From 0d185f7930107b29ee87c2d788b1caaa7434e63e Mon Sep 17 00:00:00 2001
From: Bradley Farias <bradley.meck@gmail.com>
Date: Mon, 30 Nov 2020 10:03:30 -0600
Subject: [PATCH] esm: support https remotely and http locally under flag

Co-authored-by: Jacob Smith
  <3012099+JakobJingleheimer@users.noreply.github.com>
Co-authored-by: James M Snell <jasnell@gmail.com>
Co-authored-by: Jordan Harband <ljharb@gmail.com>
Co-authored-by: James Sumners <james@sumners.email>
PR-URL: https://github.com/nodejs/node/pull/36328
Backport-PR-URL: https://github.com/nodejs/node/pull/42726
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
---
 doc/api/cli.md                                |  11 +
 doc/api/errors.md                             |  17 ++
 doc/api/esm.md                                |  65 ++++
 doc/node.1                                    |   3 +
 lib/internal/errors.js                        |  11 +-
 lib/internal/main/check_syntax.js             |   6 +-
 lib/internal/modules/esm/fetch_module.js      | 286 ++++++++++++++++++
 lib/internal/modules/esm/formats.js           |  65 ++++
 lib/internal/modules/esm/get_format.js        |  93 +++---
 lib/internal/modules/esm/get_source.js        |  25 +-
 .../modules/esm/initialize_import_meta.js     |  25 +-
 lib/internal/modules/esm/load.js              |   6 +-
 lib/internal/modules/esm/loader.js            |  27 +-
 lib/internal/modules/esm/resolve.js           | 168 +++++++++-
 lib/internal/policy/manifest.js               |  36 +++
 lib/repl.js                                   |   2 +-
 src/node_options.cc                           |   4 +
 src/node_options.h                            |   1 +
 test/common/index.mjs                         |   2 +
 test/es-module/test-esm-dynamic-import.js     |   4 +-
 .../test-esm-import-assertion-errors.js       |   4 +-
 .../test-esm-import-assertion-errors.mjs      |   2 +-
 test/es-module/test-esm-invalid-data-urls.js  |  15 +-
 .../test-esm-loader-resolve-type.mjs          |   3 +-
 test/es-module/test-esm-loader-search.js      |   4 +-
 test/es-module/test-esm-resolve-type.js       |  17 +-
 test/es-module/test-http-imports.mjs          | 170 +++++++++++
 .../builtin-named-exports-loader.mjs          |   4 +-
 .../es-module-loaders/hook-resolve-type.mjs   |   8 +-
 .../es-module-loaders/loader-with-dep.mjs     |   4 +-
 .../es-module-loaders/mock-loader.mjs         |  14 +-
 test/parallel/test-bootstrap-modules.js       |  36 ++-
 test/pummel/test-policy-integrity-dep.js      |   1 +
 33 files changed, 995 insertions(+), 144 deletions(-)
 create mode 100644 lib/internal/modules/esm/fetch_module.js
 create mode 100644 lib/internal/modules/esm/formats.js
 create mode 100644 test/es-module/test-http-imports.mjs

diff --git a/doc/api/cli.md b/doc/api/cli.md
index 2d1e6c2d6963b7..ae0dde8630099a 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -291,6 +291,16 @@ added: v9.0.0
 Specify the `module` of a custom experimental [ECMAScript module loader][].
 `module` may be any string accepted as an [`import` specifier][].
 
+### `--experimental-network-imports`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1 - Experimental
+
+Enable experimental support for the `https:` protocol in `import` specifiers.
+
 ### `--experimental-policy`
 
 <!-- YAML
@@ -1534,6 +1544,7 @@ Node.js options that are allowed are:
 * `--experimental-json-modules`
 * `--experimental-loader`
 * `--experimental-modules`
+* `--experimental-network-imports`
 * `--experimental-policy`
 * `--experimental-specifier-resolution`
 * `--experimental-top-level-await`
diff --git a/doc/api/errors.md b/doc/api/errors.md
index adde7d35009733..d4f7c9656956a4 100644
--- a/doc/api/errors.md
+++ b/doc/api/errors.md
@@ -3105,6 +3105,23 @@ removed: v10.0.0
 
 Used by the `Node-API` when `Constructor.prototype` is not an object.
 
+<a id="ERR_NETWORK_IMPORT_BAD_RESPONSE"></a>
+
+### `ERR_NETWORK_IMPORT_BAD_RESPONSE`
+
+> Stability: 1 - Experimental
+
+Response was received but was invalid when importing a module over the network.
+
+<a id="ERR_NETWORK_IMPORT_DISALLOWED"></a>
+
+### `ERR_NETWORK_IMPORT_DISALLOWED`
+
+> Stability: 1 - Experimental
+
+A network module attempted to load another module that it is not allowed to
+load. Likely this restriction is for security reasons.
+
 <a id="ERR_NO_LONGER_SUPPORTED"></a>
 
 ### `ERR_NO_LONGER_SUPPORTED`
diff --git a/doc/api/esm.md b/doc/api/esm.md
index 854684248afa45..dac16eedda7b92 100644
--- a/doc/api/esm.md
+++ b/doc/api/esm.md
@@ -596,6 +596,71 @@ spawn(execPath, [
 });
 ```
 
+## HTTPS and HTTP imports
+
+> Stability: 1 - Experimental
+
+Importing network based modules using `https:` and `http:` is supported under
+the `--experimental-network-imports` flag. This allows web browser-like imports
+to work in Node.js with a few differences due to application stability and
+security concerns that are different when running in a privileged environment
+instead of a browser sandbox.
+
+### Imports are limited to HTTP/1
+
+Automatic protocol negotiation for HTTP/2 and HTTP/3 is not yet supported.
+
+### HTTP is limited to loopback addresses
+
+`http:` is vulnerable to man-in-the-middle attacks and is not allowed to be
+used for addresses outside of the IPv4 address `127.0.0.0/8` (`127.0.0.1` to
+`127.255.255.255`) and the IPv6 address `::1`. Support for `http:` is intended
+to be used for local development.
+
+### Authentication is never sent to the destination server.
+
+`Authorization`, `Cookie`, and `Proxy-Authorization` headers are not sent to the
+server. Avoid including user info in parts of imported URLs. A security model
+for safely using these on the server is being worked on.
+
+### CORS is never checked on the destination server
+
+CORS is designed to allow a server to limit the consumers of an API to a
+specific set of hosts. This is not supported as it does not make sense for a
+server-based implementation.
+
+### Cannot load non-network dependencies
+
+These modules cannot access other modules that are not over `http:` or `https:`.
+To still access local modules while avoiding the security concern, pass in
+references to the local dependencies:
+
+```mjs
+// file.mjs
+import worker_threads from 'worker_threads';
+import { configure, resize } from 'https://example.com/imagelib.mjs';
+configure({ worker_threads });
+```
+
+```mjs
+// https://example.com/imagelib.mjs
+let worker_threads;
+export function configure(opts) {
+  worker_threads = opts.worker_threads;
+}
+export function resize(img, size) {
+  // Perform resizing in worker_thread to avoid main thread blocking
+}
+```
+
+### Network-based loading is not enabled by default
+
+For now, the `--experimental-network-imports` flag is required to enable loading
+resources over `http:` or `https:`. In the future, a different mechanism will be
+used to enforce this. Opt-in is required to prevent transitive dependencies
+inadvertently using potentially mutable state that could affect reliability
+of Node.js applications.
+
 <i id="esm_experimental_loaders"></i>
 
 ## Loaders
diff --git a/doc/node.1 b/doc/node.1
index 7518fe1e6da570..fecf83de899c6c 100644
--- a/doc/node.1
+++ b/doc/node.1
@@ -147,6 +147,9 @@ Specify the
 .Ar module
 to use as a custom module loader.
 .
+.It Fl -experimental-network-imports
+Enable experimental support for loading modules using `import` over `https:`.
+.
 .It Fl -experimental-policy
 Use the specified file as a security policy.
 .
