errors: remove input from ERR_INVALID_URL message

Avoid potentially huge messages and leaked secrets.
nodejs · May 12, 2021 · f7da77c · f7da77c
1 parent 7c8a608
commit f7da77c
Show file tree

Hide file tree

Showing 3 changed files with 14 additions and 10 deletions.
diff --git a/lib/internal/errors.js b/lib/internal/errors.js
@@ -1265,7 +1265,9 @@ E('ERR_INVALID_TUPLE', '%s must be an iterable %s tuple', TypeError);
 E('ERR_INVALID_URI', 'URI malformed', URIError);
 E('ERR_INVALID_URL', function(input) {
   this.input = input;
-  return `Invalid URL: ${input}`;
+  // Don't include URL in message.
+  // (See https://github.com/nodejs/node/pull/38614)
+  return 'Invalid URL';
 }, TypeError);
 E('ERR_INVALID_URL_SCHEME',
   (expected) => {

diff --git a/test/es-module/test-esm-loader-invalid-url.mjs b/test/es-module/test-esm-loader-invalid-url.mjs
@@ -3,8 +3,12 @@ import { expectsError, mustCall } from '../common/index.mjs';
 import assert from 'assert';
 
 import('../fixtures/es-modules/test-esm-ok.mjs')
-.then(assert.fail, expectsError({
-  code: 'ERR_INVALID_URL',
-  message: 'Invalid URL: ../fixtures/es-modules/test-esm-ok.mjs'
-}))
+.then(assert.fail, (error) => {
+  expectsError({
+    code: 'ERR_INVALID_URL',
+    message: 'Invalid URL'
+  })(error);
+
+  assert.strictEqual(error.input, '../fixtures/es-modules/test-esm-ok.mjs');
+})
 .then(mustCall());
diff --git a/test/parallel/test-whatwg-url-custom-parsing.js b/test/parallel/test-whatwg-url-custom-parsing.js
@@ -55,11 +55,9 @@ for (const test of failureTests) {
     () => new URL(test.input, test.base),
     (error) => {
       assert.throws(() => { throw error; }, expectedError);
-
-      // The input could be processed, so we don't do strict matching here
-      let match;
-      assert(match = (`${error}`).match(/Invalid URL: (.*)$/));
-      assert.strictEqual(error.input, match[1]);
+      assert.strictEqual(`${error}`, 'TypeError [ERR_INVALID_URL]: Invalid URL');
+      assert.strictEqual(error.message, 'Invalid URL');
+      assert.strictEqual(error.input, test.input);
       return true;
     });
 }