lib: fix regular expression to detect / and \

PR-URL: nodejs#40325 Fixes: nodejs#40305 Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Guy Bedford <guybedford@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Zeyu Yang <himself65@outlook.com>
aduh95 · Oct 22, 2021 · a33a1a3 · a33a1a3
1 parent ec3bd72
commit a33a1a3
Show file tree

Hide file tree

Showing 7 changed files with 19 additions and 5 deletions.
diff --git a/lib/internal/modules/esm/resolve.js b/lib/internal/modules/esm/resolve.js
@@ -278,7 +278,7 @@ function resolveDirectoryEntry(search) {
   return resolveExtensions(new URL('index', search));
 }
 
-const encodedSepRegEx = /%2F|%2C/i;
+const encodedSepRegEx = /%2F|%5C/i;
 function finalizeResolution(resolved, base) {
   if (RegExpPrototypeTest(encodedSepRegEx, resolved.pathname))
     throw new ERR_INVALID_MODULE_SPECIFIER(

diff --git a/test/es-module/test-esm-encoded-path.mjs b/test/es-module/test-esm-encoded-path.mjs
@@ -2,5 +2,8 @@ import '../common/index.mjs';
 import assert from 'assert';
 // ./test-esm-ok.mjs
 import ok from '../fixtures/es-modules/test-%65%73%6d-ok.mjs';
+// ./test-esm-comma,.mjs
+import comma from '../fixtures/es-modules/test-esm-comma%2c.mjs';
 
 assert(ok);
+assert(comma);
diff --git a/test/es-module/test-esm-exports.mjs b/test/es-module/test-esm-exports.mjs
@@ -176,10 +176,13 @@ import fromInside from '../fixtures/node_modules/pkgexports/lib/hole.js';
     }));
   }
 
-  // The use of %2F escapes in paths fails loading
+  // The use of %2F and %5C escapes in paths fails loading
   loadFixture('pkgexports/sub/..%2F..%2Fbar.js').catch(mustCall((err) => {
     strictEqual(err.code, 'ERR_INVALID_MODULE_SPECIFIER');
   }));
+  loadFixture('pkgexports/sub/..%5C..%5Cbar.js').catch(mustCall((err) => {
+    strictEqual(err.code, 'ERR_INVALID_MODULE_SPECIFIER');
+  }));
 
   // Package export with numeric index properties must throw a validation error
   loadFixture('pkgexports-numeric').catch(mustCall((err) => {

diff --git a/test/es-module/test-esm-imports.mjs b/test/es-module/test-esm-imports.mjs
@@ -55,13 +55,15 @@ const { requireImport, importImport } = importer;
     // Backtracking below the package base
     ['#subpath/sub/../../../belowbase', 'request is not a valid subpath'],
     // Percent-encoded slash errors
-    ['#external/subpath/x%2Fy', 'must not include encoded "/"'],
+    ['#external/subpath/x%2Fy', 'must not include encoded "/" or "\\"'],
+    ['#external/subpath/x%5Cy', 'must not include encoded "/" or "\\"'],
     // Target must have a name
     ['#', '#'],
     // Initial slash target must have a leading name
     ['#/initialslash', '#/initialslash'],
     // Percent-encoded target paths
-    ['#percent', 'must not include encoded "/"'],
+    ['#encodedslash', 'must not include encoded "/" or "\\"'],
+    ['#encodedbackslash', 'must not include encoded "/" or "\\"'],
   ]);
 
   for (const [specifier, expected] of invalidImportSpecifiers) {

diff --git a/test/es-module/test-esm-pkgname.mjs b/test/es-module/test-esm-pkgname.mjs
@@ -7,6 +7,10 @@ importFixture('as%2Ff').catch(mustCall((err) => {
   strictEqual(err.code, 'ERR_INVALID_MODULE_SPECIFIER');
 }));
 
+importFixture('as%5Cf').catch(mustCall((err) => {
+  strictEqual(err.code, 'ERR_INVALID_MODULE_SPECIFIER');
+}));
+
 importFixture('as\\df').catch(mustCall((err) => {
   strictEqual(err.code, 'ERR_INVALID_MODULE_SPECIFIER');
 }));

diff --git a/test/fixtures/es-modules/pkgimports/package.json b/test/fixtures/es-modules/pkgimports/package.json
@@ -26,6 +26,7 @@
     "#": "./test.js",
     "#/initialslash": "./test.js",
     "#notfound": "./notfound.js",
-    "#percent": "./..%2F/x.js"
+    "#encodedslash": "./..%2F/x.js",
+    "#encodedbackslash": "./..%5C/x.js"
   }
 }
diff --git a/test/fixtures/es-modules/test-esm-comma,.mjs b/test/fixtures/es-modules/test-esm-comma,.mjs
@@ -0,0 +1 @@
+export default ',';