lib,src: drop --experimental-network-imports

PR-URL: #53822
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>

doc/api/cli.md

@@ -988,18 +988,6 @@ changes:
 Specify the `module` containing exported [module customization hooks][].
 `module` may be any string accepted as an [`import` specifier][].
 
-### `--experimental-network-imports`
-
-<!-- YAML
-added:
-  - v17.6.0
-  - v16.15.0
--->
-
-> Stability: 1 - Experimental
-
-Enable experimental support for the `https:` protocol in `import` specifiers.
-
 ### `--experimental-network-inspection`
 
 <!-- YAML
@@ -2961,7 +2949,6 @@ one is included in the list below.
 * `--experimental-json-modules`
 * `--experimental-loader`
 * `--experimental-modules`
-* `--experimental-network-imports`
 * `--experimental-permission`
 * `--experimental-print-required-tla`
 * `--experimental-require-module`

doc/api/errors.md

@@ -3567,23 +3567,6 @@ removed: v10.0.0
 
 Used by the `Node-API` when `Constructor.prototype` is not an object.
 
-<a id="ERR_NETWORK_IMPORT_BAD_RESPONSE"></a>
-
-### `ERR_NETWORK_IMPORT_BAD_RESPONSE`
-
-> Stability: 1 - Experimental
-
-Response was received but was invalid when importing a module over the network.
-
-<a id="ERR_NETWORK_IMPORT_DISALLOWED"></a>
-
-### `ERR_NETWORK_IMPORT_DISALLOWED`
-
-> Stability: 1 - Experimental
-
-A network module attempted to load another module that it is not allowed to
-load. Likely this restriction is for security reasons.
-
 <a id="ERR_NO_LONGER_SUPPORTED"></a>
 