diff --git a/lib/internal/errors.js b/lib/internal/errors.js
index d4855e60598560..0ef58432391f39 100644
--- a/lib/internal/errors.js
+++ b/lib/internal/errors.js
@@ -1414,6 +1414,10 @@ E('ERR_NAPI_INVALID_TYPEDARRAY_ALIGNMENT',
   'start offset of %s should be a multiple of %s', RangeError);
 E('ERR_NAPI_INVALID_TYPEDARRAY_LENGTH',
   'Invalid typed array length', RangeError);
+E('ERR_NETWORK_IMPORT_BAD_RESPONSE',
+  "import '%s' received a bad response: %s", Error);
+E('ERR_NETWORK_IMPORT_DISALLOWED',
+  "import of '%s' by %s is not supported: %s", Error);
 E('ERR_NO_CRYPTO',
   'Node.js is not compiled with OpenSSL crypto support', Error);
 E('ERR_NO_ICU',
@@ -1575,12 +1579,13 @@ E('ERR_UNKNOWN_ENCODING', 'Unknown encoding: %s', TypeError);
 E('ERR_UNKNOWN_FILE_EXTENSION',
   'Unknown file extension "%s" for %s',
   TypeError);
-E('ERR_UNKNOWN_MODULE_FORMAT', 'Unknown module format: %s', RangeError);
+E('ERR_UNKNOWN_MODULE_FORMAT', 'Unknown module format: %s for URL %s',
+  RangeError);
 E('ERR_UNKNOWN_SIGNAL', 'Unknown signal: %s', TypeError);
 E('ERR_UNSUPPORTED_DIR_IMPORT', "Directory import '%s' is not supported " +
 'resolving ES modules imported from %s', Error);
-E('ERR_UNSUPPORTED_ESM_URL_SCHEME', (url) => {
-  let msg = 'Only file and data URLs are supported by the default ESM loader';
+E('ERR_UNSUPPORTED_ESM_URL_SCHEME', (url, supported) => {
+  let msg = `Only URLs with a scheme in: ${ArrayPrototypeJoin(supported, ', ')} are supported by the default ESM loader`;
   if (isWindows && url.protocol.length === 2) {
     msg +=
       '. On Windows, absolute paths must be valid file:// URLs';
diff --git a/lib/internal/main/check_syntax.js b/lib/internal/main/check_syntax.js
index 25ae6bdb47a2df..010bef045e4fc8 100644
--- a/lib/internal/main/check_syntax.js
+++ b/lib/internal/main/check_syntax.js
@@ -45,7 +45,7 @@ if (process.argv[1] && process.argv[1] !== '-') {
   });
 }
 
-function checkSyntax(source, filename) {
+async function checkSyntax(source, filename) {
   const { getOptionValue } = require('internal/options');
   let isModule = false;
   if (filename === '[stdin]' || filename === '[eval]') {
@@ -53,8 +53,8 @@ function checkSyntax(source, filename) {
   } else {
     const { defaultResolve } = require('internal/modules/esm/resolve');
     const { defaultGetFormat } = require('internal/modules/esm/get_format');
-    const { url } = defaultResolve(pathToFileURL(filename).toString());
-    const format = defaultGetFormat(url);
+    const { url } = await defaultResolve(pathToFileURL(filename).toString());
+    const format = await defaultGetFormat(url);
     isModule = format === 'module';
   }
   if (isModule) {
diff --git a/lib/internal/modules/esm/fetch_module.js b/lib/internal/modules/esm/fetch_module.js
new file mode 100644
index 00000000000000..288a202ea07372
--- /dev/null
+++ b/lib/internal/modules/esm/fetch_module.js
@@ -0,0 +1,286 @@
+'use strict';
+const {
+  ArrayPrototypePush,
+  Promise,
+  PromisePrototypeThen,
+  PromiseResolve,
+  SafeMap,
+  StringPrototypeEndsWith,
+  StringPrototypeSlice,
+  StringPrototypeStartsWith,
+} = primordials;
+const {
+  Buffer: {
+    concat: BufferConcat
+  }
+} = require('buffer');
+const {
+  ERR_NETWORK_IMPORT_DISALLOWED,
+  ERR_NETWORK_IMPORT_BAD_RESPONSE,
+} = require('internal/errors').codes;
+const { URL } = require('internal/url');
+const net = require('net');
+const path = require('path');
+
+/**
+ * @typedef CacheEntry
+ * @property {Promise<string> | string} resolvedHREF
+ * @property {Record<string, string>} headers
+ * @property {Promise<Buffer> | Buffer} body
+ */
+
+/**
+ * Only for GET requests, other requests would need new Map
+ * HTTP cache semantics keep diff caches
+ *
+ * Maps HREF to pending cache entry
+ * @type {Map<string, Promise<CacheEntry> | CacheEntry>}
+ */
+const cacheForGET = new SafeMap();
+
+// [1] The V8 snapshot doesn't like some C++ APIs to be loaded eagerly. Do it
+// lazily/at runtime and not top level of an internal module.
+
+// [2] Creating a new agent instead of using the gloabl agent improves
+// performance and precludes the agent becoming tainted.
+
+let HTTPSAgent;
+function HTTPSGet(url, opts) {
+  const https = require('https'); // [1]
+  HTTPSAgent ??= new https.Agent({ // [2]
+    keepAlive: true
+  });
+  return https.get(url, {
+    agent: HTTPSAgent,
+    ...opts
+  });
+}
+
+let HTTPAgent;
+function HTTPGet(url, opts) {
+  const http = require('http'); // [1]
+  HTTPAgent ??= new http.Agent({ // [2]
+    keepAlive: true
+  });
+  return http.get(url, {
+    agent: HTTPAgent,
+    ...opts
+  });
+}
+
+function dnsLookup(name, opts) {
+  // eslint-disable-next-line no-func-assign
+  dnsLookup = require('dns/promises').lookup;
+  return dnsLookup(name, opts);
+}
+
+let zlib;
+function createBrotliDecompress() {
+  zlib ??= require('zlib'); // [1]
+  // eslint-disable-next-line no-func-assign
+  createBrotliDecompress = zlib.createBrotliDecompress;
+  return createBrotliDecompress();
+}
+
+function createUnzip() {
+  zlib ??= require('zlib'); // [1]
+  // eslint-disable-next-line no-func-assign
+  createUnzip = zlib.createUnzip;
+  return createUnzip();
+}
+
+/**
+ * @param {URL} parsed
+ * @returns {Promise<CacheEntry> | CacheEntry}
+ */
+function fetchWithRedirects(parsed) {
+  const existing = cacheForGET.get(parsed.href);
+  if (existing) {
+    return existing;
+  }
+  const handler = parsed.protocol === 'http:' ? HTTPGet : HTTPSGet;
+  const result = new Promise((fulfill, reject) => {
+    const req = handler(parsed, {
+      headers: {
+        Accept: '*/*'
+      }
+    })
+    .on('error', reject)
+    .on('response', (res) => {
+      function dispose() {
+        req.destroy();
+        res.destroy();
+      }
+      if (res.statusCode >= 300 && res.statusCode <= 303) {
+        if (res.headers.location) {
+          dispose();
+          try {
+            const location = new URL(res.headers.location, parsed);
+            if (location.protocol !== 'http:' &&
+              location.protocol !== 'https:') {
+              reject(new ERR_NETWORK_IMPORT_DISALLOWED(
+                res.headers.location,
+                parsed.href,
+                'cannot redirect to non-network location'));
+              return;
+            }
+            return PromisePrototypeThen(
+              PromiseResolve(fetchWithRedirects(location)),
+              (entry) => {
+                cacheForGET.set(parsed.href, entry);
+                fulfill(entry);
+              });
+          } catch (e) {
+            dispose();
+            reject(e);
+          }
+        }
+      }
+      if (res.statusCode > 303 || res.statusCode < 200) {
+        dispose();
+        reject(
+          new ERR_NETWORK_IMPORT_BAD_RESPONSE(
+            parsed.href,
+            'HTTP response returned status code of ' + res.statusCode));
+        return;
+      }
+      const { headers } = res;
+      const contentType = headers['content-type'];
+      if (!contentType) {
+        dispose();
+        reject(new ERR_NETWORK_IMPORT_BAD_RESPONSE(
+          parsed.href,
+          'the \'Content-Type\' header is required'));
+        return;
+      }
+      /**
+       * @type {CacheEntry}
+       */
+      const entry = {
+        resolvedHREF: parsed.href,
+        headers: {
+          'content-type': res.headers['content-type']
+        },
+        body: new Promise((f, r) => {
+          const buffers = [];
+          let size = 0;
+          let bodyStream = res;
+          let onError;
+          if (res.headers['content-encoding'] === 'br') {
+            bodyStream = createBrotliDecompress();
+            onError = function onError(error) {
+              bodyStream.close();
+              dispose();
+              reject(error);
+              r(error);
+            };
+            res.on('error', onError);
+            res.pipe(bodyStream);
+          } else if (res.headers['content-encoding'] === 'gzip' ||
+            res.headers['content-encoding'] === 'deflate') {
+            bodyStream = createUnzip();
+            onError = function onError(error) {
+              bodyStream.close();
+              dispose();
+              reject(error);
+              r(error);
+            };
+            res.on('error', onError);
+            res.pipe(bodyStream);
+          } else {
+            onError = function onError(error) {
+              dispose();
+              reject(error);
+              r(error);
+            };
+          }
+          bodyStream.on('error', onError);
+          bodyStream.on('data', (d) => {
+            ArrayPrototypePush(buffers, d);
+            size += d.length;
+          });
+          bodyStream.on('end', () => {
+            const body = entry.body = /** @type {Buffer} */(
+              BufferConcat(buffers, size)
+            );
+            f(body);
+          });
+        }),
+      };
+      cacheForGET.set(parsed.href, entry);
+      fulfill(entry);
+    });
+  });
+  cacheForGET.set(parsed.href, result);
+  return result;
+}
+
+const allowList = new net.BlockList();
+allowList.addAddress('::1', 'ipv6');
+allowList.addRange('127.0.0.1', '127.255.255.255');
+
+/**
+ * Returns if an address has local status by if it is going to a local
+ * interface or is an address resolved by DNS to be a local interface
+ * @param {string} hostname url.hostname to test
+ * @returns {Promise<boolean>}
+ */
+async function isLocalAddress(hostname) {
+  try {
+    if (StringPrototypeStartsWith(hostname, '[') &&
+        StringPrototypeEndsWith(hostname, ']')) {
+      hostname = StringPrototypeSlice(hostname, 1, -1);
+    }
+    const addr = await dnsLookup(hostname, { verbatim: true });
+    const ipv = addr.family === 4 ? 'ipv4' : 'ipv6';
+    return allowList.check(addr.address, ipv);
+  } catch {
+    // If it errored, the answer is no.
+  }
+  return false;
+}
+
+/**
+ * Fetches a location with a shared cache following redirects.
+ * Does not respect HTTP cache headers.
+ *
+ * This splits the header and body Promises so that things only needing
+ * headers don't need to wait on the body.
+ *
+ * In cases where the request & response have already settled, this returns the
+ * cache value synchronously.
