webpack 5.97.1 → 5.104.1

package/lib/schemes/HttpUriPlugin.js

@@ -6,16 +6,21 @@
 "use strict";
 
 const EventEmitter = require("events");
-const { extname, basename } = require("path");
-const { URL } = require("url");
-const { createGunzip, createBrotliDecompress, createInflate } = require("zlib");
+const { basename, extname } = require("path");
+const {
+	// eslint-disable-next-line n/no-unsupported-features/node-builtins
+	createBrotliDecompress,
+	createGunzip,
+	createInflate
+} = require("zlib");
 const NormalModule = require("../NormalModule");
 const createSchemaValidation = require("../util/create-schema-validation");
 const createHash = require("../util/createHash");
-const { mkdirp, dirname, join } = require("../util/fs");
+const { dirname, join, mkdirp } = require("../util/fs");
 const memoize = require("../util/memoize");
 
 /** @typedef {import("http").IncomingMessage} IncomingMessage */
+/** @typedef {import("http").OutgoingHttpHeaders} OutgoingHttpHeaders */
 /** @typedef {import("http").RequestOptions} RequestOptions */
 /** @typedef {import("net").Socket} Socket */
 /** @typedef {import("stream").Readable} Readable */
@@ -29,10 +34,12 @@ const memoize = require("../util/memoize");
 const getHttp = memoize(() => require("http"));
 const getHttps = memoize(() => require("https"));
 
+const MAX_REDIRECTS = 5;
+
 /**
  * @param {typeof import("http") | typeof import("https")} request request
- * @param {string | { toString: () => string } | undefined} proxy proxy
- * @returns {function(URL, RequestOptions, function(IncomingMessage): void): EventEmitter} fn
+ * @param {string | URL | undefined} proxy proxy
+ * @returns {(url: URL, requestOptions: RequestOptions, callback: (incomingMessage: IncomingMessage) => void) => EventEmitter} fn
  */
 const proxyFetch = (request, proxy) => (url, options, callback) => {
 	const eventEmitter = new EventEmitter();
@@ -41,7 +48,7 @@ const proxyFetch = (request, proxy) => (url, options, callback) => {
 	 * @param {Socket=} socket socket
 	 * @returns {void}
 	 */
-	const doRequest = socket => {
+	const doRequest = (socket) => {
 		request
 			.get(url, { ...options, ...(socket && { socket }) }, callback)
 			.on("error", eventEmitter.emit.bind(eventEmitter, "error"));
@@ -63,7 +70,7 @@ const proxyFetch = (request, proxy) => (url, options, callback) => {
 					doRequest(socket);
 				}
 			})
-			.on("error", err => {
+			.on("error", (err) => {
 				eventEmitter.emit(
 					"error",
 					new Error(
@@ -84,7 +91,7 @@ const proxyFetch = (request, proxy) => (url, options, callback) => {
 let inProgressWrite;
 
 const validate = createSchemaValidation(
-	require("../../schemas/plugins/schemes/HttpUriPlugin.check.js"),
+	require("../../schemas/plugins/schemes/HttpUriPlugin.check"),
 	() => require("../../schemas/plugins/schemes/HttpUriPlugin.json"),
 	{
 		name: "Http Uri Plugin",
@@ -96,7 +103,7 @@ const validate = createSchemaValidation(
  * @param {string} str path
  * @returns {string} safe path
  */
-const toSafePath = str =>
+const toSafePath = (str) =>
 	str
 		.replace(/^[^a-zA-Z0-9]+|[^a-zA-Z0-9]+$/g, "")
 		.replace(/[^a-zA-Z0-9._-]+/g, "_");
@@ -105,7 +112,7 @@ const toSafePath = str =>
  * @param {Buffer} content content
  * @returns {string} integrity
  */
-const computeIntegrity = content => {
+const computeIntegrity = (content) => {
 	const hash = createHash("sha512");
 	hash.update(content);
 	const integrity = `sha512-${hash.digest("base64")}`;
@@ -126,7 +133,7 @@ const verifyIntegrity = (content, integrity) => {
  * @param {string} str input
  * @returns {Record<string, string>} parsed
  */
-const parseKeyValuePairs = str => {
+const parseKeyValuePairs = (str) => {
 	/** @type {Record<string, string>} */
 	const result = {};
 	for (const item of str.split(",")) {
@@ -147,7 +154,7 @@ const parseKeyValuePairs = str => {
 /**
  * @param {string | undefined} cacheControl Cache-Control header
  * @param {number} requestTime timestamp of request
- * @returns {{storeCache: boolean, storeLock: boolean, validUntil: number}} Logic for storing in cache and lockfile cache
+ * @returns {{ storeCache: boolean, storeLock: boolean, validUntil: number }} Logic for storing in cache and lockfile cache
  */
 const parseCacheControl = (cacheControl, requestTime) => {
 	// When false resource is not stored in cache
@@ -190,11 +197,27 @@ const areLockfileEntriesEqual = (a, b) =>
 
