fs: only back Blobs with regular files

FdEntry::Create() accepted any path that stat'd, so openAsBlob() handed
out a Blob for directories and fifos. Reading a directory Blob failed
later with NotReadableError and code 0, hiding the EISDIR. A fifo was
worse: opening it with no writer blocked the main thread, so the event
loop stopped.

Only a regular file can be read through the file descriptor this entry
uses, so reject everything else, reporting EISDIR for directories and
EINVAL otherwise.

Author: xia-chao

src/dataqueue/queue.cc

@@ -859,8 +859,6 @@ class DataQueueEntry : public EntryImpl {
 // results if the file just happens to get modified.
 class FdEntry final : public EntryImpl {
   // TODO(@jasnell, @flakey5):
-  // * This should only allow reading from regular files. No directories, no
-  // pipes, etc.
   // * The reader should support accepting the buffer(s) from the pull, if any.
   // It should
   //   only allocate a managed buffer if the pull doesn't provide any.
@@ -882,6 +880,16 @@ class FdEntry final : public EntryImpl {
       return nullptr;
     }
 
+    // A file-backed Blob is read through a regular file descriptor, so only
+    // regular files are usable here. A directory read fails with EISDIR, and
+    // opening a fifo with no writer blocks the thread doing the open, which
+    // for this entry is the main thread.
+    const uint64_t type = req.statbuf.st_mode & S_IFMT;
+    if (type != S_IFREG) {
+      if (status != nullptr) *status = type == S_IFDIR ? UV_EISDIR : UV_EINVAL;
+      return nullptr;
+    }
+
     return std::make_unique<FdEntry>(
         env, std::move(buf), req.statbuf, 0, req.statbuf.st_size);
   }

test/parallel/test-blob-file-backed.js

@@ -12,6 +12,7 @@ const {
   unlink
 } = require('fs/promises');
 const { Blob } = require('buffer');
+const { spawnSync } = require('child_process');
 
 const tmpdir = require('../common/tmpdir');
 const testfile = tmpdir.resolve('test-file-backed-blob.txt');
@@ -142,6 +143,29 @@ writeFileSync(testfile5, '');
   });
 })().then(common.mustCall());
 
+(async () => {
+  // Only a regular file can back a Blob: a directory read fails with EISDIR,
+  // and a fifo with no writer would block the thread doing the open.
+  await assert.rejects(async () => openAsBlob(tmpdir.path), {
+    code: 'EISDIR',
+    syscall: 'stat',
+    path: tmpdir.path,
+  });
+})().then(common.mustCall());
+
+if (!common.isWindows) {
+  const fifo = tmpdir.resolve('test-file-backed-blob.fifo');
+  if (spawnSync('mkfifo', [fifo]).status === 0) {
+    (async () => {
+      await assert.rejects(async () => openAsBlob(fifo), {
+        code: 'EINVAL',
+        syscall: 'stat',
+        path: fifo,
+      });
+    })().then(common.mustCall());
+  }
+}
+
 (async () => {
   // We currently do not allow File-backed blobs to be cloned or transferred
   // across worker threads. This is largely because the underlying FdEntry