From 8661421a8cbfb3f9a29b9a363d5d2780394bb0d4 Mon Sep 17 00:00:00 2001 From: Yagiz Nizipli Date: Thu, 13 Apr 2023 10:43:50 -0400 Subject: [PATCH] esm: avoid accessing lazy getters for urls --- lib/internal/modules/esm/resolve.js | 40 ++++++++++++++++++----------- 1 file changed, 25 insertions(+), 15 deletions(-) diff --git a/lib/internal/modules/esm/resolve.js b/lib/internal/modules/esm/resolve.js index 0dc7a9ae1d6690..896bd10c0ccddc 100644 --- a/lib/internal/modules/esm/resolve.js +++ b/lib/internal/modules/esm/resolve.js @@ -899,16 +899,20 @@ function resolveAsCommonJS(specifier, parentURL) { // TODO(@JakobJingleheimer): de-dupe `specifier` & `parsed` function checkIfDisallowedImport(specifier, parsed, parsedParentURL) { if (parsedParentURL) { + // Avoid accessing the `protocol` property due to the lazy getters. + const parentProtocol = parsedParentURL.protocol; if ( - parsedParentURL.protocol === 'http:' || - parsedParentURL.protocol === 'https:' + parentProtocol === 'http:' || + parentProtocol === 'https:' ) { if (shouldBeTreatedAsRelativeOrAbsolutePath(specifier)) { + // Avoid accessing the `protocol` property due to the lazy getters. + const parsedProtocol = parsed?.protocol; // data: and blob: disallowed due to allowing file: access via // indirection - if (parsed && - parsed.protocol !== 'https:' && - parsed.protocol !== 'http:' + if (parsedProtocol && + parsedProtocol !== 'https:' && + parsedProtocol !== 'http:' ) { throw new ERR_NETWORK_IMPORT_DISALLOWED( specifier, @@ -949,22 +953,26 @@ function throwIfInvalidParentURL(parentURL) { } function throwIfUnsupportedURLProtocol(url) { - if (url.protocol !== 'file:' && url.protocol !== 'data:' && - url.protocol !== 'node:') { + // Avoid accessing the `protocol` property due to the lazy getters. + const protocol = url.protocol; + if (protocol !== 'file:' && protocol !== 'data:' && + protocol !== 'node:') { throw new ERR_UNSUPPORTED_ESM_URL_SCHEME(url); } } function throwIfUnsupportedURLScheme(parsed, experimentalNetworkImports) { + // Avoid accessing the `protocol` property due to the lazy getters. + const protocol = parsed?.protocol; if ( - parsed && - parsed.protocol !== 'file:' && - parsed.protocol !== 'data:' && + protocol && + protocol !== 'file:' && + protocol !== 'data:' && ( !experimentalNetworkImports || ( - parsed.protocol !== 'https:' && - parsed.protocol !== 'http:' + protocol !== 'https:' && + protocol !== 'http:' ) ) ) { @@ -1021,11 +1029,13 @@ function defaultResolve(specifier, context = {}) { parsed = new URL(specifier); } - if (parsed.protocol === 'data:' || + // Avoid accessing the `protocol` property due to the lazy getters. + const protocol = parsed.protocol; + if (protocol === 'data:' || (experimentalNetworkImports && ( - parsed.protocol === 'https:' || - parsed.protocol === 'http:' + protocol === 'https:' || + protocol === 'http:' ) ) ) {