB. An attacker who controls the requested file path could point it at a server they control and abuse this to leak the current user's NTLM credentials: Windows automatically attempts NTLM authentication against the remote host, sending the user's NTLM challenge-response, which the attacker can capture for offline cracking or relay to another service (an NTLM relay attack). Because the file path frequently originates from untrusted input (for example, the `file` query parameter handled by `launch-editor-middleware`), `launch-editor` rejects UNC paths up front so it never performs any filesystem operation on them.
+
+When a UNC path is rejected, the error callback is invoked with:
+
+> UNC paths are not supported on Windows to avoid security issues.
+
+If you need to edit a file on a network share, map the share to a drive letter first and pass that path (e.g. `Z:\file.js`) instead.