Node.js 文件系统与路径工程：安全、性能与实战

import { readFile, writeFile } from 'node:fs/promises';

// Promise 形态，不会阻塞事件循环
const data = await readFile('config.json', 'utf8');
await writeFile('out.txt', data, 'utf8');

import path from 'node:path';

path.join('app', 'config', 'db.json');   // app/config/db.json（按平台自适应）
path.resolve('app', '../config');        // /abs/path/config（相对 cwd 解析为绝对路径）

path.sep;    // 当前平台分隔符：'/' 或 '\\'
path.delimiter; // 环境变量路径分隔符：':' 或 ';'

// ✗ 危险：用户可注入 ../ 逃出目录
const p = `/uploads/${userInput}`;

// ✓ 安全：先 resolve 再校验前缀
const base = path.resolve('uploads');
const target = path.resolve(base, userInput);
if (!target.startsWith(base + path.sep)) throw new Error('非法路径');

import { createReadStream, createWriteStream } from 'node:fs';
import { pipeline } from 'node:stream/promises';

// pipeline 自动处理背压：读太快时写流会暂停读取
await pipeline(
  createReadStream('big.log'),
  createWriteStream('big-copy.log')
);

import { createReadStream } from 'node:fs';
import { createInterface } from 'node:readline';

const rl = createInterface({ input: createReadStream('access.log'), crlfDelay: Infinity });
for await (const line of rl) {
  // 逐行处理，内存占用恒定为 O(1)
}

import { watch } from 'node:fs';

const watcher = watch('uploads', { recursive: true }, (event, filename) => {
  console.log(`${event}: ${filename}`);
});
// 用毕关闭，否则句柄泄漏
watcher.close();

// 防御完整模板
import path from 'node:path';
import { realpath } from 'node:fs/promises';

async function safePath(root, relative) {
  const base = path.resolve(root);
  const target = path.resolve(base, relative);
  // 1) 前缀校验：必须落在 base 之下
  if (!target.startsWith(base + path.sep)) {
    throw new Error('路径越界');
  }
  // 2) realpath 消解符号链接：防 symlink 逃逸
  const real = await realpath(target);
  if (!real.startsWith(base + path.sep)) {
    throw new Error('符号链接逃逸');
  }
  return target;
}

import { mkdtemp, rename, writeFile, rm } from 'node:fs/promises';
import os from 'node:os';
import path from 'node:path';

async function atomicWrite(file, content) {
  const dir = await mkdtemp(path.join(os.tmpdir(), 'app-'));
  const tmp = path.join(dir, 'part');
  await writeFile(tmp, content);
  await rename(tmp, file);   // 原子替换
  await rm(dir, { recursive: true, force: true });
}

// 并行写多个文件
await Promise.all(files.map((f) => writeFile(f.path, f.data)));

data/
  uploads/       # 用户上传（不可执行、定期清理）
  tmp/           # 临时/中间产物
  logs/          # 日志（轮转）
  config/        # 配置文件（只读挂载）