fix: panic on invalid file:// module specifier (#8964)

2 files changed, 55 insertions, 3 deletions

diff --git a/cli/disk_cache.rs b/cli/disk_cache.rs
index 81b86c0ae..3cc3b16f3 100644
--- a/cli/disk_cache.rs
+++ b/cli/disk_cache.rs
@@ -69,7 +69,10 @@ impl DiskCache {
       }
       "http" | "https" => out = url_to_filename(url),
       "file" => {
-        let path = url.to_file_path().unwrap();
+        let path = match url.to_file_path() {
+          Ok(path) => path,
+          Err(_) => return None,
+        };
         let mut path_components = path.components();
 
         if cfg!(target_os = "windows") {
@@ -278,4 +281,28 @@ mod tests {
       )
     }
   }
+
+  #[test]
+  fn test_get_cache_filename_invalid_urls() {
+    let cache_location = if cfg!(target_os = "windows") {
+      PathBuf::from(r"C:\deno_dir\")
+    } else {
+      PathBuf::from("/deno_dir/")
+    };
+
+    let cache = DiskCache::new(&cache_location);
+
+    let mut test_cases = vec!["unknown://localhost/test.ts"];
+
+    if cfg!(target_os = "windows") {
+      test_cases.push("file://");
+      test_cases.push("file:///");
+    }
+
+    for test_case in &test_cases {
+      let cache_filename =
+        cache.get_cache_filename(&Url::parse(test_case).unwrap());
+      assert_eq!(cache_filename, None);
+    }
+  }
 }
diff --git a/runtime/permissions.rs b/runtime/permissions.rs
index 782c44e4f..a331ef3e9 100644
--- a/runtime/permissions.rs
+++ b/runtime/permissions.rs
@@ -581,8 +581,13 @@ impl Permissions {
   ) -> Result<(), AnyError> {
     let url = specifier.as_url();
     if url.scheme() == "file" {
-      let path = url.to_file_path().unwrap();
-      self.check_read(&path)
+      match url.to_file_path() {
+        Ok(path) => self.check_read(&path),
+        Err(_) => Err(uri_error(format!(
+          "Invalid file path.\n  Specifier: {}",
+          specifier
+        ))),
+      }
     } else {
       self.check_net_url(url)
     }
@@ -943,6 +948,26 @@ mod tests {
   }
 
   #[test]
+  fn check_invalid_specifiers() {
+    let perms = Permissions::allow_all();
+
+    let mut test_cases = vec![];
+
+    if cfg!(target_os = "windows") {
+      test_cases.push("file://");
+      test_cases.push("file:///");
+    } else {
+      test_cases.push("file://remotehost/");
+    }
+
+    for url in test_cases {
+      assert!(perms
+        .check_specifier(&ModuleSpecifier::resolve_url_or_path(url).unwrap())
+        .is_err());
+    }
+  }
+
+  #[test]
   fn test_deserialize_perms() {
     let json_perms = r#"
     {