+ *
+ * @param {URL} parsed
+ * @param {ESModuleContext} context
+ * @returns {ReturnType<typeof fetchWithRedirects>}
+ */
+function fetchModule(parsed, { parentURL }) {
+  const { href } = parsed;
+  const existing = cacheForGET.get(href);
+  if (existing) {
+    return existing;
+  }
+  if (parsed.protocol === 'http:') {
+    return PromisePrototypeThen(isLocalAddress(parsed.hostname), (is) => {
+      if (is !== true) {
+        let parent = parentURL;
+        const parentName = path.basename(parent.pathname);
+        if (
+          parentName === '[eval]' ||
+          parentName === '[stdin'
+        ) parent = 'command-line';
+        throw new ERR_NETWORK_IMPORT_DISALLOWED(
+          href,
+          parent,
+          'http can only be used to load local resources (use https instead).'
+        );
+      }
+      return fetchWithRedirects(parsed);
+    });
+  }
+  return fetchWithRedirects(parsed);
+}
+
+module.exports = {
+  fetchModule: fetchModule
+};
diff --git a/lib/internal/modules/esm/formats.js b/lib/internal/modules/esm/formats.js
new file mode 100644
index 00000000000000..8fbe0f38446862
--- /dev/null
+++ b/lib/internal/modules/esm/formats.js
@@ -0,0 +1,65 @@
+'use strict';
+
+const {
+  RegExpPrototypeTest,
+} = primordials;
+const { getOptionValue } = require('internal/options');
+
+
+const experimentalWasmModules = getOptionValue('--experimental-wasm-modules');
+const experimentalSpecifierResolution =
+  getOptionValue('--experimental-specifier-resolution');
+
+const extensionFormatMap = {
+  '__proto__': null,
+  '.cjs': 'commonjs',
+  '.js': 'module',
+  '.json': 'json',
+  '.mjs': 'module',
+};
+
+const legacyExtensionFormatMap = {
+  '__proto__': null,
+  '.cjs': 'commonjs',
+  '.js': 'commonjs',
+  '.json': 'commonjs',
+  '.mjs': 'module',
+  '.node': 'commonjs',
+};
+
+if (experimentalWasmModules) {
+  extensionFormatMap['.wasm'] = legacyExtensionFormatMap['.wasm'] = 'wasm';
+}
+
+function mimeToFormat(mime) {
+  if (
+    RegExpPrototypeTest(
+      /\s*(text|application)\/javascript\s*(;\s*charset=utf-?8\s*)?/i,
+      mime
+    )
+  ) return 'module';
+  if (mime === 'application/json') return 'json';
+  if (experimentalWasmModules && mime === 'application/wasm') return 'wasm';
+  return null;
+}
+
+let experimentalSpecifierResolutionWarned = false;
+function getLegacyExtensionFormat(ext) {
+  if (
+    experimentalSpecifierResolution === 'node' &&
+    !experimentalSpecifierResolutionWarned
+  ) {
+    process.emitWarning(
+      'The Node.js specifier resolution in ESM is experimental.',
+      'ExperimentalWarning');
+    experimentalSpecifierResolutionWarned = true;
+  }
+  return legacyExtensionFormatMap[ext];
+}
+
+module.exports = {
+  extensionFormatMap,
+  getLegacyExtensionFormat,
+  legacyExtensionFormatMap,
+  mimeToFormat,
+};
diff --git a/lib/internal/modules/esm/get_format.js b/lib/internal/modules/esm/get_format.js
index ca90cd6a5d1e97..825fbae3f5931f 100644
--- a/lib/internal/modules/esm/get_format.js
+++ b/lib/internal/modules/esm/get_format.js
@@ -1,75 +1,47 @@
 'use strict';
 const {
+  RegExpPrototypeExec,
   ObjectAssign,
   ObjectCreate,
   ObjectPrototypeHasOwnProperty,
-  RegExpPrototypeExec,
+  PromisePrototypeThen,
+  PromiseResolve,
 } = primordials;
 const { extname } = require('path');
 const { getOptionValue } = require('internal/options');
+const { fetchModule } = require('internal/modules/esm/fetch_module');
+const {
+  extensionFormatMap,
+  getLegacyExtensionFormat,
+  mimeToFormat,
+} = require('internal/modules/esm/formats');
 
+const experimentalNetworkImports =
+  getOptionValue('--experimental-network-imports');
 const experimentalSpecifierResolution =
   getOptionValue('--experimental-specifier-resolution');
-const experimentalWasmModules = getOptionValue('--experimental-wasm-modules');
 const { getPackageType } = require('internal/modules/esm/resolve');
 const { URL, fileURLToPath } = require('internal/url');
 const { ERR_UNKNOWN_FILE_EXTENSION } = require('internal/errors').codes;
 
-const extensionFormatMap = {
-  '__proto__': null,
-  '.cjs': 'commonjs',
-  '.js': 'module',
-  '.json': 'json',
-  '.mjs': 'module',
-};
-
-const legacyExtensionFormatMap = {
-  '__proto__': null,
-  '.cjs': 'commonjs',
-  '.js': 'commonjs',
-  '.json': 'commonjs',
-  '.mjs': 'module',
-  '.node': 'commonjs',
-};
-
-let experimentalSpecifierResolutionWarned = false;
-
-if (experimentalWasmModules)
-  extensionFormatMap['.wasm'] = legacyExtensionFormatMap['.wasm'] = 'wasm';
-
 const protocolHandlers = ObjectAssign(ObjectCreate(null), {
-  'data:'(parsed) {
-    const { 1: mime } = RegExpPrototypeExec(
-      /^([^/]+\/[^;,]+)(?:[^,]*?)(;base64)?,/,
-      parsed.pathname,
-    ) || [, null]; // eslint-disable-line no-sparse-arrays
-    const format = ({
-      '__proto__': null,
-      'text/javascript': 'module',
-      'application/json': 'json',
-      'application/wasm': experimentalWasmModules ? 'wasm' : null
-    })[mime] || null;
-
-    return format;
-  },
+  'data:': getDataProtocolModuleFormat,
   'file:': getFileProtocolModuleFormat,
+  'http:': getHttpProtocolModuleFormat,
+  'https:': getHttpProtocolModuleFormat,
   'node:'() { return 'builtin'; },
 });
 
-function getLegacyExtensionFormat(ext) {
-  if (
-    experimentalSpecifierResolution === 'node' &&
-    !experimentalSpecifierResolutionWarned
-  ) {
-    process.emitWarning(
-      'The Node.js specifier resolution in ESM is experimental.',
-      'ExperimentalWarning');
-    experimentalSpecifierResolutionWarned = true;
-  }
-  return legacyExtensionFormatMap[ext];
+function getDataProtocolModuleFormat(parsed) {
+  const { 1: mime } = RegExpPrototypeExec(
+    /^([^/]+\/[^;,]+)(?:[^,]*?)(;base64)?,/,
+    parsed.pathname,
+  ) || [ null, null, null ];
+
+  return mimeToFormat(mime);
 }
 
-function getFileProtocolModuleFormat(url, ignoreErrors) {
+function getFileProtocolModuleFormat(url, context, ignoreErrors) {
   const ext = extname(url.pathname);
   if (ext === '.js') {
     return getPackageType(url) === 'module' ? 'module' : 'commonjs';
@@ -77,26 +49,38 @@ function getFileProtocolModuleFormat(url, ignoreErrors) {
 
   const format = extensionFormatMap[ext];
   if (format) return format;
+
   if (experimentalSpecifierResolution !== 'node') {
     // Explicit undefined return indicates load hook should rerun format check
-    if (ignoreErrors)
-      return undefined;
+    if (ignoreErrors) return undefined;
     throw new ERR_UNKNOWN_FILE_EXTENSION(ext, fileURLToPath(url));
   }
+
   return getLegacyExtensionFormat(ext) ?? null;
 }
 
+function getHttpProtocolModuleFormat(url, context) {
+  if (experimentalNetworkImports) {
+    return PromisePrototypeThen(
+      PromiseResolve(fetchModule(url, context)),
+      (entry) => {
+        return mimeToFormat(entry.headers['content-type']);
+      }
+    );
+  }
+}
+
 function defaultGetFormatWithoutErrors(url, context) {
   const parsed = new URL(url);
   if (!ObjectPrototypeHasOwnProperty(protocolHandlers, parsed.protocol))
     return null;
-  return protocolHandlers[parsed.protocol](parsed, true);
+  return protocolHandlers[parsed.protocol](parsed, context, true);
 }
 
 function defaultGetFormat(url, context) {
   const parsed = new URL(url);
   return ObjectPrototypeHasOwnProperty(protocolHandlers, parsed.protocol) ?
