1import { mustCall, spawnPromisified } from '../common/index.mjs';
2import { ok, match, notStrictEqual } from 'node:assert';
3import { spawn as spawnAsync } from 'node:child_process';
4import { execPath } from 'node:process';
5import { describe, it } from 'node:test';
6
7
8describe('ESM: http import via CLI', { concurrency: true }, () => {
9  const disallowedSpecifier = 'http://example.com';
10
11  it('should throw disallowed error for insecure protocol', async () => {
12    const { code, stderr } = await spawnPromisified(execPath, [
13      '--experimental-network-imports',
14      '--input-type=module',
15      '--eval',
16      `import ${JSON.stringify(disallowedSpecifier)}`,
17    ]);
18
19    notStrictEqual(code, 0);
20
21    // [ERR_NETWORK_IMPORT_DISALLOWED]: import of 'http://example.com/' by
22    //   …/[eval1] is not supported: http can only be used to load local
23    // resources (use https instead).
24    match(stderr, /ERR_NETWORK_IMPORT_DISALLOWED/);
25    ok(stderr.includes(disallowedSpecifier));
26  });
27
28  it('should throw disallowed error for insecure protocol in REPL', () => {
29    const child = spawnAsync(execPath, [
30      '--experimental-network-imports',
31      '--input-type=module',
32    ]);
33    child.stdin.end(`import ${JSON.stringify(disallowedSpecifier)}`);
34
35    let stderr = '';
36    child.stderr.setEncoding('utf8');
37    child.stderr.on('data', (data) => stderr += data);
38    child.on('close', mustCall((code, _signal) => {
39      notStrictEqual(code, 0);
40
41      // [ERR_NETWORK_IMPORT_DISALLOWED]: import of 'http://example.com/' by
42      //   …/[stdin] is not supported: http can only be used to load local
43      // resources (use https instead).
44      match(stderr, /\[ERR_NETWORK_IMPORT_DISALLOWED\]/);
45      ok(stderr.includes(disallowedSpecifier));
46    }));
47  });
48});
49