 /**
  * @param {LockfileEntry} entry lockfile entry
- * @returns {`resolved: ${string}, integrity: ${string}, contentType: ${*}`} stringified entry
+ * @returns {`resolved: ${string}, integrity: ${string}, contentType: ${string}`} stringified entry
  */
-const entryToString = entry =>
+const entryToString = (entry) =>
 	`resolved: ${entry.resolved}, integrity: ${entry.integrity}, contentType: ${entry.contentType}`;
 
+/**
+ * Sanitize URL for inclusion in error messages
+ * @param {string} href URL string to sanitize
+ * @returns {string} sanitized URL text for logs/errors
+ */
+const sanitizeUrlForError = (href) => {
+	try {
+		const u = new URL(href);
+		return `${u.protocol}//${u.host}`;
+	} catch (_err) {
+		return String(href)
+			.slice(0, 200)
+			.replace(/[\r\n]/g, "");
+	}
+};
+
 class Lockfile {
 	constructor() {
 		this.version = 1;
@@ -209,8 +232,9 @@ class Lockfile {
 	static parse(content) {
 		// TODO handle merge conflicts
 		const data = JSON.parse(content);
-		if (data.version !== 1)
+		if (data.version !== 1) {
 			throw new Error(`Unsupported lockfile version ${data.version}`);
+		}
 		const lockfile = new Lockfile();
 		for (const key of Object.keys(data)) {
 			if (key === "version") continue;
@@ -233,16 +257,15 @@ class Lockfile {
 	 */
 	toString() {
 		let str = "{\n";
-		const entries = Array.from(this.entries).sort(([a], [b]) =>
-			a < b ? -1 : 1
-		);
+		const entries = [...this.entries].sort(([a], [b]) => (a < b ? -1 : 1));
 		for (const [key, entry] of entries) {
 			if (typeof entry === "string") {
 				str += `  ${JSON.stringify(key)}: ${JSON.stringify(entry)},\n`;
 			} else {
 				str += `  ${JSON.stringify(key)}: { `;
-				if (entry.resolved !== key)
+				if (entry.resolved !== key) {
 					str += `"resolved": ${JSON.stringify(entry.resolved)}, `;
+				}
 				str += `"integrity": ${JSON.stringify(
 					entry.integrity
 				)}, "contentType": ${JSON.stringify(entry.contentType)} },\n`;
@@ -255,18 +278,28 @@ class Lockfile {
 
 /**
  * @template R
- * @param {function(function(Error | null, R=): void): void} fn function
- * @returns {function(function(Error | null, R=): void): void} cached function
+ * @typedef {(err: Error | null, result?: R) => void}  FnWithoutKeyCallback
  */
-const cachedWithoutKey = fn => {
+
+/**
+ * @template R
+ * @typedef {(callback: FnWithoutKeyCallback<R>) => void} FnWithoutKey
+ */
+
+/**
+ * @template R
+ * @param {FnWithoutKey<R>} fn function
+ * @returns {FnWithoutKey<R>} cached function
+ */
+const cachedWithoutKey = (fn) => {
 	let inFlight = false;
 	/** @type {Error | undefined} */
 	let cachedError;
 	/** @type {R | undefined} */
 	let cachedResult;
-	/** @type {(function(Error| null, R=): void)[] | undefined} */
+	/** @type {FnWithoutKeyCallback<R>[] | undefined} */
 	let cachedCallbacks;
-	return callback => {
+	return (callback) => {
 		if (inFlight) {
 			if (cachedResult !== undefined) return callback(null, cachedResult);
 			if (cachedError !== undefined) return callback(cachedError);
@@ -286,30 +319,42 @@ const cachedWithoutKey = fn => {
 	};
 };
 
