esm: validate custom loader url

lib/internal/modules/esm/loader.js

@@ -3,9 +3,11 @@
 const {
   ERR_INVALID_ARG_TYPE,
   ERR_INVALID_PROTOCOL,
+  ERR_INVALID_URL,
   ERR_MISSING_DYNAMIC_INTSTANTIATE_HOOK,
   ERR_UNKNOWN_MODULE_FORMAT
 } = require('internal/errors').codes;
+const { URL } = require('url');
 const ModuleMap = require('internal/modules/esm/module_map');
 const ModuleJob = require('internal/modules/esm/module_job');
 const defaultResolve = require('internal/modules/esm/default_resolve');
@@ -64,6 +66,14 @@ class Loader {
     if (format === 'builtin')
       return { url: `node:${url}`, format };
 
+    if (this._resolve !== defaultResolve) {
+      try {
+        new URL(url);
+      } catch (err) {
+        throw new ERR_INVALID_URL(url);
+      }
+    }
+
     if (format !== 'dynamic' && !url.startsWith('file:'))
       throw new ERR_INVALID_PROTOCOL(url, 'file:');
 

test/es-module/test-esm-loader-invalid-url.mjs

@@ -0,0 +1,10 @@
+// Flags: --experimental-modules --loader ./test/fixtures/es-module-loaders/loader-invalid-url.mjs
+/* eslint-disable node-core/required-modules */
+import assert from 'assert';
+
+import('../fixtures/es-modules/test-esm-ok.mjs')
+.then(() => {
+  assert.fail();
+}, (err) => {
+  assert.strictEqual(err.code, 'ERR_INVALID_URL');
+});

test/fixtures/es-module-loaders/loader-invalid-url.mjs

@@ -0,0 +1,8 @@
+export async function resolve(specifier, parentModuleURL, defaultResolve) {
+  if (parentModuleURL && specifier !== 'assert')
+    return {
+      url: specifier,
+      format: 'esm'
+    };
+  return defaultResolve(specifier, parentModuleURL);
+}