From 269482f61fc52feec24235051bcbd3007fdf49c8 Mon Sep 17 00:00:00 2001
From: Yagiz Nizipli <yagiz@nizipli.com>
Date: Sat, 15 Apr 2023 10:51:32 -0400
Subject: [PATCH] esm: avoid accessing lazy getters for urls

PR-URL: https://github.com/nodejs/node/pull/47542
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 lib/internal/modules/esm/resolve.js | 40 ++++++++++++++++++-----------
 1 file changed, 25 insertions(+), 15 deletions(-)

diff --git a/lib/internal/modules/esm/resolve.js b/lib/internal/modules/esm/resolve.js
index 2ee5b0e23e0ba6..43cfdb61e8aa95 100644
--- a/lib/internal/modules/esm/resolve.js
+++ b/lib/internal/modules/esm/resolve.js
@@ -894,16 +894,20 @@ function resolveAsCommonJS(specifier, parentURL) {
 // TODO(@JakobJingleheimer): de-dupe `specifier` & `parsed`
 function checkIfDisallowedImport(specifier, parsed, parsedParentURL) {
   if (parsedParentURL) {
+    // Avoid accessing the `protocol` property due to the lazy getters.
+    const parentProtocol = parsedParentURL.protocol;
     if (
-      parsedParentURL.protocol === 'http:' ||
-      parsedParentURL.protocol === 'https:'
+      parentProtocol === 'http:' ||
+      parentProtocol === 'https:'
     ) {
       if (shouldBeTreatedAsRelativeOrAbsolutePath(specifier)) {
+        // Avoid accessing the `protocol` property due to the lazy getters.
+        const parsedProtocol = parsed?.protocol;
         // data: and blob: disallowed due to allowing file: access via
         // indirection
-        if (parsed &&
-          parsed.protocol !== 'https:' &&
-          parsed.protocol !== 'http:'
+        if (parsedProtocol &&
+          parsedProtocol !== 'https:' &&
+          parsedProtocol !== 'http:'
         ) {
           throw new ERR_NETWORK_IMPORT_DISALLOWED(
             specifier,
@@ -944,22 +948,26 @@ function throwIfInvalidParentURL(parentURL) {
 }
 
 function throwIfUnsupportedURLProtocol(url) {
-  if (url.protocol !== 'file:' && url.protocol !== 'data:' &&
-      url.protocol !== 'node:') {
+  // Avoid accessing the `protocol` property due to the lazy getters.
+  const protocol = url.protocol;
+  if (protocol !== 'file:' && protocol !== 'data:' &&
+      protocol !== 'node:') {
     throw new ERR_UNSUPPORTED_ESM_URL_SCHEME(url);
   }
 }
 
 function throwIfUnsupportedURLScheme(parsed, experimentalNetworkImports) {
+  // Avoid accessing the `protocol` property due to the lazy getters.
+  const protocol = parsed?.protocol;
   if (
-    parsed &&
-    parsed.protocol !== 'file:' &&
-    parsed.protocol !== 'data:' &&
+    protocol &&
+    protocol !== 'file:' &&
+    protocol !== 'data:' &&
     (
       !experimentalNetworkImports ||
       (
-        parsed.protocol !== 'https:' &&
-        parsed.protocol !== 'http:'
+        protocol !== 'https:' &&
+        protocol !== 'http:'
       )
     )
   ) {
@@ -1016,11 +1024,13 @@ function defaultResolve(specifier, context = {}) {
       parsed = new URL(specifier);
     }
 
-    if (parsed.protocol === 'data:' ||
+    // Avoid accessing the `protocol` property due to the lazy getters.
+    const protocol = parsed.protocol;
+    if (protocol === 'data:' ||
       (experimentalNetworkImports &&
         (
-          parsed.protocol === 'https:' ||
-          parsed.protocol === 'http:'
+          protocol === 'https:' ||
+          protocol === 'http:'
         )
       )
     ) {