 ### `ERR_NO_LONGER_SUPPORTED`

doc/api/esm.md

@@ -697,71 +697,6 @@ spawn(execPath, [
 });
 ```
 
-## HTTPS and HTTP imports
-
-> Stability: 1 - Experimental
-
-Importing network based modules using `https:` and `http:` is supported under
-the `--experimental-network-imports` flag. This allows web browser-like imports
-to work in Node.js with a few differences due to application stability and
-security concerns that are different when running in a privileged environment
-instead of a browser sandbox.
-
-### Imports are limited to HTTP/1
-
-Automatic protocol negotiation for HTTP/2 and HTTP/3 is not yet supported.
-
-### HTTP is limited to loopback addresses
-
-`http:` is vulnerable to man-in-the-middle attacks and is not allowed to be
-used for addresses outside of the IPv4 address `127.0.0.0/8` (`127.0.0.1` to
-`127.255.255.255`) and the IPv6 address `::1`. Support for `http:` is intended
-to be used for local development.
-
-### Authentication is never sent to the destination server.
-
-`Authorization`, `Cookie`, and `Proxy-Authorization` headers are not sent to the
-server. Avoid including user info in parts of imported URLs. A security model
-for safely using these on the server is being worked on.
-
-### CORS is never checked on the destination server
-
-CORS is designed to allow a server to limit the consumers of an API to a
-specific set of hosts. This is not supported as it does not make sense for a
-server-based implementation.
-
-### Cannot load non-network dependencies
-
-These modules cannot access other modules that are not over `http:` or `https:`.
-To still access local modules while avoiding the security concern, pass in
-references to the local dependencies:
-
-```mjs
-// file.mjs
-import worker_threads from 'node:worker_threads';
-import { configure, resize } from 'https://example.com/imagelib.mjs';
-configure({ worker_threads });
-```
-
-```mjs
-// https://example.com/imagelib.mjs
-let worker_threads;
-export function configure(opts) {
-  worker_threads = opts.worker_threads;
-}
-export function resize(img, size) {
-  // Perform resizing in worker_thread to avoid main thread blocking
-}
-```
-
-### Network-based loading is not enabled by default
-
-For now, the `--experimental-network-imports` flag is required to enable loading
-resources over `http:` or `https:`. In the future, a different mechanism will be
-used to enforce this. Opt-in is required to prevent transitive dependencies
-inadvertently using potentially mutable state that could affect reliability
-of Node.js applications.
-
 <i id="esm_experimental_loaders"></i>
 
 ## Loaders
@@ -804,8 +739,7 @@ does not determine whether the resolved URL protocol can be loaded,
 or whether the file extensions are permitted, instead these validations
 are applied by Node.js during the load phase
 (for example, if it was asked to load a URL that has a protocol that is
-not `file:`, `data:`, `node:`, or if `--experimental-network-imports`
-is enabled, `https:`).
+not `file:`, `data:` or `node:`.
 
 The algorithm also tries to determine the format of the file based
 on the extension (see `ESM_FILE_FORMAT` algorithm below). If it does

doc/api/module.md

@@ -717,7 +717,7 @@ behaviors.
 #### Import from HTTPS
 
 In current Node.js, specifiers starting with `https://` are experimental (see
-[HTTPS and HTTP imports][]).
+\[HTTPS and HTTP imports]\[]).
 
 The hook below registers hooks to enable rudimentary support for such
 specifiers. While this may seem like a significant improvement to Node.js core
@@ -1054,7 +1054,6 @@ returned object contains the following keys:
 [Conditional exports]: packages.md#conditional-exports
 [Customization hooks]: #customization-hooks
 [ES Modules]: esm.md
-[HTTPS and HTTP imports]: esm.md#https-and-http-imports
 [Source map v3 format]: https://sourcemaps.info/spec.html#h.mofvlxcwqzej
 [`"exports"`]: packages.md#exports
 [`--enable-source-maps`]: cli.md#--enable-source-maps

doc/node.1

@@ -173,9 +173,6 @@ Specify the
 .Ar module
 to use as a custom module loader.
 .
-.It Fl -experimental-network-imports
-Enable experimental support for loading modules using `import` over `https:`.
-.
 .It Fl -experimental-permission
 Enable the experimental permission model.
 .

lib/internal/errors.js

@@ -1595,10 +1595,6 @@ E('ERR_NAPI_INVALID_TYPEDARRAY_ALIGNMENT',
   'start offset of %s should be a multiple of %s', RangeError);
 E('ERR_NAPI_INVALID_TYPEDARRAY_LENGTH',
   'Invalid typed array length', RangeError);
-E('ERR_NETWORK_IMPORT_BAD_RESPONSE',
-  "import '%s' received a bad response: %s", Error);
-E('ERR_NETWORK_IMPORT_DISALLOWED',
-  "import of '%s' by %s is not supported: %s", Error);
 E('ERR_NOT_BUILDING_SNAPSHOT',
   'Operation cannot be invoked when not building startup snapshot', Error);
 E('ERR_NOT_IN_SINGLE_EXECUTABLE_APPLICATION',

lib/internal/modules/esm/get_format.js

@@ -2,8 +2,6 @@
 
 const {
   ObjectPrototypeHasOwnProperty,
-  PromisePrototypeThen,
-  PromiseResolve,
   RegExpPrototypeExec,
   SafeSet,
   StringPrototypeCharCodeAt,
@@ -18,8 +16,6 @@ const {
 } = require('internal/modules/esm/formats');
 