-    protocolHandlers[parsed.protocol](parsed, false) :
+    protocolHandlers[parsed.protocol](parsed, context, false) :
     null;
 }
 
@@ -104,5 +88,4 @@ module.exports = {
   defaultGetFormat,
   defaultGetFormatWithoutErrors,
   extensionFormatMap,
-  legacyExtensionFormatMap,
 };
diff --git a/lib/internal/modules/esm/get_source.js b/lib/internal/modules/esm/get_source.js
index 8281a8e4876aa0..ab2a9888f76fe7 100644
--- a/lib/internal/modules/esm/get_source.js
+++ b/lib/internal/modules/esm/get_source.js
@@ -1,28 +1,33 @@
 'use strict';
 
 const {
+  ArrayPrototypeConcat,
   RegExpPrototypeExec,
   decodeURIComponent,
 } = primordials;
 const { getOptionValue } = require('internal/options');
+const { fetchModule } = require('internal/modules/esm/fetch_module');
+
 // Do not eagerly grab .manifest, it may be in TDZ
 const policy = getOptionValue('--experimental-policy') ?
   require('internal/process/policy') :
   null;
+const experimentalNetworkImports =
+  getOptionValue('--experimental-network-imports');
 
-const { Buffer } = require('buffer');
+const { Buffer: { from: BufferFrom } } = require('buffer');
 
 const fs = require('internal/fs/promises').exports;
 const { URL } = require('internal/url');
 const {
   ERR_INVALID_URL,
-  ERR_INVALID_URL_SCHEME,
+  ERR_UNSUPPORTED_ESM_URL_SCHEME,
 } = require('internal/errors').codes;
 const readFileAsync = fs.readFile;
 
 const DATA_URL_PATTERN = /^[^/]+\/[^,;]+(?:[^,]*?)(;base64)?,([\s\S]*)$/;
 
-async function defaultGetSource(url, { format } = {}, defaultGetSource) {
+async function defaultGetSource(url, context, defaultGetSource) {
   const parsed = new URL(url);
   let source;
   if (parsed.protocol === 'file:') {
@@ -33,9 +38,19 @@ async function defaultGetSource(url, { format } = {}, defaultGetSource) {
       throw new ERR_INVALID_URL(url);
     }
     const { 1: base64, 2: body } = match;
-    source = Buffer.from(decodeURIComponent(body), base64 ? 'base64' : 'utf8');
+    source = BufferFrom(decodeURIComponent(body), base64 ? 'base64' : 'utf8');
+  } else if (experimentalNetworkImports && (
+    parsed.protocol === 'https:' ||
+    parsed.protocol === 'http:'
+  )) {
+    const res = await fetchModule(parsed, context);
+    source = await res.body;
   } else {
-    throw new ERR_INVALID_URL_SCHEME(['file', 'data']);
+    throw new ERR_UNSUPPORTED_ESM_URL_SCHEME(parsed, ArrayPrototypeConcat([
+      'file',
+      'data',
+      experimentalNetworkImports ? ['https', 'http'] : [],
+    ]));
   }
   if (policy?.manifest) {
     policy.manifest.assertIntegrity(parsed, source);
diff --git a/lib/internal/modules/esm/initialize_import_meta.js b/lib/internal/modules/esm/initialize_import_meta.js
index 322b4c59be1561..cb9fa23f966f76 100644
--- a/lib/internal/modules/esm/initialize_import_meta.js
+++ b/lib/internal/modules/esm/initialize_import_meta.js
@@ -2,8 +2,14 @@
 
 const { getOptionValue } = require('internal/options');
 const experimentalImportMetaResolve =
-getOptionValue('--experimental-import-meta-resolve');
-const { PromisePrototypeThen, PromiseReject } = primordials;
+  getOptionValue('--experimental-import-meta-resolve');
+const { fetchModule } = require('internal/modules/esm/fetch_module');
+const { URL } = require('internal/url');
+const {
+  PromisePrototypeThen,
+  PromiseReject,
+  StringPrototypeStartsWith,
+} = primordials;
 const asyncESM = require('internal/process/esm_loader');
 
 function createImportMetaResolve(defaultParentUrl) {
@@ -19,11 +25,22 @@ function createImportMetaResolve(defaultParentUrl) {
 }
 
 function initializeImportMeta(meta, context) {
-  const url = context.url;
+  let url = context.url;
 
   // Alphabetical
-  if (experimentalImportMetaResolve)
+  if (experimentalImportMetaResolve) {
     meta.resolve = createImportMetaResolve(url);
+  }
+
+  if (
+    StringPrototypeStartsWith(url, 'http:') ||
+    StringPrototypeStartsWith(url, 'https:')
+  ) {
+    // The request & response have already settled, so they are in fetchModule's
+    // cache, in which case, fetchModule returns immediately and synchronously
+    url = fetchModule(new URL(url), context).resolvedHREF;
+  }
+
   meta.url = url;
 }
 
diff --git a/lib/internal/modules/esm/load.js b/lib/internal/modules/esm/load.js
index 86fe0a77406ecf..6defb598a2abf7 100644
--- a/lib/internal/modules/esm/load.js
+++ b/lib/internal/modules/esm/load.js
@@ -11,14 +11,14 @@ const { validateAssertions } = require('internal/modules/esm/assert');
  * @returns {object}
  */
 async function defaultLoad(url, context) {
+  const { importAssertions } = context;
   let {
     format,
     source,
   } = context;
-  const { importAssertions } = context;
 
   if (format == null) {
-    format = defaultGetFormat(url);
+    format = await defaultGetFormat(url, context);
   }
 
   validateAssertions(url, format, importAssertions);
@@ -29,7 +29,7 @@ async function defaultLoad(url, context) {
   ) {
     source = null;
   } else if (source == null) {
-    source = await defaultGetSource(url, { format });
+    source = await defaultGetSource(url, context);
   }
 
   return {
diff --git a/lib/internal/modules/esm/loader.js b/lib/internal/modules/esm/loader.js
index 1707db8b1857fa..d5e0b61af6a309 100644
--- a/lib/internal/modules/esm/loader.js
+++ b/lib/internal/modules/esm/loader.js
@@ -24,7 +24,6 @@ const { MessageChannel } = require('internal/worker/io');
 const {
   ERR_INVALID_ARG_TYPE,
   ERR_INVALID_ARG_VALUE,
-  ERR_INVALID_MODULE_SPECIFIER,
   ERR_INVALID_RETURN_PROPERTY_VALUE,
   ERR_INVALID_RETURN_VALUE,
   ERR_UNKNOWN_MODULE_FORMAT
@@ -277,13 +276,19 @@ class ESMLoader {
    */
   #createModuleJob(url, importAssertions, parentURL, format) {
     const moduleProvider = async (url, isMain) => {
-      const { format: finalFormat, source } = await this.load(
-        url, { format, importAssertions });
+      const {
+        format: finalFormat,
+        source,
+      } = await this.load(url, {
+        format,
+        importAssertions,
+        parentURL,
+      });
 
       const translator = translators.get(finalFormat);
 
       if (!translator) {
-        throw new ERR_UNKNOWN_MODULE_FORMAT(finalFormat);
+        throw new ERR_UNKNOWN_MODULE_FORMAT(finalFormat, url);
       }
 
       return FunctionPrototypeCall(translator, this, url, source, isMain);
@@ -377,10 +382,9 @@ class ESMLoader {
         url,
       );
 
-      throw new ERR_INVALID_MODULE_SPECIFIER(
-        url,
-        dataUrl ? `has an unsupported MIME type "${dataUrl[1]}"` : ''
-      );
+      throw new ERR_UNKNOWN_MODULE_FORMAT(
+        dataUrl ? dataUrl[1] : format,
+        url);
     }
 
     if (typeof format !== 'string') {
@@ -506,8 +510,11 @@ class ESMLoader {
    *                                              statement or expression.
    * @returns {{ url: string }}
    */
-  async resolve(originalSpecifier, parentURL,
-                importAssertions = ObjectCreate(null)) {
+  async resolve(
+    originalSpecifier,
+    parentURL,
+    importAssertions = ObjectCreate(null)
+  ) {
     const isMain = parentURL === undefined;
 
     if (
diff --git a/lib/internal/modules/esm/resolve.js b/lib/internal/modules/esm/resolve.js
index a4be89cc949b76..831e04732d3b7c 100644
--- a/lib/internal/modules/esm/resolve.js
+++ b/lib/internal/modules/esm/resolve.js
@@ -2,6 +2,7 @@
 
 const {
   ArrayIsArray,
+  ArrayPrototypeConcat,
   ArrayPrototypeJoin,
   ArrayPrototypeShift,
   JSONParse,
@@ -39,6 +40,8 @@ const policy = getOptionValue('--experimental-policy') ?
 const { sep, relative, resolve } = require('path');
 const preserveSymlinks = getOptionValue('--preserve-symlinks');
 const preserveSymlinksMain = getOptionValue('--preserve-symlinks-main');
+const experimentalNetworkImports =
+  getOptionValue('--experimental-network-imports');
 const typeFlag = getOptionValue('--input-type');
 const pendingDeprecation = getOptionValue('--pending-deprecation');
 const { URL, pathToFileURL, fileURLToPath } = require('internal/url');
@@ -53,6 +56,7 @@ const {
   ERR_PACKAGE_IMPORT_NOT_DEFINED,
   ERR_PACKAGE_PATH_NOT_EXPORTED,
   ERR_UNSUPPORTED_DIR_IMPORT,
+  ERR_NETWORK_IMPORT_DISALLOWED,
   ERR_UNSUPPORTED_ESM_URL_SCHEME,
 } = require('internal/errors').codes;
 const { Module: CJSModule } = require('internal/modules/cjs/loader');
@@ -174,7 +178,7 @@ function getConditionsSet(conditions) {
 }
 
 const realpathCache = new SafeMap();
-const packageJSONCache = new SafeMap();  /* string -> PackageConfig */
+const packageJSONCache = new SafeMap(); /* string -> PackageConfig */
 
 /**
  * @param {string | URL} path
@@ -557,8 +561,9 @@ function resolvePackageTarget(packageJSONUrl, target, subpath, packageSubpath,
       target, subpath, packageSubpath, packageJSONUrl, base, pattern, internal,
       conditions);
   } else if (ArrayIsArray(target)) {
-    if (target.length === 0)
+    if (target.length === 0) {
       return null;
+    }
 
     let lastException;
     for (let i = 0; i < target.length; i++) {
@@ -570,12 +575,14 @@ function resolvePackageTarget(packageJSONUrl, target, subpath, packageSubpath,
           internal, conditions);
       } catch (e) {
         lastException = e;
-        if (e.code === 'ERR_INVALID_PACKAGE_TARGET')
+        if (e.code === 'ERR_INVALID_PACKAGE_TARGET') {
           continue;
+        }
         throw e;
       }
-      if (resolveResult === undefined)
+      if (resolveResult === undefined) {
         continue;
+      }
       if (resolveResult === null) {
         lastException = null;
         continue;
@@ -964,18 +971,22 @@ function shouldBeTreatedAsRelativeOrAbsolutePath(specifier) {
  * @returns {URL}
  */
 function moduleResolve(specifier, base, conditions, preserveSymlinks) {
+  const isRemote = base.protocol === 'http:' ||
+    base.protocol === 'https:';
   // Order swapped from spec for minor perf gain.
