◐ Shell
clean mode source ↗

worker: restrict supported extensions · nodejs/node@c97fb91

@@ -8,7 +8,8 @@ const util = require('util');

88

const {

99

ERR_INVALID_ARG_TYPE,

1010

ERR_WORKER_NEED_ABSOLUTE_PATH,

11-

ERR_WORKER_UNSERIALIZABLE_ERROR

11+

ERR_WORKER_UNSERIALIZABLE_ERROR,

12+

ERR_WORKER_UNSUPPORTED_EXTENSION,

1213

} = require('internal/errors').codes;

13141415

const { internalBinding } = require('internal/bootstrap/loaders');

@@ -136,8 +137,14 @@ class Worker extends EventEmitter {

136137

throw new ERR_INVALID_ARG_TYPE('filename', 'string', filename);

137138

}

138139139-

if (!options.eval && !path.isAbsolute(filename)) {

140-

throw new ERR_WORKER_NEED_ABSOLUTE_PATH(filename);

140+

if (!options.eval) {

141+

if (!path.isAbsolute(filename)) {

142+

throw new ERR_WORKER_NEED_ABSOLUTE_PATH(filename);

143+

}

144+

const ext = path.extname(filename);

145+

if (ext !== '.js' && ext !== '.mjs') {

146+

throw new ERR_WORKER_UNSUPPORTED_EXTENSION(ext);

147+

}

141148

}

142149143150

// Set up the C++ handle for the worker, as well as some internal wiring.