+/**
+ * @template R
+ * @typedef {(err: Error | null, result?: R) => void} FnWithKeyCallback
+ */
+
 /**
  * @template T
  * @template R
- * @param {function(T, function(Error | null, R=): void): void} fn function
- * @param {function(T, function(Error | null, R=): void): void=} forceFn function for the second try
- * @returns {(function(T, function(Error | null, R=): void): void) & { force: function(T, function(Error | null, R=): void): void }} cached function
+ * @typedef {(item: T, callback: FnWithKeyCallback<R>) => void} FnWithKey
+ */
+
+/**
+ * @template T
+ * @template R
+ * @param {FnWithKey<T, R>} fn function
+ * @param {FnWithKey<T, R>=} forceFn function for the second try
+ * @returns {FnWithKey<T, R> & { force: FnWithKey<T, R> }} cached function
  */
 const cachedWithKey = (fn, forceFn = fn) => {
 	/**
 	 * @template R
-	 * @typedef {{ result?: R, error?: Error, callbacks?: (function(Error | null, R=): void)[], force?: true }} CacheEntry
+	 * @typedef {{ result?: R, error?: Error, callbacks?: FnWithKeyCallback<R>[], force?: true }} CacheEntry
 	 */
 	/** @type {Map<T, CacheEntry<R>>} */
 	const cache = new Map();
 	/**
 	 * @param {T} arg arg
-	 * @param {function(Error | null, R=): void} callback callback
+	 * @param {FnWithKeyCallback<R>} callback callback
 	 * @returns {void}
 	 */
 	const resultFn = (arg, callback) => {
 		const cacheEntry = cache.get(arg);
 		if (cacheEntry !== undefined) {
-			if (cacheEntry.result !== undefined)
+			if (cacheEntry.result !== undefined) {
 				return callback(null, cacheEntry.result);
+			}
 			if (cacheEntry.error !== undefined) return callback(cacheEntry.error);
 			if (cacheEntry.callbacks === undefined) cacheEntry.callbacks = [callback];
 			else cacheEntry.callbacks.push(callback);
@@ -333,14 +378,15 @@ const cachedWithKey = (fn, forceFn = fn) => {
 	};
 	/**
 	 * @param {T} arg arg
-	 * @param {function(Error | null, R=): void} callback callback
+	 * @param {FnWithKeyCallback<R>} callback callback
 	 * @returns {void}
 	 */
 	resultFn.force = (arg, callback) => {
 		const cacheEntry = cache.get(arg);
 		if (cacheEntry !== undefined && cacheEntry.force) {
-			if (cacheEntry.result !== undefined)
+			if (cacheEntry.result !== undefined) {
 				return callback(null, cacheEntry.result);
+			}
 			if (cacheEntry.error !== undefined) return callback(cacheEntry.error);
 			if (cacheEntry.callbacks === undefined) cacheEntry.callbacks = [callback];
 			else cacheEntry.callbacks.push(callback);
@@ -384,6 +430,8 @@ const cachedWithKey = (fn, forceFn = fn) => {
 /** @typedef {FetchResultMeta & { entry: LockfileEntry, content: Buffer }} ContentFetchResult */
 /** @typedef {RedirectFetchResult | ContentFetchResult} FetchResult */
 
+const PLUGIN_NAME = "HttpUriPlugin";
+
 class HttpUriPlugin {
 	/**
 	 * @param {HttpUriPluginOptions} options options
@@ -419,14 +467,14 @@ class HttpUriPlugin {
 		/** @type {LockfileCache} */
 		let lockfileCache;
 		compiler.hooks.compilation.tap(
-			"HttpUriPlugin",
+			PLUGIN_NAME,
 			(compilation, { normalModuleFactory }) => {
 				const intermediateFs =
 					/** @type {IntermediateFileSystem} */
 					(compiler.intermediateFileSystem);
 				const fs = compilation.inputFileSystem;
-				const cache = compilation.getCache("webpack.HttpUriPlugin");
-				const logger = compilation.getLogger("webpack.HttpUriPlugin");
+				const cache = compilation.getCache(`webpack.${PLUGIN_NAME}`);
+				const logger = compilation.getLogger(`webpack.${PLUGIN_NAME}`);
 				/** @type {string} */
 				const lockfileLocation =
 					this._lockfileLocation ||
@@ -457,7 +505,7 @@ class HttpUriPlugin {
 				 * @param {string} url the url
 				 * @returns {string} the key
 				 */
-				const getCacheKey = url => {
+				const getCacheKey = (url) => {
 					const cachedResult = cacheKeyCache.get(url);
 					if (cachedResult !== undefined) return cachedResult;
 					const result = _getCacheKey(url);
@@ -469,7 +517,7 @@ class HttpUriPlugin {
 				 * @param {string} url the url
 				 * @returns {string} the key
 				 */
-				const _getCacheKey = url => {
+				const _getCacheKey = (url) => {
 					const parsedUrl = new URL(url);
 					const folder = toSafePath(parsedUrl.origin);
 					const name = toSafePath(parsedUrl.pathname);
@@ -487,10 +535,10 @@ class HttpUriPlugin {
 