   // Ok since relative URLs cannot parse as URLs.
   let resolved;
   if (shouldBeTreatedAsRelativeOrAbsolutePath(specifier)) {
     resolved = new URL(specifier, base);
-  } else if (specifier[0] === '#') {
+  } else if (!isRemote && specifier[0] === '#') {
     ({ resolved } = packageImportsResolve(specifier, base, conditions));
   } else {
     try {
       resolved = new URL(specifier);
     } catch {
-      resolved = packageResolve(specifier, base, conditions);
+      if (!isRemote) {
+        resolved = packageResolve(specifier, base, conditions);
+      }
     }
   }
   if (resolved.protocol !== 'file:')
@@ -1029,6 +1040,48 @@ function resolveAsCommonJS(specifier, parentURL) {
   }
 }
 
+// TODO(@JakobJingleheimer): de-dupe `specifier` & `parsed`
+function checkIfDisallowedImport(specifier, parsed, parsedParentURL) {
+  if (parsedParentURL) {
+    const parentURL = fileURLToPath(parsedParentURL?.href);
+
+    if (
+      parsedParentURL.protocol === 'http:' ||
+      parsedParentURL.protocol === 'https:'
+    ) {
+      if (shouldBeTreatedAsRelativeOrAbsolutePath(specifier)) {
+        // data: and blob: disallowed due to allowing file: access via
+        // indirection
+        if (parsed &&
+          parsed.protocol !== 'https:' &&
+          parsed.protocol !== 'http:'
+        ) {
+          throw new ERR_NETWORK_IMPORT_DISALLOWED(
+            specifier,
+            parentURL,
+            'remote imports cannot import from a local location.'
+          );
+        }
+
+        return { url: parsed.href };
+      }
+      if (NativeModule.canBeRequiredByUsers(specifier)) {
+        throw new ERR_NETWORK_IMPORT_DISALLOWED(
+          specifier,
+          parentURL,
+          'remote imports cannot import from a local location.'
+        );
+      }
+
+      throw new ERR_NETWORK_IMPORT_DISALLOWED(
+        specifier,
+        parentURL,
+        'only relative and absolute specifiers are supported.'
+      );
+    }
+  }
+}
+
 function throwIfUnsupportedURLProtocol(url) {
   if (url.protocol !== 'file:' && url.protocol !== 'data:' &&
       url.protocol !== 'node:') {
@@ -1036,7 +1089,28 @@ function throwIfUnsupportedURLProtocol(url) {
   }
 }
 
-function defaultResolve(specifier, context = {}, defaultResolveUnused) {
+function throwIfUnsupportedURLScheme(parsed, experimentalNetworkImports) {
+  if (
+    parsed &&
+    parsed.protocol !== 'file:' &&
+    parsed.protocol !== 'data:' &&
+    (
+      !experimentalNetworkImports ||
+      (
+        parsed.protocol !== 'https:' &&
+        parsed.protocol !== 'http:'
+      )
+    )
+  ) {
+    throw new ERR_UNSUPPORTED_ESM_URL_SCHEME(parsed, ArrayPrototypeConcat(
+      'file',
+      'data',
+      experimentalNetworkImports ? ['https', 'http'] : [],
+    ));
+  }
+}
+
+async function defaultResolve(specifier, context = {}, defaultResolveUnused) {
   let { parentURL, conditions } = context;
   if (parentURL && policy?.manifest) {
     const redirects = policy.manifest.getDependencyMapper(parentURL);
@@ -1051,6 +1125,9 @@ function defaultResolve(specifier, context = {}, defaultResolveUnused) {
         return { url: href };
       }
       if (missing) {
+        // Prevent network requests from firing if resolution would be banned.
+        // Network requests can extract data by doing things like putting
+        // secrets in query params
         reaction(new ERR_MANIFEST_DEPENDENCY_MISSING(
           parentURL,
           specifier,
@@ -1060,6 +1137,53 @@ function defaultResolve(specifier, context = {}, defaultResolveUnused) {
     }
   }
 
+  let parsedParentURL;
+  if (parentURL) {
+    try {
+      parsedParentURL = new URL(parentURL);
+    } catch {
+      // Ignore exception
+    }
+  }
+
+  let parsed;
+  try {
+    if (shouldBeTreatedAsRelativeOrAbsolutePath(specifier)) {
+      parsed = new URL(specifier, parsedParentURL);
+    } else {
+      parsed = new URL(specifier);
+    }
+
+    if (parsed.protocol === 'data:' ||
+      (experimentalNetworkImports &&
+        (
+          parsed.protocol === 'https:' ||
+          parsed.protocol === 'http:'
+        )
+      )
+    ) {
+      return { url: specifier };
+    }
+  } catch {
+    // Ignore exception
+  }
+
+  // There are multiple deep branches that can either throw or return; instead
+  // of duplicating that deeply nested logic for the possible returns, DRY and
+  // check for a return. This seems the least gnarly.
+  const maybeReturn = checkIfDisallowedImport(
+    specifier,
+    parsed,
+    parsedParentURL,
+  );
+
+  if (maybeReturn) return maybeReturn;
+
+  // This must come after checkIfDisallowedImport
+  if (parsed && parsed.protocol === 'node:') return { url: specifier };
+
+  throwIfUnsupportedURLScheme(parsed, experimentalNetworkImports);
+
   const isMain = parentURL === undefined;
   if (isMain) {
     parentURL = pathToFileURL(`${process.cwd()}/`).href;
@@ -1070,8 +1194,7 @@ function defaultResolve(specifier, context = {}, defaultResolveUnused) {
     // input, to avoid user confusion over how expansive the effect of the
     // flag should be (i.e. entry point only, package scope surrounding the
     // entry point, etc.).
-    if (typeFlag)
-      throw new ERR_INPUT_TYPE_NOT_ALLOWED();
+    if (typeFlag) throw new ERR_INPUT_TYPE_NOT_ALLOWED();
   }
 
   conditions = getConditionsSet(conditions);
@@ -1105,8 +1228,10 @@ function defaultResolve(specifier, context = {}, defaultResolveUnused) {
   throwIfUnsupportedURLProtocol(url);
 
   return {
-    url: `${url}`,
-    format: defaultGetFormatWithoutErrors(url),
+    // Do NOT cast `url` to a string: that will work even when there are real
+    // problems, silencing them
+    url: url.href,
+    format: defaultGetFormatWithoutErrors(url, context),
   };
 }
 
@@ -1117,10 +1242,29 @@ module.exports = {
   getPackageScopeConfig,
   getPackageType,
   packageExportsResolve,
-  packageImportsResolve
+  packageImportsResolve,
 };
 
 // cycle
 const {
   defaultGetFormatWithoutErrors,
 } = require('internal/modules/esm/get_format');
+
+if (policy) {
+  const $defaultResolve = defaultResolve;
+  module.exports.defaultResolve = async function defaultResolve(
+    specifier,
+    context
+  ) {
+    const ret = await $defaultResolve(specifier, context, $defaultResolve);
+    // This is a preflight check to avoid data exfiltration by query params etc.
