From dcf1a48abbae80c7df10e47e2886ffd737741dfb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C3=ABl=20Zasso?= <targos@protonmail.com>
Date: Tue, 9 Jul 2024 11:26:55 +0200
Subject: [PATCH] esm: do not truncate `data:` URLs for evaluation

Fixes: https://github.com/nodejs/node/issues/53775
---
 lib/internal/modules/esm/load.js     | 4 ++--
 test/es-module/test-esm-data-urls.js | 5 +++++
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/lib/internal/modules/esm/load.js b/lib/internal/modules/esm/load.js
index 1ca6495c84a029..340213a3828c84 100644
--- a/lib/internal/modules/esm/load.js
+++ b/lib/internal/modules/esm/load.js
@@ -41,7 +41,7 @@ async function getSource(url, context) {
     const { readFile: readFileAsync } = require('internal/fs/promises').exports;
     source = await readFileAsync(url);
   } else if (protocol === 'data:') {
-    const match = RegExpPrototypeExec(DATA_URL_PATTERN, url.pathname);
+    const match = RegExpPrototypeExec(DATA_URL_PATTERN, href);
     if (!match) {
       throw new ERR_INVALID_URL(responseURL);
     }
@@ -77,7 +77,7 @@ function getSourceSync(url, context) {
   if (protocol === 'file:') {
     source = readFileSync(url);
   } else if (protocol === 'data:') {
-    const match = RegExpPrototypeExec(DATA_URL_PATTERN, url.pathname);
+    const match = RegExpPrototypeExec(DATA_URL_PATTERN, href);
     if (!match) {
       throw new ERR_INVALID_URL(responseURL);
     }
diff --git a/test/es-module/test-esm-data-urls.js b/test/es-module/test-esm-data-urls.js
index 0817cf179df340..03fd0474aff682 100644
--- a/test/es-module/test-esm-data-urls.js
+++ b/test/es-module/test-esm-data-urls.js
@@ -112,4 +112,9 @@ function createBase64URL(mime, body) {
     const plainESMURL = `data:text/javascript,${encodeURIComponent(`import ${JSON.stringify(fixtures.fileURL('es-module-url', 'empty.js'))}`)}`;
     await import(plainESMURL);
   }
+  {
+    const urlWithUnescapedQueryAndHash = 'data:text/javascript,export const value="?query#hash";'
+    const { value } = await import(urlWithUnescapedQueryAndHash);
+    assert.strictEqual(value, '?query#hash');
+  }
 })().then(common.mustCall());