Skip to content

Commit d76edeb

Browse files
committed
lib,src: drop --experimental-network-imports
1 parent 24648b5 commit d76edeb

File tree

10 files changed

+3
-219
lines changed

10 files changed

+3
-219
lines changed

doc/api/cli.md

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -986,18 +986,6 @@ changes:
986986
Specify the `module` containing exported [module customization hooks][].
987987
`module` may be any string accepted as an [`import` specifier][].
988988

989-
### `--experimental-network-imports`
990-
991-
<!-- YAML
992-
added:
993-
- v17.6.0
994-
- v16.15.0
995-
-->
996-
997-
> Stability: 1 - Experimental
998-
999-
Enable experimental support for the `https:` protocol in `import` specifiers.
1000-
1001989
### `--experimental-permission`
1002990

1003991
<!-- YAML
@@ -2854,7 +2842,6 @@ one is included in the list below.
28542842
* `--experimental-json-modules`
28552843
* `--experimental-loader`
28562844
* `--experimental-modules`
2857-
* `--experimental-network-imports`
28582845
* `--experimental-permission`
28592846
* `--experimental-print-required-tla`
28602847
* `--experimental-require-module`

doc/api/errors.md

Lines changed: 0 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -3583,23 +3583,6 @@ removed: v10.0.0
35833583

35843584
Used by the `Node-API` when `Constructor.prototype` is not an object.
35853585

3586-
<a id="ERR_NETWORK_IMPORT_BAD_RESPONSE"></a>
3587-
3588-
### `ERR_NETWORK_IMPORT_BAD_RESPONSE`
3589-
3590-
> Stability: 1 - Experimental
3591-
3592-
Response was received but was invalid when importing a module over the network.
3593-
3594-
<a id="ERR_NETWORK_IMPORT_DISALLOWED"></a>
3595-
3596-
### `ERR_NETWORK_IMPORT_DISALLOWED`
3597-
3598-
> Stability: 1 - Experimental
3599-
3600-
A network module attempted to load another module that it is not allowed to
3601-
load. Likely this restriction is for security reasons.
3602-
36033586
<a id="ERR_NO_LONGER_SUPPORTED"></a>
36043587