+    policy.manifest.mightAllow(ret.url, () =>
+      new ERR_MANIFEST_DEPENDENCY_MISSING(
+        context.parentURL,
+        specifier,
+        context.conditions
+      )
+    );
+    return ret;
+  };
+}
diff --git a/lib/internal/policy/manifest.js b/lib/internal/policy/manifest.js
index 1be12eb4635d36..a0cd9707a2c7d5 100644
--- a/lib/internal/policy/manifest.js
+++ b/lib/internal/policy/manifest.js
@@ -14,6 +14,7 @@ const {
   SafeMap,
   SafeSet,
   StringPrototypeEndsWith,
+  StringPrototypeStartsWith,
   StringPrototypeReplace,
   Symbol,
   uncurryThis,
@@ -532,6 +533,41 @@ class Manifest {
     };
   }
 
+  mightAllow(url, onreact) {
+    const href = `${url}`;
+    debug('Checking for entry of %s', href);
+    if (StringPrototypeStartsWith(href, 'node:')) {
+      return true;
+    }
+    if (this.#resourceIntegrities.has(href)) {
+      return true;
+    }
+    let scope = findScopeHREF(href, this.#scopeIntegrities, true);
+    while (scope !== null) {
+      if (this.#scopeIntegrities.has(scope)) {
+        const entry = this.#scopeIntegrities.get(scope);
+        if (entry === true) {
+          return true;
+        } else if (entry !== kCascade) {
+          break;
+        }
+      }
+      const nextScope = findScopeHREF(
+        new URL('..', scope),
+        this.#scopeIntegrities,
+        false,
+      );
+      if (!nextScope || nextScope === scope) {
+        break;
+      }
+      scope = nextScope;
+    }
+    if (onreact) {
+      this.#reaction(onreact());
+    }
+    return false;
+  }
+
   assertIntegrity(url, content) {
     const href = `${url}`;
     debug('Checking integrity of %s', href);
diff --git a/lib/repl.js b/lib/repl.js
index 8e31ec43add7cc..321d5c6bf9c361 100644
--- a/lib/repl.js
+++ b/lib/repl.js
@@ -177,7 +177,7 @@ const history = require('internal/repl/history');
 const {
   extensionFormatMap,
   legacyExtensionFormatMap,
-} = require('internal/modules/esm/get_format');
+} = require('internal/modules/esm/formats');
 
 let nextREPLResourceNumber = 1;
 // This prevents v8 code cache from getting confused and using a different
diff --git a/src/node_options.cc b/src/node_options.cc
index 00339ff340123f..aa932351436bc3 100644
--- a/src/node_options.cc
+++ b/src/node_options.cc
@@ -319,6 +319,10 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             kAllowedInEnvironment);
   AddAlias("--loader", "--experimental-loader");
   AddOption("--experimental-modules", "", NoOp{}, kAllowedInEnvironment);
+  AddOption("--experimental-network-imports",
+            "experimental https: support for the ES Module loader",
+            &EnvironmentOptions::experimental_https_modules,
+            kAllowedInEnvironment);
   AddOption("--experimental-wasm-modules",
             "experimental ES Module support for webassembly modules",
             &EnvironmentOptions::experimental_wasm_modules,
diff --git a/src/node_options.h b/src/node_options.h
index 1efa7202ed2f17..048768c531eac0 100644
--- a/src/node_options.h
+++ b/src/node_options.h
@@ -103,6 +103,7 @@ class EnvironmentOptions : public Options {
   std::vector<std::string> conditions;
   std::string dns_result_order;
   bool enable_source_maps = false;
+  bool experimental_https_modules = false;
   std::string experimental_specifier_resolution;
   bool experimental_wasm_modules = false;
   bool experimental_import_meta_resolve = false;
diff --git a/test/common/index.mjs b/test/common/index.mjs
index babc3fbbba0528..ec181dcacb4d72 100644
--- a/test/common/index.mjs
+++ b/test/common/index.mjs
@@ -20,6 +20,7 @@ const {
   localIPv6Hosts,
   opensslCli,
   PIPE,
+  hasCrypto,
   hasIPv6,
   childShouldThrowAndAbort,
   createZeroFilledFile,
@@ -65,6 +66,7 @@ export {
   localIPv6Hosts,
   opensslCli,
   PIPE,
+  hasCrypto,
   hasIPv6,
   childShouldThrowAndAbort,
   createZeroFilledFile,
diff --git a/test/es-module/test-esm-dynamic-import.js b/test/es-module/test-esm-dynamic-import.js
index 3df2191e3ba06b..eed5f230cc87a5 100644
--- a/test/es-module/test-esm-dynamic-import.js
+++ b/test/es-module/test-esm-dynamic-import.js
@@ -59,8 +59,8 @@ function expectFsNamespace(result) {
                     'ERR_UNSUPPORTED_ESM_URL_SCHEME');
   if (common.isWindows) {
     const msg =
-      'Only file and data URLs are supported by the default ESM loader. ' +
-      'On Windows, absolute paths must be valid file:// URLs. ' +
+      'Only URLs with a scheme in: file, data are supported by the default ' +
+      'ESM loader. On Windows, absolute paths must be valid file:// URLs. ' +
       "Received protocol 'c:'";
     expectModuleError(import('C:\\example\\foo.mjs'),
                       'ERR_UNSUPPORTED_ESM_URL_SCHEME',
diff --git a/test/es-module/test-esm-import-assertion-errors.js b/test/es-module/test-esm-import-assertion-errors.js
index 147781b45ccca3..2fb167aa0941e2 100644
--- a/test/es-module/test-esm-import-assertion-errors.js
+++ b/test/es-module/test-esm-import-assertion-errors.js
@@ -7,10 +7,8 @@ const jsonModuleDataUrl = 'data:application/json,""';
 
 async function test() {
   await rejects(
-    // This rejects because of the unsupported MIME type, not because of the
-    // unsupported assertion.
     import('data:text/css,', { assert: { type: 'css' } }),
-    { code: 'ERR_INVALID_MODULE_SPECIFIER' }
+    { code: 'ERR_UNKNOWN_MODULE_FORMAT' }
   );
 
   await rejects(
diff --git a/test/es-module/test-esm-import-assertion-errors.mjs b/test/es-module/test-esm-import-assertion-errors.mjs
index d3f958ced0eb93..acaeef50626508 100644
--- a/test/es-module/test-esm-import-assertion-errors.mjs
+++ b/test/es-module/test-esm-import-assertion-errors.mjs
@@ -8,7 +8,7 @@ await rejects(
   // This rejects because of the unsupported MIME type, not because of the
   // unsupported assertion.
   import('data:text/css,', { assert: { type: 'css' } }),
-  { code: 'ERR_INVALID_MODULE_SPECIFIER' }
+  { code: 'ERR_UNKNOWN_MODULE_FORMAT' }
 );
 
 await rejects(
diff --git a/test/es-module/test-esm-invalid-data-urls.js b/test/es-module/test-esm-invalid-data-urls.js
index c349aa309cee65..e434c895a2e37d 100644
--- a/test/es-module/test-esm-invalid-data-urls.js
+++ b/test/es-module/test-esm-invalid-data-urls.js
@@ -4,15 +4,18 @@ const assert = require('assert');
 
 (async () => {
   await assert.rejects(import('data:text/plain,export default0'), {
-    code: 'ERR_INVALID_MODULE_SPECIFIER',
-    message: 'Invalid module "data:text/plain,export default0" has an unsupported MIME type "text/plain"',
+    code: 'ERR_UNKNOWN_MODULE_FORMAT',
+    message:
+      'Unknown module format: text/plain for URL data:text/plain,' +
+      'export default0',
   });
   await assert.rejects(import('data:text/plain;base64,'), {
-    code: 'ERR_INVALID_MODULE_SPECIFIER',
-    message: 'Invalid module "data:text/plain;base64," has an unsupported MIME type "text/plain"',
+    code: 'ERR_UNKNOWN_MODULE_FORMAT',
+    message:
+      'Unknown module format: text/plain for URL data:text/plain;base64,',
   });
   await assert.rejects(import('data:text/css,.error { color: red; }'), {
-    code: 'ERR_INVALID_MODULE_SPECIFIER',
-    message: 'Invalid module "data:text/css,.error { color: red; }" has an unsupported MIME type "text/css"',
+    code: 'ERR_UNKNOWN_MODULE_FORMAT',
+    message: 'Unknown module format: text/css for URL data:text/css,.error { color: red; }',
   });
 })().then(common.mustCall());
diff --git a/test/es-module/test-esm-loader-resolve-type.mjs b/test/es-module/test-esm-loader-resolve-type.mjs
index f4bab3723d1f46..913a7f40d2c551 100644
--- a/test/es-module/test-esm-loader-resolve-type.mjs
+++ b/test/es-module/test-esm-loader-resolve-type.mjs
@@ -30,12 +30,13 @@ fs.cpSync(
 const { importedESM: importedESMBefore,
         importedCJS: importedCJSBefore } = global.getModuleTypeStats();
 
-import(`${moduleName}`).finally(() => {
+await import(`${moduleName}`).finally(() => {
   fs.rmSync(basePath, { recursive: true, force: true });
 });
 
 const { importedESM: importedESMAfter,
         importedCJS: importedCJSAfter } = global.getModuleTypeStats();
 
+// Dynamic import above should incriment ESM counter but not CJS counter
 assert.strictEqual(importedESMBefore + 1, importedESMAfter);
 assert.strictEqual(importedCJSBefore, importedCJSAfter);
diff --git a/test/es-module/test-esm-loader-search.js b/test/es-module/test-esm-loader-search.js
index 3c451409b356db..0440d3d7775cff 100644
--- a/test/es-module/test-esm-loader-search.js
+++ b/test/es-module/test-esm-loader-search.js
@@ -10,8 +10,8 @@ const {
   defaultResolve: resolve
 } = require('internal/modules/esm/resolve');
 
-assert.throws(
-  () => resolve('target'),
+assert.rejects(
+  resolve('target'),
   {
     code: 'ERR_MODULE_NOT_FOUND',
     name: 'Error',
diff --git a/test/es-module/test-esm-resolve-type.js b/test/es-module/test-esm-resolve-type.js
index ba4dea03c8ac48..05e908cd32fc34 100644
--- a/test/es-module/test-esm-resolve-type.js
+++ b/test/es-module/test-esm-resolve-type.js
@@ -28,6 +28,7 @@ const {
 const rel = (file) => path.join(tmpdir.path, file);
 const previousCwd = process.cwd();
 const nmDir = rel('node_modules');
+
 try {
   tmpdir.refresh();
   process.chdir(tmpdir.path);
@@ -40,10 +41,10 @@ try {
     [ '/es-modules/package-type-commonjs/index.js', 'commonjs' ],
     [ '/es-modules/package-without-type/index.js', 'commonjs' ],
