Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

lib: fix MIME overmatch in data URLs #49104

Merged
merged 1 commit into from
Aug 13, 2023
+4 −1
Merged

lib: fix MIME overmatch in data URLs #49104

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion lib/internal/modules/esm/formats.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ if (experimentalWasmModules) {
function mimeToFormat(mime) {
if (
RegExpPrototypeExec(
/\s*(text|application)\/javascript\s*(;\s*charset=utf-?8\s*)?/i,
/^\s*(text|application)\/javascript\s*(;\s*charset=utf-?8\s*)?$/i,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could there be any other extra “query params,” so to speak, besides charset=utf-8? If so, then we can’t add the $.

This is another issue, but is utf-8 / utf8 the only permitted charset?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
/^\s*(text|application)\/javascript\s*(;\s*charset=utf-?8\s*)?$/i,
/^\s*(text|application)\/javascript\s*(;|$)/i,

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could there be any other extra “query params,” so to speak, besides charset=utf-8? If so, then we can’t add the $.

I read the MDN article about "Common MIME types" and found a link to the RFC of text/javascript MIME type. They don't mention any other param other than the charset parameter and say that it's optional.

Also, I found out that the first implementation of this code was only matching text/javascript and then someone refactored it to inclued the support for the optional charset parameter.

This is another issue, but is utf-8 / utf8 the only permitted charset?

According to that RFC: "Module goal sources MUST always be processed as UTF-8.", so I think we should be good using just utf-8.

Thanks for the feedback 🚀

mime,
) !== null
) return 'module';
Expand Down
3 changes: 3 additions & 0 deletions test/es-module/test-esm-invalid-data-urls.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,4 +18,7 @@ const assert = require('assert');
code: 'ERR_UNKNOWN_MODULE_FORMAT',
message: 'Unknown module format: text/css for URL data:text/css,.error { color: red; }',
});
await assert.rejects(import('data:WRONGtext/javascriptFORMAT,console.log("hello!");'), {
code: 'ERR_UNKNOWN_MODULE_FORMAT',
});
})().then(common.mustCall());