fix(ext/fs): truncate files when a ReadableStream is passed to writeFile (#23330)

Closes #19697. This fixes a bug where the writeFile API can create
partially-overwritten files which may lead to invalid / corrupt files or
data leakage. It also aligns the behavior of writing a ReadableStream
and writing a Uint8Array to the disk.

2 files changed, 19 insertions, 0 deletions

diff --git a/ext/fs/30_fs.js b/ext/fs/30_fs.js
index 3a35749d8..183e51e50 100644
--- a/ext/fs/30_fs.js
+++ b/ext/fs/30_fs.js
@@ -926,6 +926,7 @@ async function writeFile(
         append: options.append ?? false,
         create: options.create ?? true,
         createNew: options.createNew ?? false,
+        truncate: !(options.append ?? false),
         write: true,
       });
       await data.pipeTo(file.writable, {
diff --git a/tests/unit/write_file_test.ts b/tests/unit/write_file_test.ts
index 6cd08e2d1..29780446c 100644
--- a/tests/unit/write_file_test.ts
+++ b/tests/unit/write_file_test.ts
@@ -425,3 +425,21 @@ Deno.test(
     assertEquals(Deno.readFileSync(filename), new Uint8Array([1, 2]));
   },
 );
+
+Deno.test(
+  { permissions: { read: true, write: true } },
+  async function overwriteFileWithStream() {
+    const filename = Deno.makeTempDirSync() + "/test.txt";
+    await Deno.writeFile(filename, new Uint8Array([1, 2, 3, 4]));
+
+    const stream = new ReadableStream({
+      pull(controller) {
+        controller.enqueue(new Uint8Array([1]));
+        controller.enqueue(new Uint8Array([2]));
+        controller.close();
+      },
+    });
+    await Deno.writeFile(filename, stream);
+    assertEquals(Deno.readFileSync(filename), new Uint8Array([1, 2]));
+  },
+);