     [ '/es-modules/package-without-pjson/index.js', 'commonjs' ],
-  ].forEach((testVariant) => {
+  ].forEach(async (testVariant) => {
     const [ testScript, expectedType ] = testVariant;
     const resolvedPath = path.resolve(fixtures.path(testScript));
-    const resolveResult = resolve(url.pathToFileURL(resolvedPath));
+    const resolveResult = await resolve(url.pathToFileURL(resolvedPath));
     assert.strictEqual(resolveResult.format, expectedType);
   });
 
@@ -58,7 +59,7 @@ try {
     [ 'test-module-mainmjs', 'mjs', 'module', 'module'],
     [ 'test-module-cjs', 'js', 'commonjs', 'commonjs'],
     [ 'test-module-ne', 'js', undefined, 'commonjs'],
-  ].forEach((testVariant) => {
+  ].forEach(async (testVariant) => {
     const [ moduleName,
             moduleExtenstion,
             moduleType,
@@ -88,7 +89,7 @@ try {
     fs.writeFileSync(script,
                      'export function esm-resolve-tester() {return 42}');
 
-    const resolveResult = resolve(`${moduleName}`);
+    const resolveResult = await resolve(`${moduleName}`);
     assert.strictEqual(resolveResult.format, expectedResolvedType);
 
     fs.rmSync(nmDir, { recursive: true, force: true });
@@ -101,7 +102,7 @@ try {
     }
   };
 
-  function testDualPackageWithJsMainScriptAndModuleType() {
+  async function testDualPackageWithJsMainScriptAndModuleType() {
     // Create a dummy dual package
     //
     /**
@@ -171,7 +172,7 @@ try {
     );
 
     // test the resolve
-    const resolveResult = resolve(`${moduleName}`);
+    const resolveResult = await resolve(`${moduleName}`);
     assert.strictEqual(resolveResult.format, 'module');
     assert.ok(resolveResult.url.includes('my-dual-package/es/index.js'));
   }
@@ -191,7 +192,7 @@ try {
     [ 'hmod', 'index.js', 'imp.js', 'commonjs', 'module', 'module', '#Key'],
     [ 'qhmod', 'index.js', 'imp.js', 'commonjs', 'module', 'module', '?k=v#h'],
     [ 'ts-mod-com', 'index.js', 'imp.ts', 'module', 'commonjs', undefined],
-  ].forEach((testVariant) => {
+  ].forEach(async (testVariant) => {
     const [
       moduleName,
       mainRequireScript,
@@ -239,7 +240,7 @@ try {
     );
 
     // test the resolve
-    const resolveResult = resolve(`${moduleName}`);
+    const resolveResult = await resolve(`${moduleName}`);
     assert.strictEqual(resolveResult.format, expectedResolvedFormat);
     assert.ok(resolveResult.url.endsWith(`${moduleName}/subdir/${mainImportScript}${mainSuffix}`));
   });
diff --git a/test/es-module/test-http-imports.mjs b/test/es-module/test-http-imports.mjs
new file mode 100644
index 00000000000000..dfb05f3cdd12fd
--- /dev/null
+++ b/test/es-module/test-http-imports.mjs
@@ -0,0 +1,170 @@
+// Flags: --experimental-network-imports --dns-result-order=ipv4first
+import * as common from '../common/index.mjs';
+import { path, readKey } from '../common/fixtures.mjs';
+import { pathToFileURL } from 'url';
+import assert from 'assert';
+import http from 'http';
+import os from 'os';
+import util from 'util';
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+
+const https = (await import('https')).default;
+
+const createHTTPServer = http.createServer;
+
+// Needed to deal w/ test certs
+process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
+const options = {
+  key: readKey('agent1-key.pem'),
+  cert: readKey('agent1-cert.pem')
+};
+
+const createHTTPSServer = https.createServer.bind(null, options);
+
+
+const testListeningOptions = [
+  {
+    hostname: 'localhost',
+    listenOptions: {
+      host: '127.0.0.1'
+    }
+  },
+];
+
+const internalInterfaces = Object.values(os.networkInterfaces()).flat().filter(
+  (iface) => iface?.internal && iface.address && !iface.scopeid
+);
+for (const iface of internalInterfaces) {
+  testListeningOptions.push({
+    hostname: iface?.family === 'IPv6' ? `[${iface?.address}]` : iface?.address,
+    listenOptions: {
+      host: iface?.address,
+      ipv6Only: iface?.family === 'IPv6'
+    }
+  });
+}
+
+for (const { protocol, createServer } of [
+  { protocol: 'http:', createServer: createHTTPServer },
+  { protocol: 'https:', createServer: createHTTPSServer },
+]) {
+  const body = `
+    export default (a) => () => a;
+    export let url = import.meta.url;
+  `;
+
+  const base = 'http://127.0.0.1';
+  for (const { hostname, listenOptions } of testListeningOptions) {
+    const host = new URL(base);
+    host.protocol = protocol;
+    host.hostname = hostname;
+    const server = createServer(function(_req, res) {
+      const url = new URL(_req.url, host);
+      const redirect = url.searchParams.get('redirect');
+      if (redirect) {
+        const { status, location } = JSON.parse(redirect);
+        res.writeHead(status, {
+          location
+        });
+        res.end();
+        return;
+      }
+      res.writeHead(200, {
+        'content-type': url.searchParams.get('mime') || 'text/javascript'
+      });
+      res.end(url.searchParams.get('body') || body);
+    });
+
+    const listen = util.promisify(server.listen.bind(server));
+    await listen({
+      ...listenOptions,
+      port: 0
+    });
+    const url = new URL(host);
+    url.port = server?.address()?.port;
+
+    const ns = await import(url.href);
+    assert.strict.deepStrictEqual(Object.keys(ns), ['default', 'url']);
+    const obj = {};
+    assert.strict.equal(ns.default(obj)(), obj);
+    assert.strict.equal(ns.url, url.href);
+
+    // Redirects have same import.meta.url but different cache
+    // entry on Web
+    const redirect = new URL(url.href);
+    redirect.searchParams.set('redirect', JSON.stringify({
+      status: 302,
+      location: url.href
+    }));
+    const redirectedNS = await import(redirect.href);
+    assert.strict.deepStrictEqual(
+      Object.keys(redirectedNS),
+      ['default', 'url']
+    );
+    assert.strict.notEqual(redirectedNS.default, ns.default);
+    assert.strict.equal(redirectedNS.url, url.href);
+
+    const crossProtocolRedirect = new URL(url.href);
+    crossProtocolRedirect.searchParams.set('redirect', JSON.stringify({
+      status: 302,
+      location: 'data:text/javascript,'
+    }));
+    await assert.rejects(
+      import(crossProtocolRedirect.href),
+      'should not be able to redirect across protocols'
+    );
+
+    const deps = new URL(url.href);
+    deps.searchParams.set('body', `
+      export {data} from 'data:text/javascript,export let data = 1';
+      import * as http from ${JSON.stringify(url.href)};
+      export {http};
+    `);
+    const depsNS = await import(deps.href);
+    assert.strict.deepStrictEqual(Object.keys(depsNS), ['data', 'http']);
+    assert.strict.equal(depsNS.data, 1);
+    assert.strict.equal(depsNS.http, ns);
+
+    const fileDep = new URL(url.href);
+    const { href } = pathToFileURL(path('/es-modules/message.mjs'));
+    fileDep.searchParams.set('body', `
+      import ${JSON.stringify(href)};
+      export default 1;`);
+    await assert.rejects(
+      import(fileDep.href),
+      'should not be able to load file: from http:');
+
+    const builtinDep = new URL(url.href);
+    builtinDep.searchParams.set('body', `
+      import 'node:fs';
+      export default 1;
+    `);
+    await assert.rejects(
+      import(builtinDep.href),
+      'should not be able to load node: from http:'
+    );
+
+    const unprefixedBuiltinDep = new URL(url.href);
+    unprefixedBuiltinDep.searchParams.set('body', `
+      import 'fs';
+      export default 1;
+    `);
+    await assert.rejects(
+      import(unprefixedBuiltinDep.href),
+      'should not be able to load unprefixed builtins from http:'
+    );
+
+    const unsupportedMIME = new URL(url.href);
+    unsupportedMIME.searchParams.set('mime', 'application/node');
+    unsupportedMIME.searchParams.set('body', '');
+    await assert.rejects(
+      import(unsupportedMIME.href),
+      'should not be able to load unsupported MIMEs from http:'
+    );
+
+    server.close();
+  }
+}
diff --git a/test/fixtures/es-module-loaders/builtin-named-exports-loader.mjs b/test/fixtures/es-module-loaders/builtin-named-exports-loader.mjs
index 82e64567494842..8790811c7e7bd6 100644
--- a/test/fixtures/es-module-loaders/builtin-named-exports-loader.mjs
+++ b/test/fixtures/es-module-loaders/builtin-named-exports-loader.mjs
@@ -13,8 +13,8 @@ export function globalPreload() {
 `;
 }
 
-export function resolve(specifier, context, next) {
-  const def = next(specifier, context);
+export async function resolve(specifier, context, next) {
+  const def = await next(specifier, context);
 
   if (def.url.startsWith('node:')) {
     return {
diff --git a/test/fixtures/es-module-loaders/hook-resolve-type.mjs b/test/fixtures/es-module-loaders/hook-resolve-type.mjs
index 48692ba4eec544..5068d6265c57b2 100644
--- a/test/fixtures/es-module-loaders/hook-resolve-type.mjs
+++ b/test/fixtures/es-module-loaders/hook-resolve-type.mjs
@@ -2,19 +2,19 @@ let importedESM = 0;
 let importedCJS = 0;
 global.getModuleTypeStats = () => { return {importedESM, importedCJS} };
 
-export function load(url, context, next) {
+export async function load(url, context, next) {
   return next(url, context, next);
 }
 
-export function resolve(specifier, context, next) {
-  const nextResult = next(specifier, context);
+export async function resolve(specifier, context, next) {
