Address comments

Author: minggangw

demo/electron/car/README.md

@@ -22,8 +22,8 @@ in real time.
 
 ```bash
 cd demo/electron/car
+source /opt/ros/<distro>/setup.bash   # required before install and launch
 npm install
-source /opt/ros/<distro>/setup.bash   # required before launch
 npm start
 ```
 

demo/electron/manipulator/README.md

@@ -23,8 +23,8 @@ Three.js. It publishes and subscribes to `sensor_msgs/msg/JointState` on
 
 ```bash
 cd demo/electron/manipulator
+source /opt/ros/<distro>/setup.bash   # required before install and launch
 npm install
-source /opt/ros/$ROS_DISTRO/setup.bash   # required before launch
 npm start
 ```
 

demo/electron/turtle_tf2/README.md

@@ -26,8 +26,8 @@ turtlesim, and makes turtle2 follow turtle1.
 
 ```bash
 cd demo/electron/turtle_tf2
+source /opt/ros/<distro>/setup.bash   # required, in the same terminal as npm install / npm start
 npm install
-source /opt/ros/$ROS_DISTRO/setup.bash   # required, in the same terminal as npm start
 ros2 run turtlesim turtlesim_node        # in another sourced terminal
 npm start
 ```

lib/native_loader.js

@@ -46,9 +46,15 @@ function mirrorPrebuiltToBuildRelease(srcPath) {
       return;
     }
     fs.mkdirSync(destDir, { recursive: true });
-    fs.copyFileSync(srcPath, destPath);
+    // COPYFILE_EXCL guarantees we never overwrite an existing build output,
+    // even if another process created it after the existsSync check above.
+    fs.copyFileSync(srcPath, destPath, fs.constants.COPYFILE_EXCL);
     debug(`Mirrored prebuilt binary to ${destPath}`);
   } catch (e) {
+    if (e.code === 'EEXIST') {
+      // Another process mirrored the binary first; leave it untouched.
+      return;
+    }
     debug('Could not mirror prebuilt binary to build/Release:', e.message);
   }
 }
@@ -120,6 +126,13 @@ function customFallbackLoader() {
       arch,
       runtime,
     });
+    // The filename is built from environment-derived values (notably
+    // ROS_DISTRO); ensure it stays a plain basename so it cannot escape
+    // prebuildDir via path separators before we join/require/copy it.
+    if (path.basename(candidate) !== candidate) {
+      debug(`Rejecting suspicious prebuilt filename: ${candidate}`);
+      return null;
+    }
     const candidatePath = path.join(prebuildDir, candidate);
 
     if (fs.existsSync(candidatePath)) {