36053588
### `ERR_NO_LONGER_SUPPORTED`

doc/api/esm.md

Lines changed: 1 addition & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -697,71 +697,6 @@ spawn(execPath, [
697697
});
698698
```
699699
700-
## HTTPS and HTTP imports
701-
702-
> Stability: 1 - Experimental
703-
704-
Importing network based modules using `https:` and `http:` is supported under
705-
the `--experimental-network-imports` flag. This allows web browser-like imports
706-
to work in Node.js with a few differences due to application stability and
707-
security concerns that are different when running in a privileged environment
708-
instead of a browser sandbox.
709-
710-
### Imports are limited to HTTP/1
711-
712-
Automatic protocol negotiation for HTTP/2 and HTTP/3 is not yet supported.
713-
714-
### HTTP is limited to loopback addresses
715-
716-
`http:` is vulnerable to man-in-the-middle attacks and is not allowed to be
717-
used for addresses outside of the IPv4 address `127.0.0.0/8` (`127.0.0.1` to
718-
`127.255.255.255`) and the IPv6 address `::1`. Support for `http:` is intended
719-
to be used for local development.
720-
721-
### Authentication is never sent to the destination server.
722-
723-
`Authorization`, `Cookie`, and `Proxy-Authorization` headers are not sent to the
724-
server. Avoid including user info in parts of imported URLs. A security model
725-
for safely using these on the server is being worked on.
726-
727-
### CORS is never checked on the destination server
728-
729-
CORS is designed to allow a server to limit the consumers of an API to a
730-
specific set of hosts. This is not supported as it does not make sense for a
731-
server-based implementation.
732-
733-
### Cannot load non-network dependencies
734-
735-
These modules cannot access other modules that are not over `http:` or `https:`.
736-
To still access local modules while avoiding the security concern, pass in
737-
references to the local dependencies:
738-
739-
```mjs
740-
// file.mjs
741-
import worker_threads from 'node:worker_threads';
742-
import { configure, resize } from 'https://example.com/imagelib.mjs';
743-
configure({ worker_threads });
744-
```
745-
746-
```mjs
747-
// https://example.com/imagelib.mjs
748-
let worker_threads;
749-
export function configure(opts) {
750-
worker_threads = opts.worker_threads;
751-
}
752-
export function resize(img, size) {
753-
// Perform resizing in worker_thread to avoid main thread blocking
754-
}
755-
```
756-
757-
### Network-based loading is not enabled by default
758-
759-
For now, the `--experimental-network-imports` flag is required to enable loading
760-
resources over `http:` or `https:`. In the future, a different mechanism will be
761-
used to enforce this. Opt-in is required to prevent transitive dependencies
762-
inadvertently using potentially mutable state that could affect reliability
763-
of Node.js applications.
764-
765700
<i id="esm_experimental_loaders"></i>
766701
767702
## Loaders
@@ -804,8 +739,7 @@ does not determine whether the resolved URL protocol can be loaded,
804739
or whether the file extensions are permitted, instead these validations
805740
are applied by Node.js during the load phase
806741
(for example, if it was asked to load a URL that has a protocol that is
807-
not `file:`, `data:`, `node:`, or if `--experimental-network-imports`
808-
is enabled, `https:`).
742+
not `file:`, `data:` or `node:`.
809743
810744
The algorithm also tries to determine the format of the file based
811745
on the extension (see `ESM_FILE_FORMAT` algorithm below). If it does

doc/node.1

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -173,9 +173,6 @@ Specify the
173173
.Ar module
174174
to use as a custom module loader.
175175
.
176-
.It Fl -experimental-network-imports
177-
Enable experimental support for loading modules using `import` over `https:`.
178-
.
179176
.It Fl -experimental-permission
180177
Enable the experimental permission model.
181178
.

lib/internal/errors.js

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1591,10 +1591,6 @@ E('ERR_NAPI_INVALID_TYPEDARRAY_ALIGNMENT',
15911591
'start offset of %s should be a multiple of %s', RangeError);
15921592
E('ERR_NAPI_INVALID_TYPEDARRAY_LENGTH',
15931593
'Invalid typed array length', RangeError);
1594-
E('ERR_NETWORK_IMPORT_BAD_RESPONSE',
