createDynamicModule() properly escapes import names, but not export
names. In WebAssembly, any string is a valid export name. Importing a
WebAssembly module that uses a non-identifier export name leads to
either a syntax error in createDynamicModule() or to code injection,
that is, to the evaluation of almost arbitrary JavaScript code outside
of the WebAssembly module.
To address this issue, adopt the same mechanism in createExport() that
createImport() already uses. Add tests for both exports and imports.
PR-URL: https://github.com/nodejs-private/node-private/pull/461
Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/489
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2023-39333
doc: update ESM hook examples
esm: fix unsafe primordial
doc: fix ESM example linting
esm: allow source of type ArrayBuffer
doc: update ESM hook changelog to include resolve format
esm: allow all ArrayBuffers and TypedArrays for load hook source
doc: tidy code & API docs
doc: convert ESM source table header from Title Case to Sentence case
doc: add detailed explanation for getPackageType
esm: add caveat that ESMLoader::import() must NOT be renamed
esm: tidy code declaration of getFormat protocolHandlers
doc: correct ESM doc link (bad conflict resolution)
doc: update ESM hook limitation for CJS
esm: tweak preload description
doc: update ESM getPackageType() example explanation
PR-URL: https://github.com/nodejs/node/pull/37468
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Guy Bedford <guybedford@gmail.com>
Reviewed-By: Bradley Farias <bradley.meck@gmail.com>
Reviewed-By: Geoffrey Booth <webmaster@geoffreybooth.com>
The node process crashes when trying to parse a multiline import
statement for named exports of a CommonJS module:
TypeError: Cannot read property '0' of null
at ModuleJob._instantiate (internal/modules/esm/module_job.js:112:77)
at async ModuleJob.run (internal/modules/esm/module_job.js:137:5)
at async Loader.import (internal/modules/esm/loader.js:165:24)
at async rejects.name (file:///***/node/test/es-module/test-esm-cjs-named-error.mjs:56:3)
at async waitForActual (assert.js:721:5)
at async rejects (assert.js:830:25),
The reason is that the regexp that is currently used to decorate the
original error fails for multi line import statements.
Unfortunately the undecorated error stack only contains the single line
which causes the import to fail:
file:///***/node/test/fixtures/es-modules/package-cjs-named-error/multi-line.mjs:2
comeOn,
^^^^^^
SyntaxError: The requested module './fail.cjs' does not provide an export named 'comeOn'
at ModuleJob._instantiate (internal/modules/esm/module_job.js:98:21)
at async ModuleJob.run (internal/modules/esm/module_job.js:141:5)
at async Loader.import (internal/modules/esm/loader.js:165:24)
at async rejects.name (file:///***/node/test/es-module/test-esm-cjs-named-error.mjs:56:3)
at async waitForActual (assert.js:721:5)
at async rejects (assert.js:830:25)
Hence, for multiline import statements we cannot create an equivalent
piece of code that uses default import followed by an object
destructuring assignment.
In any case the node process should definitely not crash. So until we
have a more sophisticated way of extracting the entire problematic
multiline import statement, show the code example only for single-line
imports where the current regexp approach works well.
Refs: https://github.com/nodejs/node/issues/35259
PR-URL: https://github.com/nodejs/node/pull/35275
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Handle situations in which the main `Promise` from a TLA module
is not fulfilled better:
- When not resolving the `Promise` at all, set a non-zero exit code
(unless another one has been requested explicitly) to distinguish
the result from a successful completion.
- When rejecting the `Promise`, always treat it like an uncaught
exception. In particular, this also ensures a non-zero exit code.
Refs: https://github.com/nodejs/node/pull/34558
PR-URL: https://github.com/nodejs/node/pull/34640
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Guy Bedford <guybedford@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Yongsheng Zhang <zyszys98@gmail.com>
When importing specific names from a CJS module, and renaming them using
`as`, the example fix in the error message erroneously contains the
keyword `as` in the destructuring variable declaration.
Example of this issue:
import { parse as acornParse } from "acorn";
^^^^^
SyntaxError: The requested module 'acorn' is expected to be of type CommonJS, which does not support named exports. CommonJS modules can be imported by importing the default export.
For example:
import pkg from 'acorn';
const { parse as acornParse } = pkg;
PR-URL: https://github.com/nodejs/node/pull/33882
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Guy Bedford <guybedford@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
We do not support importing named exports from a CJS module.
This change decorates the error message for missing named exports in
the case where the module being imported is expected to be CJS by the
ESM loader.
Signed-off-by: Myles Borins <myles.borins@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/33256
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Michaël Zasso