os: fix tmpdir() returning 'undefined\temp' on Windows

[ish1416]

When process.env is cleared (e.g., in sandboxed environments), os.tmpdir() would return 'undefined\temp' on Windows due to string concatenation with undefined values.

This fix:

• Checks for valid environment variables before using them
• Falls back to getTempDir() when env vars are unavailable
• Adds test case to prevent regression

Reported-by: @rhysd
Fixes: #60582

@ry Could you please review this fix?

[rhysd]

How did you determine that C:\temp is the default temporary directory on Windows? I haven't read Microsoft's official document which explains it.

[ish1416]

getTempDir should already handle the temp directory i just added C://temp just as a fallback as most of the windows have this address as default!

How did you determine that C:\temp is the default temporary directory on Windows? I haven't read Microsoft's official document which explains it.

[Renegade334]

Is there a reason we're not wrapping uv_os_tmpdir here?

[ish1416]

Is there a reason we're not wrapping uv_os_tmpdir here?

@Renegade334 You're absolutely right. We should use uv_os_tmpdir directly instead of the env var fallback chain. That would be the proper cross-platform solution and eliminate the need for any hardcoded fallbacks.

Should I update the fix to use uv_os_tmpdir as the primary approach on Windows?

[cjihrig]

Should I update the fix to use uv_os_tmpdir as the primary approach on Windows?

I would recommend using uv_os_tmpdir() if the existing logic fails first. Otherwise this could become a massive breaking change. It's why I didn't make the change back when I created uv_os_tmpdir().

[ish1416]

Should I update the fix to use uv_os_tmpdir as the primary approach on Windows?

I would recommend using uv_os_tmpdir() if the existing logic fails first. Otherwise this could become a massive breaking change. It's why I didn't make the change back when I created uv_os_tmpdir().

Thanks for the suggestion I have updated my pr accordingly

[ish1416]

@ry Can you please review this fix and merge the pr?

[ish1416]

@cjihrig Can you review it please?

[cjihrig]

This changes more than I would expect. My thought was that the environment variable checking logic would remain essentially the same. However, if all of those were undefined, then it would fallback to uv_os_tmpdir().

[targos]

Unless I'm missing something, uv_os_tmpdir is unused in core at the moment, so to fallback to it would require writing C++ code, which isn't done in this PR.

[ish1416]

Unless I'm missing something, uv_os_tmpdir is unused in core at the moment, so to fallback to it would require writing C++ code, which isn't done in this PR.

@targos You're absolutely right - I'm not using uv_os_tmpdir at all. My fallback implementation uses direct read/write operations between source and destination files, which is the minimal approach needed to avoid the permission preservation issue on CIFS volumes. This keeps the solution simple and doesn't require any temporary file handling.