module: ensure 'node:'-only modules can access node_modules

This commit allows require() and import to search the
node_modules directories when importing a core module that
must have the node: scheme. This prevents these core modules
from shadowing userland modules with the same name but no
prefix.

PR-URL: https://github.com/nodejs/node/pull/42430
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Beth Griggs <bgriggs@redhat.com>
Reviewed-By: Richard Lau <rlau@redhat.com>

3 files changed, 14 insertions, 16 deletions

diff --git a/lib/internal/modules/cjs/loader.js b/lib/internal/modules/cjs/loader.js
index 3fd1aa3404f..de919e7406b 100644
--- a/lib/internal/modules/cjs/loader.js
+++ b/lib/internal/modules/cjs/loader.js
@@ -666,7 +666,8 @@ if (isWindows) {
 }
 
 Module._resolveLookupPaths = function(request, parent) {
-  if (NativeModule.canBeRequiredByUsers(request)) {
+  if (NativeModule.canBeRequiredByUsers(request) &&
+      NativeModule.canBeRequiredWithoutScheme(request)) {
     debug('looking for %j in []', request);
     return null;
   }
@@ -803,11 +804,8 @@ Module._load = function(request, parent, isMain) {
   }
 
   const mod = loadNativeModule(filename, request);
-  if (mod?.canBeRequiredByUsers) {
-    if (!NativeModule.canBeRequiredWithoutScheme(filename)) {
-      throw new ERR_UNKNOWN_BUILTIN_MODULE(filename);
-    }
-
+  if (mod?.canBeRequiredByUsers &&
+      NativeModule.canBeRequiredWithoutScheme(filename)) {
     return mod.exports;
   }
 
@@ -854,7 +852,8 @@ Module._load = function(request, parent, isMain) {
 
 Module._resolveFilename = function(request, parent, isMain, options) {
   if (StringPrototypeStartsWith(request, 'node:') ||
-      NativeModule.canBeRequiredByUsers(request)) {
+      (NativeModule.canBeRequiredByUsers(request) &&
+      NativeModule.canBeRequiredWithoutScheme(request))) {
     return request;
   }
 
@@ -1286,7 +1285,8 @@ Module._preloadModules = function(requests) {
 
 Module.syncBuiltinESMExports = function syncBuiltinESMExports() {
   for (const mod of NativeModule.map.values()) {
-    if (mod.canBeRequiredByUsers) {
+    if (mod.canBeRequiredByUsers &&
+        NativeModule.canBeRequiredWithoutScheme(mod.id)) {
       mod.syncExports();
     }
   }
diff --git a/lib/internal/modules/esm/loader.js b/lib/internal/modules/esm/loader.js
index 0dccfebbd4f..39f8ebca59e 100644
--- a/lib/internal/modules/esm/loader.js
+++ b/lib/internal/modules/esm/loader.js
@@ -534,7 +534,8 @@ class ESMLoader {
           globalThis,
           // Param getBuiltin
           (builtinName) => {
-            if (NativeModule.canBeRequiredByUsers(builtinName)) {
+            if (NativeModule.canBeRequiredByUsers(builtinName) &&
+                NativeModule.canBeRequiredWithoutScheme(builtinName)) {
               return require(builtinName);
             }
             throw new ERR_INVALID_ARG_VALUE('builtinName', builtinName);
diff --git a/lib/internal/modules/esm/resolve.js b/lib/internal/modules/esm/resolve.js
index e640947450c..f1298e58dc4 100644
--- a/lib/internal/modules/esm/resolve.js
+++ b/lib/internal/modules/esm/resolve.js
@@ -57,7 +57,6 @@ const {
   ERR_PACKAGE_PATH_NOT_EXPORTED,
   ERR_UNSUPPORTED_DIR_IMPORT,
   ERR_NETWORK_IMPORT_DISALLOWED,
-  ERR_UNKNOWN_BUILTIN_MODULE,
   ERR_UNSUPPORTED_ESM_URL_SCHEME,
 } = require('internal/errors').codes;
 const { Module: CJSModule } = require('internal/modules/cjs/loader');
@@ -853,11 +852,8 @@ function parsePackageName(specifier, base) {
  * @returns {resolved: URL, format? : string}
  */
 function packageResolve(specifier, base, conditions) {
-  if (NativeModule.canBeRequiredByUsers(specifier)) {
-    if (!NativeModule.canBeRequiredWithoutScheme(specifier)) {
-      throw new ERR_UNKNOWN_BUILTIN_MODULE(specifier);
-    }
-
+  if (NativeModule.canBeRequiredByUsers(specifier) &&
+      NativeModule.canBeRequiredWithoutScheme(specifier)) {
     return new URL('node:' + specifier);
   }
 
@@ -1041,7 +1037,8 @@ function checkIfDisallowedImport(specifier, parsed, parsedParentURL) {
 
         return { url: parsed.href };
       }
-      if (NativeModule.canBeRequiredByUsers(specifier)) {
+      if (NativeModule.canBeRequiredByUsers(specifier) &&
+          NativeModule.canBeRequiredWithoutScheme(specifier)) {
         throw new ERR_NETWORK_IMPORT_DISALLOWED(
           specifier,
           parentURL,