lib: fix regular expression to detect / and \

Fixes #40305

PR-URL: #40325
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Guy Bedford <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Zeyu Yang <[email protected]>

Author: fasttime

lib/internal/modules/esm/resolve.js

@@ -380,7 +380,7 @@ function resolveDirectoryEntry(search) {
   return resolveExtensions(new URL('index', search));
 }
 
-const encodedSepRegEx = /%2F|%2C/i;
+const encodedSepRegEx = /%2F|%5C/i;
 /**
  * @param {URL} resolved
  * @param {string | URL | undefined} base

test/es-module/test-esm-encoded-path.mjs

@@ -2,5 +2,8 @@ import '../common/index.mjs';
 import assert from 'assert';
 // ./test-esm-ok.mjs
 import ok from '../fixtures/es-modules/test-%65%73%6d-ok.mjs';
+// ./test-esm-comma,.mjs
+import comma from '../fixtures/es-modules/test-esm-comma%2c.mjs';
 
 assert(ok);
+assert(comma);

test/es-module/test-esm-exports.mjs

@@ -184,10 +184,13 @@ import fromInside from '../fixtures/node_modules/pkgexports/lib/hole.js';
     }));
   }
 
-  // The use of %2F escapes in paths fails loading
+  // The use of %2F and %5C escapes in paths fails loading
   loadFixture('pkgexports/sub/..%2F..%2Fbar.js').catch(mustCall((err) => {
     strictEqual(err.code, 'ERR_INVALID_MODULE_SPECIFIER');
   }));
+  loadFixture('pkgexports/sub/..%5C..%5Cbar.js').catch(mustCall((err) => {
+    strictEqual(err.code, 'ERR_INVALID_MODULE_SPECIFIER');
+  }));
 
   // Package export with numeric index properties must throw a validation error
   loadFixture('pkgexports-numeric').catch(mustCall((err) => {

test/es-module/test-esm-imports.mjs

@@ -55,13 +55,15 @@ const { requireImport, importImport } = importer;
     // Backtracking below the package base
     ['#subpath/sub/../../../belowbase', 'request is not a valid subpath'],
     // Percent-encoded slash errors
-    ['#external/subpath/x%2Fy', 'must not include encoded "/"'],
+    ['#external/subpath/x%2Fy', 'must not include encoded "/" or "\\"'],
+    ['#external/subpath/x%5Cy', 'must not include encoded "/" or "\\"'],
     // Target must have a name
     ['#', '#'],
     // Initial slash target must have a leading name
     ['#/initialslash', '#/initialslash'],
     // Percent-encoded target paths
-    ['#percent', 'must not include encoded "/"'],
+    ['#encodedslash', 'must not include encoded "/" or "\\"'],
+    ['#encodedbackslash', 'must not include encoded "/" or "\\"'],
   ]);
 
   for (const [specifier, expected] of invalidImportSpecifiers) {

test/es-module/test-esm-pkgname.mjs

@@ -7,6 +7,10 @@ importFixture('as%2Ff').catch(mustCall((err) => {
   strictEqual(err.code, 'ERR_INVALID_MODULE_SPECIFIER');
 }));
 
+importFixture('as%5Cf').catch(mustCall((err) => {
+  strictEqual(err.code, 'ERR_INVALID_MODULE_SPECIFIER');
+}));
+
 importFixture('as\\df').catch(mustCall((err) => {
   strictEqual(err.code, 'ERR_INVALID_MODULE_SPECIFIER');
 }));

test/fixtures/es-modules/pkgimports/package.json

@@ -26,6 +26,7 @@
     "#": "./test.js",
     "#/initialslash": "./test.js",
     "#notfound": "./notfound.js",
-    "#percent": "./..%2F/x.js"
+    "#encodedslash": "./..%2F/x.js",
+    "#encodedbackslash": "./..%5C/x.js"
   }
 }

test/fixtures/es-modules/test-esm-comma,.mjs

@@ -0,0 +1 @@
+export default ',';