1595-
"import '%s' received a bad response: %s", Error);
1596-
E('ERR_NETWORK_IMPORT_DISALLOWED',
1597-
"import of '%s' by %s is not supported: %s", Error);
15981594
E('ERR_NOT_BUILDING_SNAPSHOT',
15991595
'Operation cannot be invoked when not building startup snapshot', Error);
16001596
E('ERR_NOT_IN_SINGLE_EXECUTABLE_APPLICATION',

lib/internal/modules/esm/get_format.js

Lines changed: 0 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,6 @@
22

33
const {
44
ObjectPrototypeHasOwnProperty,
5-
PromisePrototypeThen,
6-
PromiseResolve,
75
RegExpPrototypeExec,
86
SafeSet,
97
StringPrototypeCharCodeAt,
@@ -17,8 +15,6 @@ const {
1715
mimeToFormat,
1816
} = require('internal/modules/esm/formats');
1917

20-
const experimentalNetworkImports =
21-
getOptionValue('--experimental-network-imports');
2218
const { containsModuleSyntax } = internalBinding('contextify');
2319
const { getPackageScopeConfig, getPackageType } = require('internal/modules/package_json_reader');
2420
const { fileURLToPath } = require('internal/url');
@@ -28,8 +24,6 @@ const protocolHandlers = {
2824
'__proto__': null,
2925
'data:': getDataProtocolModuleFormat,
3026
'file:': getFileProtocolModuleFormat,
31-
'http:': getHttpProtocolModuleFormat,
32-
'https:': getHttpProtocolModuleFormat,
3327
'node:'() { return 'builtin'; },
3428
};
3529

@@ -176,23 +170,6 @@ function getFileProtocolModuleFormat(url, context = { __proto__: null }, ignoreE
176170
throw new ERR_UNKNOWN_FILE_EXTENSION(ext, filepath);
177171
}
178172

179-
/**
180-
* @param {URL} url
181-
* @param {{parentURL: string}} context
182-
* @returns {Promise<string> | undefined} only works when enabled
183-
*/
184-
function getHttpProtocolModuleFormat(url, context) {
185-
if (experimentalNetworkImports) {
186-
const { fetchModule } = require('internal/modules/esm/fetch_module');
187-
return PromisePrototypeThen(
188-
PromiseResolve(fetchModule(url, context)),
189-
(entry) => {
190-
return mimeToFormat(entry.headers['content-type']);
191-
},
192-
);
193-
}
194-
}
195-
196173
/**
197174
* @param {URL} url
198175
* @param {{parentURL: string}} context

lib/internal/modules/esm/resolve.js

Lines changed: 2 additions & 86 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,6 @@ const { getOptionValue } = require('internal/options');
3030
const { sep, posix: { relative: relativePosixPath }, resolve } = require('path');
3131
const preserveSymlinks = getOptionValue('--preserve-symlinks');
3232
const preserveSymlinksMain = getOptionValue('--preserve-symlinks-main');
33-
const experimentalNetworkImports =
34-
getOptionValue('--experimental-network-imports');
3533
const inputTypeFlag = getOptionValue('--input-type');
3634
const { URL, pathToFileURL, fileURLToPath, isURL, URLParse } = require('internal/url');
3735
const { getCWDURL, setOwnProperty } = require('internal/util');
@@ -48,7 +46,6 @@ const {
4846
ERR_PACKAGE_PATH_NOT_EXPORTED,
4947
ERR_UNSUPPORTED_DIR_IMPORT,
5048
ERR_UNSUPPORTED_RESOLVE_REQUEST,
51-
ERR_NETWORK_IMPORT_DISALLOWED,
5249
} = require('internal/errors').codes;
5350

5451
const { Module: CJSModule } = require('internal/modules/cjs/loader');
@@ -886,10 +883,6 @@ function moduleResolve(specifier, base, conditions, preserveSymlinks) {
886883
StringPrototypeSlice(base, 0, StringPrototypeIndexOf(base, ':') + 1) :
887884
base.protocol;
888885
const isData = protocol === 'data:';
889-
const isRemote =
890-
isData ||
891-
protocol === 'http:' ||
892-
protocol === 'https:';
893886
// Order swapped from spec for minor perf gain.
894887
// Ok since relative URLs cannot parse as URLs.
895888
let resolved;
@@ -907,7 +900,7 @@ function moduleResolve(specifier, base, conditions, preserveSymlinks) {
907900
try {
908901
resolved = new URL(specifier);
909902
} catch (cause) {
910-
if (isRemote && !BuiltinModule.canBeRequiredWithoutScheme(specifier)) {
903+
if (isData && !BuiltinModule.canBeRequiredWithoutScheme(specifier)) {
911904
const error = new ERR_UNSUPPORTED_RESOLVE_REQUEST(specifier, base);
912905
setOwnProperty(error, 'cause', cause);
913906
throw error;
@@ -976,57 +969,6 @@ function resolveAsCommonJS(specifier, parentURL) {
976969
}
977970
}
978971

979-
/**
980-
* Throw an error if an import is not allowed.
981-
* TODO(@JakobJingleheimer): de-dupe `specifier` & `parsed`
982-
