url: validate pathToFileURL(path) argument as string

PR-URL: #49161
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

Author: LiviaMedeiros

lib/internal/url.js

@@ -1441,14 +1441,14 @@ function pathToFileURL(filepath) {
 consthostnameEndIndex=StringPrototypeIndexOf(filepath,'\\',2);
 if(hostnameEndIndex===-1){
 thrownewERR_INVALID_ARG_VALUE(
-'filepath',
+'path',
 filepath,
 'Missing UNC resource path',
 );
 }
 if(hostnameEndIndex===2){
 thrownewERR_INVALID_ARG_VALUE(
-'filepath',
+'path',
 filepath,
 'Empty UNC servername',
 );

lib/url.js

@@ -53,7 +53,7 @@ const {
  domainToASCII,
  domainToUnicode,
  fileURLToPath,
- pathToFileURL,
+pathToFileURL: _pathToFileURL,
  urlToHttpOptions,
  unsafeProtocol,
  hostlessProtocol,
@@ -1017,6 +1017,15 @@ Url.prototype.parseHost = function parseHost() {
 if(host)this.hostname=host;
 };
 
+// When used internally, we are not obligated to associate TypeError with
+// this function, so non-strings can be rejected by underlying implementation.
+// Public API has to validate input and throw appropriate error.
+functionpathToFileURL(path){
+validateString(path,'path');
+
+return_pathToFileURL(path);
+}
+
 module.exports={
 // Original API
  Url,

test/parallel/test-url-pathtofileurl.js

@@ -29,13 +29,30 @@ const url = require('url');
 
 // Missing server:
 assert.throws(()=>url.pathToFileURL('\\\\\\no-server'),{
-code: 'ERR_INVALID_ARG_VALUE'
+code: 'ERR_INVALID_ARG_VALUE',
 });
 
 // Missing share or resource:
 assert.throws(()=>url.pathToFileURL('\\\\host'),{
-code: 'ERR_INVALID_ARG_VALUE'
+code: 'ERR_INVALID_ARG_VALUE',
 });
+
+// Regression test for direct String.prototype.startsWith call
+assert.throws(()=>url.pathToFileURL([
+'\\\\',
+{[Symbol.toPrimitive]: ()=>'blep\\blop'},
+]),{
+code: 'ERR_INVALID_ARG_TYPE',
+});
+assert.throws(()=>url.pathToFileURL(['\\\\','blep\\blop']),{
+code: 'ERR_INVALID_ARG_TYPE',
+});
+assert.throws(()=>url.pathToFileURL({
+[Symbol.toPrimitive]: ()=>'\\\\blep\\blop',
+}),{
+code: 'ERR_INVALID_ARG_TYPE',
+});
+
 }else{
 // UNC paths on posix are considered a single path that has backslashes:
 constfileURL=url.pathToFileURL('\\\\nas\\share\\path.txt').href;
@@ -144,3 +161,19 @@ const url = require('url');
 assert.strictEqual(actual,expected);
 }
 }
+
+// Test for non-string parameter
+{
+for(constbadPathof[
+undefined,null,true,42,42n,Symbol('42'),NaN,{},[],()=>{},
+Promise.resolve('foo'),
+newDate(),
+newString('notPrimitive'),
+{toString(){return'amObject';}},
+{[Symbol.toPrimitive]: (hint)=>'amObject'},
+]){
+assert.throws(()=>url.pathToFileURL(badPath),{
+code: 'ERR_INVALID_ARG_TYPE',
+});
+}
+}