worker: restrict supported extensions

Only allow `.js` and `.mjs` extensions to provide future-proofing
for file type detection.

PR-URL: #117
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Olivia Hugger <olivia@fastmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>

Author: TimothyGu

lib/internal/errors.js

@@ -357,6 +357,8 @@ E('ERR_WORKER_NEED_ABSOLUTE_PATH',
 E('ERR_WORKER_OUT_OF_MEMORY', 'The worker script ran out of memory');
 E('ERR_WORKER_UNSERIALIZABLE_ERROR',
   'Serializing an uncaught exception failed');
+E('ERR_WORKER_UNSUPPORTED_EXTENSION',
+  'The worker script extension must be ".js" or ".mjs". Received "%s"');
 E('ERR_ZLIB_BINDING_CLOSED', 'zlib binding closed');
 
 function invalidArgType(name, expected, actual) {

lib/internal/worker.js

@@ -129,8 +129,14 @@ class Worker extends EventEmitter {
                                  'string', filename);
     }
 
-    if (!options.eval && !path.isAbsolute(filename)) {
-      throw new errors.TypeError('ERR_WORKER_NEED_ABSOLUTE_PATH', filename);
+    if (!options.eval) {
+      if (!path.isAbsolute(filename)) {
+        throw new errors.TypeError('ERR_WORKER_NEED_ABSOLUTE_PATH', filename);
+      }
+      const ext = path.extname(filename);
+      if (ext !== '.js' && ext !== '.mjs') {
+        throw new errors.TypeError('ERR_WORKER_UNSUPPORTED_EXTENSION', ext);
+      }
     }
 
     const resourceLimits = {

test/parallel/test-worker-unsupported-path.js

@@ -0,0 +1,26 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { Worker } = require('worker');
+
+{
+  const expectedErr = common.expectsError({
+    code: 'ERR_WORKER_NEED_ABSOLUTE_PATH',
+    type: TypeError
+  }, 4);
+  assert.throws(() => { new Worker('a.js'); }, expectedErr);
+  assert.throws(() => { new Worker('b'); }, expectedErr);
+  assert.throws(() => { new Worker('c/d.js'); }, expectedErr);
+  assert.throws(() => { new Worker('a.mjs'); }, expectedErr);
+}
+
+{
+  const expectedErr = common.expectsError({
+    code: 'ERR_WORKER_UNSUPPORTED_EXTENSION',
+    type: TypeError
+  }, 3);
+  assert.throws(() => { new Worker('/b'); }, expectedErr);
+  assert.throws(() => { new Worker('/c.wasm'); }, expectedErr);
+  assert.throws(() => { new Worker('/d.txt'); }, expectedErr);
+}