npm / minipass-fetch

An implementation of window.fetch in Node.js using Minipass streams
Other
54 stars 11 forks source link

[BUG] data urls are not handled properly #18

Closed isaacs closed 2 years ago

isaacs commented 2 years ago

What / Why

data: urls should be supported the "same" as fetched URLs, in the sense that they may be aborted, and should support any valid data: urls, whether base64 encoded or not.

const c = new AbortController()
fetch('data:text/plain;base64,SGVsbG8sIFdvcmxkIQ==', { signal: c.signal })
  .then(r => console.log(r), e => console.error(e))
c.abort()

Expect it to fail with an AbortError. Instead it works. (This mirrors node-fetch, but diverges from browser fetch.)

const urls = [
  'data:,Hello%2C%20World%21',
  'data:text/html,%3Ch1%3EHello%2C%20World%21%3C%2Fh1%3E',
  'data:text/html,<script>alert('hi');</script>',
]
Promise.all(urls.map(u => fetch(u)).then(() => console.log('it worked'))

Expect: load all data urls. Actual: fails because they are not base64 encoded.

Again, mirrors node-fetch, but not browser fetch.