MIME type overmatch in data URLs

Version

v20.5.0

Platform

Linux host 5.19.0-45-generic #46-Ubuntu SMP PREEMPT_DYNAMIC Wed Jun 7 09:08:58 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

Subsystem

modules

What steps will reproduce the bug?

Execute this command.

node --input-type=module --eval 'import "data:ONCEUPONAtext/javascriptTHEREWASASNEAKYMODULE,console.log(\"EVALUATED\")"'

The incorrectly typed inline module is evaluated. The string is logged to the console.

EVALUATED

How often does it reproduce? Is there a required condition?

Consistently.

What is the expected behavior? Why is that the expected behavior?

An incorrect MIME type is forbidden.

What do you see instead?

The module is evaluated.

Additional information

formats.js has a regex matching the MIME type.

/\s*(text|application)\/javascript\s*(;\s*charset=utf-?8\s*)?/i

This will match any MIME type that contains (text|application)/javascript anywhere. It maybe needs start and end anchors.

[aduh95]

Good catch. FYI if you paste a "Permalink URL", it will show the line(s) of code:

node/lib/internal/modules/esm/formats.js

Line 29 in fe514bf

/\s*(text|application)\/javascript\s*(;\s*charset=utf-?8\s*)?/i,

Would you like to send a PR to fix this?

No thanks, I won't be able to get to this.

[ntedgi]

@aduh95 i will be happy to help with this bug

[lzcampos]

@aduh95 i will be happy to help with this bug

I would be glad helping with this, too. Feel free to reach me if you want to.

[Xstoudi]

I started working on it, but I'm figuring out that the MIME type may be wrong overall.

The current regexp also allow application/javascript while the doc clearly indicate that only text/javascript is valid: https://nodejs.org/api/esm.html#data-imports

As https://datatracker.ietf.org/doc/html/rfc9239 stands that text/javascript is now common and application/javascript is obsolete and the PR was made when it wasn't the case, I'll submit a PR changing that to get comment about this specific point.

[andremralves]

As the previous PR got closed and it seems that nobody is currently working on this issue I would like to submit a PR :)

Edit: The change is pretty simple, I'm now creating a test case.