+  const nextResult = await next(specifier, context);
   const { format } = nextResult;
 
   if (format === 'module' || specifier.endsWith('.mjs')) {
     importedESM++;
   } else if (format == null || format === 'commonjs') {
     importedCJS++;
-  } 
+  }
 
   return nextResult;
 }
diff --git a/test/fixtures/es-module-loaders/loader-with-dep.mjs b/test/fixtures/es-module-loaders/loader-with-dep.mjs
index 78a72cca6d9009..1b5fd6c3c1642a 100644
--- a/test/fixtures/es-module-loaders/loader-with-dep.mjs
+++ b/test/fixtures/es-module-loaders/loader-with-dep.mjs
@@ -3,9 +3,9 @@ import {createRequire} from '../../common/index.mjs';
 const require = createRequire(import.meta.url);
 const dep = require('./loader-dep.js');
 
-export function resolve (specifier, { parentURL, importAssertions }, defaultResolve) {
+export async function resolve(specifier, { parentURL, importAssertions }, defaultResolve) {
   return {
-    url: defaultResolve(specifier, {parentURL, importAssertions}, defaultResolve).url,
+    url: (await defaultResolve(specifier, { parentURL, importAssertions }, defaultResolve)).url,
     format: dep.format
   };
 }
diff --git a/test/fixtures/es-module-loaders/mock-loader.mjs b/test/fixtures/es-module-loaders/mock-loader.mjs
index 4187137b105616..7c4592aca96834 100644
--- a/test/fixtures/es-module-loaders/mock-loader.mjs
+++ b/test/fixtures/es-module-loaders/mock-loader.mjs
@@ -76,7 +76,7 @@ export function globalPreload({port}) {
     let mockVersion = 0;
     /**
      * This is the value that is placed into the `node:mock` default export
-     * 
+     *
      * @example
      * ```mjs
      * import mock from 'node:mock';
@@ -86,7 +86,7 @@ export function globalPreload({port}) {
      * mutator.x = 2;
      * namespace.x; // 2;
      * ```
-     * 
+     *
      * @param {string} resolved an absolute URL HREF string
      * @param {object} replacementProperties an object to pick properties from
      *                                       to act as a module namespace
@@ -168,14 +168,14 @@ export function globalPreload({port}) {
 
 
 // Rewrites node: loading to mock-facade: so that it can be intercepted
-export function resolve(specifier, context, defaultResolve) {
+export async function resolve(specifier, context, defaultResolve) {
   if (specifier === 'node:mock') {
     return {
       url: specifier
     };
   }
   doDrainPort();
-  const def = defaultResolve(specifier, context);
+  const def = await defaultResolve(specifier, context);
   if (context.parentURL?.startsWith('mock-facade:')) {
     // Do nothing, let it get the "real" module
   } else if (mockedModuleExports.has(def.url)) {
@@ -184,11 +184,11 @@ export function resolve(specifier, context, defaultResolve) {
     };
   };
   return {
-    url: `${def.url}`
+    url: def.url,
   };
 }
 
-export function load(url, context, defaultLoad) {
+export async function load(url, context, defaultLoad) {
   doDrainPort();
   if (url === 'node:mock') {
     /**
@@ -218,7 +218,7 @@ export function load(url, context, defaultLoad) {
 }
 
 /**
- * 
+ *
  * @param {Array<string>} exports name of the exports of the module
  * @returns {string}
  */
diff --git a/test/parallel/test-bootstrap-modules.js b/test/parallel/test-bootstrap-modules.js
index 596ad2c2119681..de9414abb2d648 100644
--- a/test/parallel/test-bootstrap-modules.js
+++ b/test/parallel/test-bootstrap-modules.js
@@ -1,3 +1,4 @@
+// Flags: --expose-internals
 'use strict';
 
 // This list must be computed before we require any modules to
@@ -8,22 +9,24 @@ const common = require('../common');
 const assert = require('assert');
 
 const expectedModules = new Set([
-  'Internal Binding errors',
   'Internal Binding async_wrap',
+  'Internal Binding block_list',
   'Internal Binding buffer',
   'Internal Binding config',
   'Internal Binding constants',
   'Internal Binding contextify',
   'Internal Binding credentials',
-  'Internal Binding fs',
+  'Internal Binding errors',
   'Internal Binding fs_dir',
   'Internal Binding fs_event_wrap',
+  'Internal Binding fs',
   'Internal Binding heap_utils',
   'Internal Binding messaging',
   'Internal Binding module_wrap',
   'Internal Binding native_module',
   'Internal Binding options',
   'Internal Binding performance',
+  'Internal Binding pipe_wrap',
   'Internal Binding process_methods',
   'Internal Binding report',
   'Internal Binding serdes',
@@ -31,6 +34,7 @@ const expectedModules = new Set([
   'Internal Binding string_decoder',
   'Internal Binding symbols',
   'Internal Binding task_queue',
+  'Internal Binding tcp_wrap',
   'Internal Binding timers',
   'Internal Binding trace_events',
   'Internal Binding types',
@@ -45,53 +49,58 @@ const expectedModules = new Set([
   'NativeModule internal/abort_controller',
   'NativeModule internal/assert',
   'NativeModule internal/async_hooks',
+  'NativeModule internal/blocklist',
   'NativeModule internal/bootstrap/pre_execution',
   'NativeModule internal/buffer',
   'NativeModule internal/console/constructor',
   'NativeModule internal/console/global',
   'NativeModule internal/constants',
+  'NativeModule internal/dtrace',
   'NativeModule internal/encoding',
   'NativeModule internal/errors',
   'NativeModule internal/event_target',
   'NativeModule internal/fixed_queue',
   'NativeModule internal/fs/dir',
-  'NativeModule internal/fs/utils',
   'NativeModule internal/fs/promises',
   'NativeModule internal/fs/read_file_context',
   'NativeModule internal/fs/rimraf',
+  'NativeModule internal/fs/utils',
   'NativeModule internal/fs/watchers',
   'NativeModule internal/heap_utils',
   'NativeModule internal/histogram',
   'NativeModule internal/idna',
   'NativeModule internal/linkedlist',
-  'NativeModule internal/modules/run_main',
-  'NativeModule internal/modules/package_json_reader',
   'NativeModule internal/modules/cjs/helpers',
   'NativeModule internal/modules/cjs/loader',
   'NativeModule internal/modules/esm/assert',
   'NativeModule internal/modules/esm/create_dynamic_module',
+  'NativeModule internal/modules/esm/fetch_module',
+  'NativeModule internal/modules/esm/formats',
   'NativeModule internal/modules/esm/get_format',
   'NativeModule internal/modules/esm/get_source',
-  'NativeModule internal/modules/esm/loader',
+  'NativeModule internal/modules/esm/handle_process_exit',
+  'NativeModule internal/modules/esm/initialize_import_meta',
   'NativeModule internal/modules/esm/load',
+  'NativeModule internal/modules/esm/loader',
   'NativeModule internal/modules/esm/module_job',
   'NativeModule internal/modules/esm/module_map',
   'NativeModule internal/modules/esm/resolve',
-  'NativeModule internal/modules/esm/initialize_import_meta',
   'NativeModule internal/modules/esm/translators',
-  'NativeModule internal/modules/esm/handle_process_exit',
-  'NativeModule internal/process/esm_loader',
+  'NativeModule internal/modules/package_json_reader',
+  'NativeModule internal/modules/run_main',
+  'NativeModule internal/net',
   'NativeModule internal/options',
   'NativeModule internal/perf/event_loop_delay',
   'NativeModule internal/perf/event_loop_utilization',
   'NativeModule internal/perf/nodetiming',
   'NativeModule internal/perf/observe',
-  'NativeModule internal/perf/performance',
   'NativeModule internal/perf/performance_entry',
+  'NativeModule internal/perf/performance',
   'NativeModule internal/perf/timerify',
   'NativeModule internal/perf/usertiming',
   'NativeModule internal/perf/utils',
   'NativeModule internal/priority_queue',
+  'NativeModule internal/process/esm_loader',
   'NativeModule internal/process/execution',
   'NativeModule internal/process/per_thread',
   'NativeModule internal/process/promises',
@@ -101,6 +110,7 @@ const expectedModules = new Set([
   'NativeModule internal/process/warning',
   'NativeModule internal/promise_hooks',
   'NativeModule internal/querystring',
+  'NativeModule internal/socketaddress',
   'NativeModule internal/source_map/source_map_cache',
   'NativeModule internal/stream_base_commons',
   'NativeModule internal/streams/add-abort-signal',
@@ -133,6 +143,7 @@ const expectedModules = new Set([
   'Internal Binding blob',
   'NativeModule internal/blob',
   'NativeModule async_hooks',
+  'NativeModule net',
   'NativeModule path',
   'NativeModule perf_hooks',
   'NativeModule querystring',
@@ -189,6 +200,11 @@ if (process.env.NODE_V8_COVERAGE) {
   expectedModules.add('Internal Binding profiler');
 }
 
+const { internalBinding } = require('internal/test/binding');
+if (internalBinding('config').hasDtrace) {
+  expectedModules.add('Internal Binding dtrace');
+}
+
 const difference = (setA, setB) => {
   return new Set([...setA].filter((x) => !setB.has(x)));
 };
diff --git a/test/pummel/test-policy-integrity-dep.js b/test/pummel/test-policy-integrity-dep.js
index 1b64e2bc99b1ea..ec58462335cd56 100644
--- a/test/pummel/test-policy-integrity-dep.js
+++ b/test/pummel/test-policy-integrity-dep.js
@@ -174,6 +174,7 @@ function drainQueue() {
         console.log('exit code:', status, 'signal:', signal);
         console.log(`stdout: ${Buffer.concat(stdout)}`);
         console.log(`stderr: ${Buffer.concat(stderr)}`);
+        process.kill(process.pid, 'SIGKILL');
         throw e;
       }
       fs.rmSync(configDirPath, { maxRetries: 3, recursive: true, force: true });