 				const getLockfile = cachedWithoutKey(
 					/**
-					 * @param {function(Error | null, Lockfile=): void} callback callback
+					 * @param {(err: Error | null, lockfile?: Lockfile) => void} callback callback
 					 * @returns {void}
 					 */
-					callback => {
+					(callback) => {
 						const readLockfile = () => {
 							intermediateFs.readFile(lockfileLocation, (err, buffer) => {
 								if (err && err.code !== "ENOENT") {
@@ -507,7 +555,7 @@ class HttpUriPlugin {
 									(err, s) => {
 										if (err) return callback(err);
 										const lockfile = buffer
-											? Lockfile.parse(buffer.toString("utf-8"))
+											? Lockfile.parse(buffer.toString("utf8"))
 											: new Lockfile();
 										lockfileCache = {
 											lockfile,
@@ -581,19 +629,20 @@ class HttpUriPlugin {
 				 * @param {Lockfile} lockfile lockfile
 				 * @param {string} url url
 				 * @param {ResolveContentResult} result result
-				 * @param {function(Error | null, ResolveContentResult=): void} callback callback
+				 * @param {(err: Error | null, result?: ResolveContentResult) => void} callback callback
 				 * @returns {void}
 				 */
 				const storeResult = (lockfile, url, result, callback) => {
 					if (result.storeLock) {
 						storeLockEntry(lockfile, url, result.entry);
-						if (!cacheLocation || !result.content)
+						if (!cacheLocation || !result.content) {
 							return callback(null, result);
+						}
 						const key = getCacheKey(result.entry.resolved);
 						const filePath = join(intermediateFs, cacheLocation, key);
-						mkdirp(intermediateFs, dirname(intermediateFs, filePath), err => {
+						mkdirp(intermediateFs, dirname(intermediateFs, filePath), (err) => {
 							if (err) return callback(err);
-							intermediateFs.writeFile(filePath, result.content, err => {
+							intermediateFs.writeFile(filePath, result.content, (err) => {
 								if (err) return callback(err);
 								callback(null, result);
 							});
@@ -605,22 +654,70 @@ class HttpUriPlugin {
 				};
 
 				for (const { scheme, fetch } of schemes) {
+					/**
+					 * @param {string} location Location header value (relative or absolute)
+					 * @param {string} base current absolute URL
+					 * @returns {string} absolute, validated redirect target
+					 */
+					const validateRedirectLocation = (location, base) => {
+						let nextUrl;
+						try {
+							nextUrl = new URL(location, base);
+						} catch (err) {
+							throw new Error(
+								`Invalid redirect URL: ${sanitizeUrlForError(location)}`,
+								{ cause: err }
+							);
+						}
+						if (nextUrl.protocol !== "http:" && nextUrl.protocol !== "https:") {
+							throw new Error(
+								`Redirected URL uses disallowed protocol: ${sanitizeUrlForError(nextUrl.href)}`
+							);
+						}
+						if (!isAllowed(nextUrl.href)) {
+							throw new Error(
+								`${nextUrl.href} doesn't match the allowedUris policy after redirect. These URIs are allowed:\n${allowedUris
+									.map((uri) => ` - ${uri}`)
+									.join("\n")}`
+							);
+						}
+						return nextUrl.href;
+					};
 					/**
 					 * @param {string} url URL
 					 * @param {string | null} integrity integrity
-					 * @param {function(Error | null, ResolveContentResult=): void} callback callback
+					 * @param {(err: Error | null, resolveContentResult?: ResolveContentResult) => void} callback callback
+					 * @param {number=} redirectCount number of followed redirects
 					 */
-					const resolveContent = (url, integrity, callback) => {
+					const resolveContent = (
+						url,
+						integrity,
+						callback,
+						redirectCount = 0
+					) => {
 						/**
 						 * @param {Error | null} err error
-						 * @param {TODO} result result result
+						 * @param {FetchResult=} _result fetch result
 						 * @returns {void}
 						 */
-						const handleResult = (err, result) => {
+						const handleResult = (err, _result) => {
 							if (err) return callback(err);
+
+							const result = /** @type {FetchResult} */ (_result);
+
 							if ("location" in result) {
+								// Validate redirect target before following
+								let absolute;
+								try {
+									absolute = validateRedirectLocation(result.location, url);
+								} catch (err_) {
+									return callback(/** @type {Error} */ (err_));
+								}
+								if (redirectCount >= MAX_REDIRECTS) {
+									return callback(new Error("Too many redirects"));
+								}
 								return resolveContent(
-									result.location,
+									absolute,
 									integrity,
 									(err, innerResult) => {
 										if (err) return callback(err);
@@ -631,9 +728,11 @@ class HttpUriPlugin {
 											content,
 											storeLock: storeLock && result.storeLock
 										});
-									}
+									},
+									redirectCount + 1
 								);
 							}
+
 							if (
 								!result.fresh &&
 								integrity &&
@@ -642,181 +741,188 @@ class HttpUriPlugin {
 							) {
 								return fetchContent.force(url, handleResult);
 							}
+
 							return callback(null, {
 								entry: result.entry,
 								content: result.content,
 								storeLock: result.storeLock
 							});
 						};
+
 						fetchContent(url, handleResult);
 					};
 
