Skip to content

Commit

Permalink
esm: avoid accessing lazy getters for urls
Browse files Browse the repository at this point in the history
PR-URL: #47542
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
  • Loading branch information
anonrig authored and danielleadams committed Jul 6, 2023
1 parent 35b56be commit 32dcb98
Showing 1 changed file with 25 additions and 15 deletions.
40 changes: 25 additions & 15 deletions lib/internal/modules/esm/resolve.js
Original file line number Diff line number Diff line change
Expand Up @@ -994,16 +994,20 @@ function resolveAsCommonJS(specifier, parentURL) {
// TODO(@JakobJingleheimer): de-dupe `specifier` & `parsed`
function checkIfDisallowedImport(specifier, parsed, parsedParentURL) {
if (parsedParentURL) {
// Avoid accessing the `protocol` property due to the lazy getters.
const parentProtocol = parsedParentURL.protocol;
if (
parsedParentURL.protocol === 'http:' ||
parsedParentURL.protocol === 'https:'
parentProtocol === 'http:' ||
parentProtocol === 'https:'
) {
if (shouldBeTreatedAsRelativeOrAbsolutePath(specifier)) {
// Avoid accessing the `protocol` property due to the lazy getters.
const parsedProtocol = parsed?.protocol;
// data: and blob: disallowed due to allowing file: access via
// indirection
if (parsed &&
parsed.protocol !== 'https:' &&
parsed.protocol !== 'http:'
if (parsedProtocol &&
parsedProtocol !== 'https:' &&
parsedProtocol !== 'http:'
) {
throw new ERR_NETWORK_IMPORT_DISALLOWED(
specifier,
Expand Down Expand Up @@ -1033,22 +1037,26 @@ function checkIfDisallowedImport(specifier, parsed, parsedParentURL) {
}

function throwIfUnsupportedURLProtocol(url) {
if (url.protocol !== 'file:' && url.protocol !== 'data:' &&
url.protocol !== 'node:') {
// Avoid accessing the `protocol` property due to the lazy getters.
const protocol = url.protocol;
if (protocol !== 'file:' && protocol !== 'data:' &&
protocol !== 'node:') {
throw new ERR_UNSUPPORTED_ESM_URL_SCHEME(url);
}
}

function throwIfUnsupportedURLScheme(parsed, experimentalNetworkImports) {
// Avoid accessing the `protocol` property due to the lazy getters.
const protocol = parsed?.protocol;
if (
parsed &&
parsed.protocol !== 'file:' &&
parsed.protocol !== 'data:' &&
protocol &&
protocol !== 'file:' &&
protocol !== 'data:' &&
(
!experimentalNetworkImports ||
(
parsed.protocol !== 'https:' &&
parsed.protocol !== 'http:'
protocol !== 'https:' &&
protocol !== 'http:'
)
)
) {
Expand Down Expand Up @@ -1104,11 +1112,13 @@ async function defaultResolve(specifier, context = {}) {
parsed = new URL(specifier);
}

if (parsed.protocol === 'data:' ||
// Avoid accessing the `protocol` property due to the lazy getters.
const protocol = parsed.protocol;
if (protocol === 'data:' ||
(experimentalNetworkImports &&
(
parsed.protocol === 'https:' ||
parsed.protocol === 'http:'
protocol === 'https:' ||
protocol === 'http:'
)
)
) {
Expand Down

0 comments on commit 32dcb98

Please sign in to comment.