 const detectModule = getOptionValue('--experimental-detect-module');
-const experimentalNetworkImports =
-  getOptionValue('--experimental-network-imports');
 const { containsModuleSyntax } = internalBinding('contextify');
 const { getPackageScopeConfig, getPackageType } = require('internal/modules/package_json_reader');
 const { fileURLToPath } = require('internal/url');
@@ -29,8 +25,6 @@ const protocolHandlers = {
   '__proto__': null,
   'data:': getDataProtocolModuleFormat,
   'file:': getFileProtocolModuleFormat,
-  'http:': getHttpProtocolModuleFormat,
-  'https:': getHttpProtocolModuleFormat,
   'node:'() { return 'builtin'; },
 };
 
@@ -219,23 +213,6 @@ function getFileProtocolModuleFormat(url, context = { __proto__: null }, ignoreE
   throw new ERR_UNKNOWN_FILE_EXTENSION(ext, filepath);
 }
 
-/**
- * @param {URL} url
- * @param {{parentURL: string}} context
- * @returns {Promise<string> | undefined} only works when enabled
- */
-function getHttpProtocolModuleFormat(url, context) {
-  if (experimentalNetworkImports) {
-    const { fetchModule } = require('internal/modules/esm/fetch_module');
-    return PromisePrototypeThen(
-      PromiseResolve(fetchModule(url, context)),
-      (entry) => {
-        return mimeToFormat(entry.headers['content-type']);
-      },
-    );
-  }
-}
-
 /**
  * @param {URL} url
  * @param {{parentURL: string}} context

lib/internal/modules/esm/load.js

@@ -1,7 +1,6 @@
 'use strict';
 
 const {
-  ArrayPrototypePush,
   RegExpPrototypeExec,
   decodeURIComponent,
 } = primordials;
@@ -12,8 +11,6 @@ const { validateAttributes, emitImportAssertionWarning } = require('internal/mod
 const { getOptionValue } = require('internal/options');
 const { readFileSync } = require('fs');
 
-const experimentalNetworkImports =
-  getOptionValue('--experimental-network-imports');
 const defaultType =
   getOptionValue('--experimental-default-type');
 
@@ -39,7 +36,7 @@ const DATA_URL_PATTERN = /^[^/]+\/[^,;]+(?:[^,]*?)(;base64)?,([\s\S]*)$/;
  */
 async function getSource(url, context) {
   const { protocol, href } = url;
-  let responseURL = href;
+  const responseURL = href;
   let source;
   if (protocol === 'file:') {
     const { readFile: readFileAsync } = require('internal/fs/promises').exports;
@@ -51,19 +48,8 @@ async function getSource(url, context) {
     }
     const { 1: base64, 2: body } = match;
     source = BufferFrom(decodeURIComponent(body), base64 ? 'base64' : 'utf8');
-  } else if (experimentalNetworkImports && (
-    protocol === 'https:' ||
-    protocol === 'http:'
-  )) {
-    const { fetchModule } = require('internal/modules/esm/fetch_module');
-    const res = await fetchModule(url, context);
-    source = await res.body;
-    responseURL = res.resolvedHREF;
   } else {
     const supportedSchemes = ['file', 'data'];
-    if (experimentalNetworkImports) {
-      ArrayPrototypePush(supportedSchemes, 'http', 'https');
-    }
     throw new ERR_UNSUPPORTED_ESM_URL_SCHEME(url, supportedSchemes);
   }
   return { __proto__: null, responseURL, source };
@@ -121,7 +107,7 @@ async function defaultLoad(url, context = kEmptyObject) {
 
   const urlInstance = new URL(url);
 
-  throwIfUnsupportedURLScheme(urlInstance, experimentalNetworkImports);
+  throwIfUnsupportedURLScheme(urlInstance);
 
   if (urlInstance.protocol === 'node:') {
     source = null;
@@ -224,9 +210,8 @@ function defaultLoadSync(url, context = kEmptyObject) {
  * throws an error if the protocol is not one of the protocols
  * that can be loaded in the default loader
  * @param {URL} parsed
- * @param {boolean} experimentalNetworkImports
  */
-function throwIfUnsupportedURLScheme(parsed, experimentalNetworkImports) {
+function throwIfUnsupportedURLScheme(parsed) {
   // Avoid accessing the `protocol` property due to the lazy getters.
   const protocol = parsed?.protocol;
   if (
@@ -235,17 +220,11 @@ function throwIfUnsupportedURLScheme(parsed, experimentalNetworkImports) {
     protocol !== 'data:' &&
     protocol !== 'node:' &&
     (
-      !experimentalNetworkImports ||
-      (
-        protocol !== 'https:' &&
-        protocol !== 'http:'
-      )
+      protocol !== 'https:' &&
+      protocol !== 'http:'
     )
   ) {
     const schemes = ['file', 'data', 'node'];
-    if (experimentalNetworkImports) {
-      ArrayPrototypePush(schemes, 'https', 'http');
-    }
     throw new ERR_UNSUPPORTED_ESM_URL_SCHEME(parsed, schemes);
   }
 }

lib/internal/modules/esm/loader.js

@@ -30,7 +30,7 @@ const {
 } = require('internal/errors').codes;
 const { getOptionValue } = require('internal/options');
 const { isURL, pathToFileURL, URLParse } = require('internal/url');
-const { emitExperimentalWarning, kEmptyObject } = require('internal/util');
+const { kEmptyObject } = require('internal/util');
 const {
   compileSourceTextModule,
   getDefaultConditions,
@@ -145,9 +145,6 @@ class ModuleLoader {
   #customizations;
 
   constructor(customizations) {
-    if (getOptionValue('--experimental-network-imports')) {
-      emitExperimentalWarning('Network Imports');
-    }
     this.setCustomizations(customizations);
   }