 					/**
 					 * @param {string} url URL
 					 * @param {FetchResult | RedirectFetchResult | undefined} cachedResult result from cache
-					 * @param {function(Error | null, FetchResult=): void} callback callback
+					 * @param {(err: Error | null, fetchResult?: FetchResult) => void} callback callback
 					 * @returns {void}
 					 */
 					const fetchContentRaw = (url, cachedResult, callback) => {
 						const requestTime = Date.now();
-						fetch(
-							new URL(url),
-							{
-								headers: {
-									"accept-encoding": "gzip, deflate, br",
-									"user-agent": "webpack",
-									"if-none-match": /** @type {TODO} */ (
-										cachedResult ? cachedResult.etag || null : null
-									)
-								}
-							},
-							res => {
-								const etag = res.headers.etag;
-								const location = res.headers.location;
-								const cacheControl = res.headers["cache-control"];
-								const { storeLock, storeCache, validUntil } = parseCacheControl(
-									cacheControl,
-									requestTime
-								);
-								/**
-								 * @param {Partial<Pick<FetchResultMeta, "fresh">> & (Pick<RedirectFetchResult, "location"> | Pick<ContentFetchResult, "content" | "entry">)} partialResult result
-								 * @returns {void}
-								 */
-								const finishWith = partialResult => {
-									if ("location" in partialResult) {
-										logger.debug(
-											`GET ${url} [${res.statusCode}] -> ${partialResult.location}`
-										);
-									} else {
-										logger.debug(
-											`GET ${url} [${res.statusCode}] ${Math.ceil(
-												partialResult.content.length / 1024
-											)} kB${!storeLock ? " no-cache" : ""}`
-										);
-									}
-									const result = {
-										...partialResult,
-										fresh: true,
-										storeLock,
-										storeCache,
-										validUntil,
-										etag
-									};
-									if (!storeCache) {
-										logger.log(
-											`${url} can't be stored in cache, due to Cache-Control header: ${cacheControl}`
-										);
-										return callback(null, result);
-									}
-									cache.store(
-										url,
-										null,
-										{
-											...result,
-											fresh: false
-										},
-										err => {
-											if (err) {
-												logger.warn(
-													`${url} can't be stored in cache: ${err.message}`
-												);
-												logger.debug(err.stack);
-											}
-											callback(null, result);
-										}
+						/** @type {OutgoingHttpHeaders} */
+						const headers = {
+							"accept-encoding": "gzip, deflate, br",
+							"user-agent": "webpack"
+						};
+
+						if (cachedResult && cachedResult.etag) {
+							headers["if-none-match"] = cachedResult.etag;
+						}
+
+						fetch(new URL(url), { headers }, (res) => {
+							const etag = res.headers.etag;
+							const location = res.headers.location;
+							const cacheControl = res.headers["cache-control"];
+							const { storeLock, storeCache, validUntil } = parseCacheControl(
+								cacheControl,
+								requestTime
+							);
+							/**
+							 * @param {Partial<Pick<FetchResultMeta, "fresh">> & (Pick<RedirectFetchResult, "location"> | Pick<ContentFetchResult, "content" | "entry">)} partialResult result
+							 * @returns {void}
+							 */
+							const finishWith = (partialResult) => {
+								if ("location" in partialResult) {
+									logger.debug(
+										`GET ${url} [${res.statusCode}] -> ${partialResult.location}`
 									);
+								} else {
+									logger.debug(
+										`GET ${url} [${res.statusCode}] ${Math.ceil(
+											partialResult.content.length / 1024
+										)} kB${!storeLock ? " no-cache" : ""}`
+									);
+								}
+								const result = {
+									...partialResult,
+									fresh: true,
+									storeLock,
+									storeCache,
+									validUntil,
+									etag
 								};
-								if (res.statusCode === 304) {
-									const result = /** @type {FetchResult} */ (cachedResult);
-									if (
-										result.validUntil < validUntil ||
-										result.storeLock !== storeLock ||
-										result.storeCache !== storeCache ||
-										result.etag !== etag
-									) {
-										return finishWith(result);
-									}
-									logger.debug(`GET ${url} [${res.statusCode}] (unchanged)`);
-									return callback(null, { ...result, fresh: true });
+								if (!storeCache) {
+									logger.log(
+										`${url} can't be stored in cache, due to Cache-Control header: ${cacheControl}`
+									);
+									return callback(null, result);
 								}
+								cache.store(
+									url,
+									null,
+									{
+										...result,
+										fresh: false
+									},
+									(err) => {
+										if (err) {
+											logger.warn(
+												`${url} can't be stored in cache: ${err.message}`
+											);
+											logger.debug(err.stack);
+										}
+										callback(null, result);
+									}
+								);
+							};
+							if (res.statusCode === 304) {
+								const result = /** @type {FetchResult} */ (cachedResult);
 								if (
-									location &&
-									res.statusCode &&
-									res.statusCode >= 301 &&
-									res.statusCode <= 308
+									result.validUntil < validUntil ||
+									result.storeLock !== storeLock ||
+									result.storeCache !== storeCache ||
+									result.etag !== etag
 								) {
-									const result = {
-										location: new URL(location, url).href
-									};
-									if (
-										!cachedResult ||
-										!("location" in cachedResult) ||
-										cachedResult.location !== result.location ||
-										cachedResult.validUntil < validUntil ||
-										cachedResult.storeLock !== storeLock ||
-										cachedResult.storeCache !== storeCache ||
-										cachedResult.etag !== etag
-									) {
-										return finishWith(result);
-									}
-									logger.debug(`GET ${url} [${res.statusCode}] (unchanged)`);
-									return callback(null, {
-										...result,
-										fresh: true,
-										storeLock,
-										storeCache,
-										validUntil,
-										etag
-									});
+									return finishWith(result);
 								}
-								const contentType = res.headers["content-type"] || "";
-								/** @type {Buffer[]} */
-								const bufferArr = [];
-
-								const contentEncoding = res.headers["content-encoding"];
-								/** @type {Readable} */
-								let stream = res;
-								if (contentEncoding === "gzip") {
-									stream = stream.pipe(createGunzip());
-								} else if (contentEncoding === "br") {
-									stream = stream.pipe(createBrotliDecompress());
-								} else if (contentEncoding === "deflate") {
-									stream = stream.pipe(createInflate());
+								logger.debug(`GET ${url} [${res.statusCode}] (unchanged)`);
+								return callback(null, { ...result, fresh: true });
+							}
+							if (
+								location &&
+								res.statusCode &&
+								res.statusCode >= 301 &&
+								res.statusCode <= 308
+							) {
+								let absolute;
+								try {
+									absolute = validateRedirectLocation(location, url);
+								} catch (err) {
+									logger.log(
+										`GET ${url} [${res.statusCode}] -> ${String(location)} (rejected: ${/** @type {Error} */ (err).message})`
+									);
+									return callback(/** @type {Error} */ (err));
 								}
-
-								stream.on("data", chunk => {
-									bufferArr.push(chunk);
+								const result = { location: absolute };
+								if (
+									!cachedResult ||
+									!("location" in cachedResult) ||
+									cachedResult.location !== result.location ||
+									cachedResult.validUntil < validUntil ||
+									cachedResult.storeLock !== storeLock ||
+									cachedResult.storeCache !== storeCache ||
+									cachedResult.etag !== etag
+								) {
+									return finishWith(result);
+								}
+								logger.debug(`GET ${url} [${res.statusCode}] (unchanged)`);
+								return callback(null, {
+									...result,
+									fresh: true,
+									storeLock,
+									storeCache,
+									validUntil,
+									etag
 								});
+							}
+							const contentType = res.headers["content-type"] || "";
+							/** @type {Buffer[]} */
+							const bufferArr = [];
 