* @param {string} specifier - The import specifier.
983-
* @param {URL} parsed - The parsed URL of the import specifier.
984-
* @param {URL} parsedParentURL - The parsed URL of the parent module.
985-
* @throws {ERR_NETWORK_IMPORT_DISALLOWED} - If the import is disallowed.
986-
*/
987-
function checkIfDisallowedImport(specifier, parsed, parsedParentURL) {
988-
if (parsedParentURL) {
989-
// Avoid accessing the `protocol` property due to the lazy getters.
990-
const parentProtocol = parsedParentURL.protocol;
991-
if (
992-
parentProtocol === 'http:' ||
993-
parentProtocol === 'https:'
994-
) {
995-
if (shouldBeTreatedAsRelativeOrAbsolutePath(specifier)) {
996-
// Avoid accessing the `protocol` property due to the lazy getters.
997-
const parsedProtocol = parsed?.protocol;
998-
// data: and blob: disallowed due to allowing file: access via
999-
// indirection
1000-
if (parsedProtocol &&
1001-
parsedProtocol !== 'https:' &&
1002-
parsedProtocol !== 'http:'
1003-
) {
1004-
throw new ERR_NETWORK_IMPORT_DISALLOWED(
1005-
specifier,
1006-
parsedParentURL,
1007-
'remote imports cannot import from a local location.',
1008-
);
1009-
}
1010-
1011-
return { url: parsed.href };
1012-
}
1013-
if (BuiltinModule.canBeRequiredWithoutScheme(specifier)) {
1014-
throw new ERR_NETWORK_IMPORT_DISALLOWED(
1015-
specifier,
1016-
parsedParentURL,
1017-
'remote imports cannot import from a local location.',
1018-
);
1019-
}
1020-
1021-
throw new ERR_NETWORK_IMPORT_DISALLOWED(
1022-
specifier,
1023-
parsedParentURL,
1024-
'only relative and absolute specifiers are supported.',
1025-
);
1026-
}
1027-
}
1028-
}
1029-
1030972
/**
1031973
* Validate user-input in `context` supplied by a custom loader.
1032974
* @param {string | URL | undefined} parentURL - The parent URL.
@@ -1068,36 +1010,10 @@ function defaultResolve(specifier, context = {}) {
10681010
// Avoid accessing the `protocol` property due to the lazy getters.
10691011
protocol = parsed.protocol;
10701012

1071-
if (protocol === 'data:' &&
1072-
parsedParentURL.protocol !== 'file:' &&
1073-
experimentalNetworkImports) {
1074-
throw new ERR_NETWORK_IMPORT_DISALLOWED(
1075-
specifier,
1076-
parsedParentURL,
1077-
'import data: from a non file: is not allowed',
1078-
);
1079-
}
1080-
if (protocol === 'data:' ||
1081-
(experimentalNetworkImports &&
1082-
(
1083-
protocol === 'https:' ||
1084-
protocol === 'http:'
1085-
)
1086-
)
1087-
) {
1013+
if (protocol === 'data:' ) {
10881014
return { __proto__: null, url: parsed.href };
10891015
}
10901016
}
1091-
// There are multiple deep branches that can either throw or return; instead
1092-
// of duplicating that deeply nested logic for the possible returns, DRY and
1093-
// check for a return. This seems the least gnarly.
1094-
const maybeReturn = checkIfDisallowedImport(
1095-
specifier,
1096-
parsed,
1097-
parsedParentURL,
1098-
);
1099-
1100-
if (maybeReturn) { return maybeReturn; }
11011017

11021018
// This must come after checkIfDisallowedImport
11031019
protocol ??= parsed?.protocol;

src/node_options.cc

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -435,10 +435,6 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
435435
kAllowedInEnvvar);
436436
AddAlias("--loader", "--experimental-loader");
437437
AddOption("--experimental-modules", "", NoOp{}, kAllowedInEnvvar);
438-
AddOption("--experimental-network-imports",
439-
"experimental https: support for the ES Module loader",
440-
&EnvironmentOptions::experimental_https_modules,
441-
kAllowedInEnvvar);
442438
AddOption("--experimental-wasm-modules",
443439
"experimental ES Module support for webassembly modules",
444440
&EnvironmentOptions::experimental_wasm_modules,

src/node_options.h

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -123,7 +123,6 @@ class EnvironmentOptions : public Options {
123123
std::string localstorage_file;
124124
bool experimental_global_navigator = true;
125125
bool experimental_global_web_crypto = true;
126-
bool experimental_https_modules = false;
127126
bool experimental_wasm_modules = false;
128127
bool experimental_import_meta_resolve = false;
129128
std::string input_type; // Value of --input-type

test/fixtures/es-modules/network-import.mjs

Lines changed: 0 additions & 1 deletion
This file was deleted.

0 commit comments

Comments
 (0)