worker: restrict supported extensions

lib/internal/errors.js

@@ -357,6 +357,8 @@ E('ERR_WORKER_NEED_ABSOLUTE_PATH',
 E('ERR_WORKER_OUT_OF_MEMORY', 'The worker script ran out of memory');
 E('ERR_WORKER_UNSERIALIZABLE_ERROR',
   'Serializing an uncaught exception failed');
+E('ERR_WORKER_UNSUPPORTED_EXTENSION',
+  'The worker script extension must be ".js" or ".mjs". Received "%s"');
 E('ERR_ZLIB_BINDING_CLOSED', 'zlib binding closed');
 
 function invalidArgType(name, expected, actual) {

lib/internal/worker.js

@@ -129,8 +129,14 @@ class Worker extends EventEmitter {
                                  'string', filename);
     }
 
-    if (!options.eval && !path.isAbsolute(filename)) {
-      throw new errors.TypeError('ERR_WORKER_NEED_ABSOLUTE_PATH', filename);
+    if (!options.eval) {
+      if (!path.isAbsolute(filename)) {
+        throw new errors.TypeError('ERR_WORKER_NEED_ABSOLUTE_PATH', filename);
+      }
+      const ext = path.extname(filename);
+      if (ext !== '.js' && ext !== '.mjs') {
+        throw new errors.TypeError('ERR_WORKER_UNSUPPORTED_EXTENSION', ext);
+      }
     }
 
     const resourceLimits = {

test/fixtures/worker-script.mjs

@@ -0,0 +1,3 @@
+import worker from 'worker';
+
+worker.postMessage('Hello, world!');

test/parallel/test-worker-esmodule.js

@@ -0,0 +1,11 @@
+'use strict';
+// Flags: --experimental-modules
+const common = require('../common');
+const fixtures = require('../common/fixtures');
+const assert = require('assert');
+const { Worker } = require('worker');
+
+const w = new Worker(fixtures.path('worker-script.mjs'));
+w.on('message', common.mustCall((message) => {
+  assert.strictEqual(message, 'Hello, world!');
+}));

test/parallel/test-worker-unsupported-path.js

@@ -0,0 +1,26 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { Worker } = require('worker');
+
+{
+  const expectedErr = common.expectsError({
+    code: 'ERR_WORKER_NEED_ABSOLUTE_PATH',
+    type: TypeError
+  }, 4);
+  assert.throws(() => { new Worker('a.js'); }, expectedErr);
+  assert.throws(() => { new Worker('b'); }, expectedErr);
+  assert.throws(() => { new Worker('c/d.js'); }, expectedErr);
+  assert.throws(() => { new Worker('a.mjs'); }, expectedErr);
+}
+
+{
+  const expectedErr = common.expectsError({
+    code: 'ERR_WORKER_UNSUPPORTED_EXTENSION',
+    type: TypeError
+  }, 3);
+  assert.throws(() => { new Worker('/b'); }, expectedErr);
+  assert.throws(() => { new Worker('/c.wasm'); }, expectedErr);
+  assert.throws(() => { new Worker('/d.txt'); }, expectedErr);
+}