-								stream.on("end", () => {
-									if (!res.complete) {
-										logger.log(`GET ${url} [${res.statusCode}] (terminated)`);
-										return callback(new Error(`${url} request was terminated`));
-									}
+							const contentEncoding = res.headers["content-encoding"];
+							/** @type {Readable} */
+							let stream = res;
+							if (contentEncoding === "gzip") {
+								stream = stream.pipe(createGunzip());
+							} else if (contentEncoding === "br") {
+								stream = stream.pipe(createBrotliDecompress());
+							} else if (contentEncoding === "deflate") {
+								stream = stream.pipe(createInflate());
+							}
 
-									const content = Buffer.concat(bufferArr);
+							stream.on("data", (chunk) => {
+								bufferArr.push(chunk);
+							});
 
-									if (res.statusCode !== 200) {
-										logger.log(`GET ${url} [${res.statusCode}]`);
-										return callback(
-											new Error(
-												`${url} request status code = ${
-													res.statusCode
-												}\n${content.toString("utf-8")}`
-											)
-										);
-									}
+							stream.on("end", () => {
+								if (!res.complete) {
+									logger.log(`GET ${url} [${res.statusCode}] (terminated)`);
+									return callback(new Error(`${url} request was terminated`));
+								}
 
-									const integrity = computeIntegrity(content);
-									const entry = { resolved: url, integrity, contentType };
+								const content = Buffer.concat(bufferArr);
 
