lib: fix MIME overmatch in data URLs

This commit adds the delimiters ^ and $ to the regex that matches the MIME types for "data:URLs". Fixes: #48957
nodejs · Aug 11, 2023 · fc3b4dc · fc3b4dc
1 parent 7f2c810
commit fc3b4dc
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 1 deletion.
diff --git a/lib/internal/modules/esm/formats.js b/lib/internal/modules/esm/formats.js
@@ -26,7 +26,7 @@ if (experimentalWasmModules) {
 function mimeToFormat(mime) {
   if (
     RegExpPrototypeExec(
-      /\s*(text|application)\/javascript\s*(;\s*charset=utf-?8\s*)?/i,
+      /^\s*(text|application)\/javascript\s*(;\s*charset=utf-?8\s*)?$/i,
       mime,
     ) !== null
   ) return 'module';

diff --git a/test/es-module/test-esm-invalid-data-urls.js b/test/es-module/test-esm-invalid-data-urls.js
@@ -18,4 +18,9 @@ const assert = require('assert');
     code: 'ERR_UNKNOWN_MODULE_FORMAT',
     message: 'Unknown module format: text/css for URL data:text/css,.error { color: red; }',
   });
+  await assert.rejects(import('data:WRONGtext/javascriptFORMAT,console.log("hello!");'), {
+    code: 'ERR_UNKNOWN_MODULE_FORMAT',
+    message: 'Unknown module format: WRONGtext/javascriptFORMAT for URL data:WRONGtext/javascriptFORMAT,\
+console.log("hello!");',
+  });
 })().then(common.mustCall());