sanitize URLs

hook.js

@@ -122,7 +122,7 @@ function createHook (meta) {
       return {
         source: `
 import { register } from '${iitmURL}'
-import * as namespace from '${url}'
+import * as namespace from ${JSON.stringify(url)}
 const set = {}
 ${exportNames.map((n) => `
 let $${n} = namespace.${n}
@@ -132,7 +132,7 @@ set.${n} = (v) => {
   return true
 }
 `).join('\n')}
-register('${realUrl}', namespace, set, '${specifiers.get(realUrl)}')
+register(${JSON.stringify(realUrl)}, namespace, set, ${JSON.stringify(specifiers.get(realUrl))})
 `
       }
     }

test/low-level/sanitized-url.mjs

@@ -0,0 +1,11 @@
+// Unless explicitly stated otherwise all files in this repository are licensed under the Apache 2.0 License.
+//
+// This product includes software developed at Datadog (https://www.datadoghq.com/). Copyright 2021 Datadog, Inc.
+
+import { addHook } from '../../index.js'
+
+addHook(() => {})
+
+;(async () => {
+  await import("../fixtures/something.mjs#*/'/*';eval('process.exit\x281\x29\x0A')")
+})()