-									finishWith({
-										entry,
-										content
-									});
+								if (res.statusCode !== 200) {
+									logger.log(`GET ${url} [${res.statusCode}]`);
+									return callback(
+										new Error(
+											`${url} request status code = ${
+												res.statusCode
+											}\n${content.toString("utf8")}`
+										)
+									);
+								}
+
+								const integrity = computeIntegrity(content);
+								const entry = { resolved: url, integrity, contentType };
+
+								finishWith({
+									entry,
+									content
 								});
-							}
-						).on("error", err => {
+							});
+						}).on("error", (err) => {
 							logger.log(`GET ${url} (error)`);
 							err.message += `\nwhile fetching ${url}`;
 							callback(err);
@@ -826,7 +932,7 @@ class HttpUriPlugin {
 					const fetchContent = cachedWithKey(
 						/**
 						 * @param {string} url URL
-						 * @param {function(Error | null, { validUntil: number, etag?: string, entry: LockfileEntry, content: Buffer, fresh: boolean } | { validUntil: number, etag?: string, location: string, fresh: boolean }=): void} callback callback
+						 * @param {(err: Error | null, result?: FetchResult) => void} callback callback
 						 * @returns {void}
 						 */
 						(url, callback) => {
@@ -846,13 +952,29 @@ class HttpUriPlugin {
 					 * @param {string} uri uri
 					 * @returns {boolean} true when allowed, otherwise false
 					 */
-					const isAllowed = uri => {
+					const isAllowed = (uri) => {
+						let parsedUri;
+						try {
+							// Parse the URI to prevent userinfo bypass attacks
+							// (e.g., http://allowed@malicious/path where @malicious is the actual host)
+							parsedUri = new URL(uri);
+						} catch (_err) {
+							return false;
+						}
 						for (const allowed of allowedUris) {
 							if (typeof allowed === "string") {
-								if (uri.startsWith(allowed)) return true;
+								let parsedAllowed;
+								try {
+									parsedAllowed = new URL(allowed);
+								} catch (_err) {
+									continue;
+								}
+								if (parsedUri.href.startsWith(parsedAllowed.href)) {
+									return true;
+								}
 							} else if (typeof allowed === "function") {
-								if (allowed(uri)) return true;
-							} else if (allowed.test(uri)) {
+								if (allowed(parsedUri.href)) return true;
+							} else if (allowed.test(parsedUri.href)) {
 								return true;
 							}
 						}
@@ -864,7 +986,7 @@ class HttpUriPlugin {
 					const getInfo = cachedWithKey(
 						/**
 						 * @param {string} url the url
-						 * @param {function(Error | null, Info=): void} callback callback
+						 * @param {(err: Error | null, info?: Info) => void} callback callback
 						 * @returns {void}
 						 */
 						// eslint-disable-next-line no-loop-func
@@ -873,7 +995,7 @@ class HttpUriPlugin {
 								return callback(
 									new Error(
 										`${url} doesn't match the allowedUris policy. These URIs are allowed:\n${allowedUris
-											.map(uri => ` - ${uri}`)
+											.map((uri) => ` - ${uri}`)
 											.join("\n")}`
 									)
 								);
@@ -910,8 +1032,9 @@ class HttpUriPlugin {
 										const result =
 											/** @type {ResolveContentResult} */
 											(_result);
-										if (!result.storeLock || entryTag === "ignore")
+										if (!result.storeLock || entryTag === "ignore") {
 											return callback(null, result);
+										}
 										if (frozen) {
 											return callback(
 												new Error(
@@ -936,7 +1059,7 @@ Remove this line from the lockfile to force upgrading.`
 								/**
 								 * @param {Buffer=} lockedContent locked content
 								 */
-								const doFetch = lockedContent => {
+								const doFetch = (lockedContent) => {
 									resolveContent(url, entry.integrity, (err, _result) => {
 										if (err) {
 											if (lockedContent) {
@@ -1017,7 +1140,7 @@ Remove this line from the lockfile to force upgrading.`
 										 * @param {Buffer | undefined} _result result
 										 * @returns {void}
 										 */
-										const continueWithCachedContent = _result => {
+										const continueWithCachedContent = (_result) => {
 											if (!upgrade) {
 												// When not in upgrade mode, we accept the result from the lockfile cache
 												return callback(null, { entry, content });
@@ -1030,7 +1153,7 @@ Remove this line from the lockfile to force upgrading.`
 											let isEolChanged = false;
 											try {
 												contentWithChangedEol = Buffer.from(
-													content.toString("utf-8").replace(/\r\n/g, "\n")
+													content.toString("utf8").replace(/\r\n/g, "\n")
 												);
 												isEolChanged = verifyIntegrity(
 													contentWithChangedEol,
@@ -1065,7 +1188,7 @@ This will avoid that the end of line sequence is changed by git on Windows.`;
 														filePath,
 														/** @type {Buffer} */
 														(contentWithChangedEol),
-														err => {
+														(err) => {
 															if (err) return callback(err);
 															continueWithCachedContent(
 																/** @type {Buffer} */
@@ -1113,7 +1236,7 @@ Run build with un-frozen lockfile to automatically fix lockfile.`
 					/**
 					 * @param {URL} url url
 					 * @param {ResourceDataWithData} resourceData resource data
-					 * @param {function(Error | null, true | void): void} callback callback
+					 * @param {(err: Error | null, result: true | void) => void} callback callback
 					 */
 					const respondWithUrlModule = (url, resourceData, callback) => {
 						getInfo(url.href, (err, _result) => {
@@ -1133,19 +1256,16 @@ Run build with un-frozen lockfile to automatically fix lockfile.`
 					};
 					normalModuleFactory.hooks.resolveForScheme
 						.for(scheme)
-						.tapAsync(
-							"HttpUriPlugin",
-							(resourceData, resolveData, callback) => {
-								respondWithUrlModule(
-									new URL(resourceData.resource),
-									resourceData,
-									callback
-								);
-							}
-						);
+						.tapAsync(PLUGIN_NAME, (resourceData, resolveData, callback) => {
+							respondWithUrlModule(
+								new URL(resourceData.resource),
+								resourceData,
+								callback
+							);
+						});
 					normalModuleFactory.hooks.resolveInScheme
 						.for(scheme)
-						.tapAsync("HttpUriPlugin", (resourceData, data, callback) => {
+						.tapAsync(PLUGIN_NAME, (resourceData, data, callback) => {
 							// Only handle relative urls (./xxx, ../xxx, /xxx, //xxx)
 							if (
 								data.dependencyType !== "url" &&
@@ -1162,42 +1282,38 @@ Run build with un-frozen lockfile to automatically fix lockfile.`
 					const hooks = NormalModule.getCompilationHooks(compilation);
 					hooks.readResourceForScheme
 						.for(scheme)
-						.tapAsync("HttpUriPlugin", (resource, module, callback) =>
+						.tapAsync(PLUGIN_NAME, (resource, module, callback) =>
 							getInfo(resource, (err, _result) => {
 								if (err) return callback(err);
 								const result = /** @type {Info} */ (_result);
-								/** @type {BuildInfo} */
-								(module.buildInfo).resourceIntegrity = result.entry.integrity;
+								if (module) {
+									/** @type {BuildInfo} */
+									(module.buildInfo).resourceIntegrity = result.entry.integrity;
+								}
 								callback(null, result.content);
 							})
 						);
-					hooks.needBuild.tapAsync(
-						"HttpUriPlugin",
-						(module, context, callback) => {
-							if (
-								module.resource &&
-								module.resource.startsWith(`${scheme}://`)
-							) {
-								getInfo(module.resource, (err, _result) => {
-									if (err) return callback(err);
-									const result = /** @type {Info} */ (_result);
-									if (
-										result.entry.integrity !==
-										/** @type {BuildInfo} */
-										(module.buildInfo).resourceIntegrity
-									) {
-										return callback(null, true);
-									}
-									callback();
-								});
-							} else {
-								return callback();
-							}
+					hooks.needBuild.tapAsync(PLUGIN_NAME, (module, context, callback) => {
+						if (module.resource && module.resource.startsWith(`${scheme}://`)) {
+							getInfo(module.resource, (err, _result) => {
+								if (err) return callback(err);
+								const result = /** @type {Info} */ (_result);
+								if (
+									result.entry.integrity !==
+									/** @type {BuildInfo} */
+									(module.buildInfo).resourceIntegrity
+								) {
+									return callback(null, true);
+								}
+								callback();
+							});
+						} else {
+							return callback();
 						}
-					);
+					});
 				}
 				compilation.hooks.finishModules.tapAsync(
-					"HttpUriPlugin",
+					PLUGIN_NAME,
 					(modules, callback) => {
 						if (!lockfileUpdates) return callback();
 						const ext = extname(lockfileLocation);
@@ -1226,22 +1342,17 @@ Run build with un-frozen lockfile to automatically fix lockfile.`
 									return callback(err);
 								}
 								const lockfile = buffer
-									? Lockfile.parse(buffer.toString("utf-8"))
+									? Lockfile.parse(buffer.toString("utf8"))
 									: new Lockfile();
 								for (const [key, value] of /** @type {LockfileUpdates} */ (
 									lockfileUpdates
 								)) {
 									lockfile.entries.set(key, value);
 								}
-								intermediateFs.writeFile(tempFile, lockfile.toString(), err => {
-									if (err) {
-										writeDone();
-										return (
-											/** @type {NonNullable<IntermediateFileSystem["unlink"]>} */
-											(intermediateFs.unlink)(tempFile, () => callback(err))
-										);
-									}
-									intermediateFs.rename(tempFile, lockfileLocation, err => {
+								intermediateFs.writeFile(
+									tempFile,
+									lockfile.toString(),
+									(err) => {
 										if (err) {
 											writeDone();
 											return (
@@ -1249,10 +1360,19 @@ Run build with un-frozen lockfile to automatically fix lockfile.`
 												(intermediateFs.unlink)(tempFile, () => callback(err))
 											);
 										}
-										writeDone();
-										callback();
-									});
-								});
+										intermediateFs.rename(tempFile, lockfileLocation, (err) => {
+											if (err) {
+												writeDone();
+												return (
+													/** @type {NonNullable<IntermediateFileSystem["unlink"]>} */
+													(intermediateFs.unlink)(tempFile, () => callback(err))
+												);
+											}
+											writeDone();
+											callback();
+										});
+									}
+								);
 							});
 						};
 						if (inProgressWrite) {