new URL("/my/file.js?wow", import.meta.url) doesn't provide "?wow" param to a plugin

[wclr]

Describe the bug

new URL("/my/file.js?wow", import.meta.url)

doesn't provide "?wow" param in resolveId or transform handlers. In transform /my/file.js?type=classic&worker_file but no custom "wow" param.

Reproduction

https://stackblitz.com/edit/vitejs-vite-kjwrqy?file=vite.config.js,main.js,index.html&terminal=dev

In the terminal you may see (no ?wow param)

resolve id /test.js?type=module&worker_file
resolve id /test.js?type=module&worker_file

Steps to reproduce

new URL("/my/file.js?wow", import.meta.url)

Create plugin with resolveId and trasnform and see id.

System Info

VITE v5.0.7

Used Package Manager

pnpm

Logs

No response

Validations

• [X] Follow our Code of Conduct
• [X] Read the Contributing Guidelines.
• [X] Read the docs.
• [X] Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• [X] Make sure this is a Vite issue and not a framework-specific issue. For example, if it's a Vue SFC related bug, it should likely be reported to vuejs/core instead.
• [X] Check that this is a concrete bug. For Q&A open a GitHub Discussion or join our Discord Chat Server.
• [X] The provided reproduction is a minimal reproducible example of the bug.

[stackblitz[bot]]

Start a new pull request in StackBlitz Codeflow.

• vitejs-vite-kjwrqy (Open reproduction)

[sapphi-red]

Your reproduction doesn't include the plugin and the code.

[github-actions[bot]]

Hello @wclr. Please provide a minimal reproduction using a GitHub repository or StackBlitz. Issues marked with need reproduction will be closed if they have no activity within 3 days.

[wclr]

Hello @wclr. Please provide a minimal reproduction using a GitHub repository or StackBlitz. Issues marked with need reproduction will be closed if they have no activity within 3 days.

I have updated it.

[chaejunlee]

I am kind of curious. Should it be /my/file.js?wow&type=classic&worker_file?

And it looks like the search params are being intentionally deleted to make it safe. If we were to bring the the params back, how should we bring it back safely? Or do params cause no security harm at all?

https://github.com/vitejs/vite/blob/c902545476a4e7ba044c35b568e73683758178a3/packages/vite/src/node/plugins/workerImportMetaUrl.ts#L182-L184

https://github.com/vitejs/vite/blob/c902545476a4e7ba044c35b568e73683758178a3/packages/vite/src/node/utils.ts#L288-L291

[wclr]

Another thing that is related to file params, is that during the build plugins (neither rollupOptions.plugins no worker.plugins) do not get any access to to params (in resolveId or transform).

Also during the build for new Worker(new URL( ids do not have worker_file params (added by vite in dev mode) . So, it is not possible to identify if the module is loaded as worker entry. This is just an example of inconsistency that dev and build have.

[hi-ogawa]

One more reference as it hasn't been mentioned yet. It doesn't change the fact that new URL(...) is inconsistent, but the worker url import ?worker&url seems to naturally work with resolveId/transform hooks.

https://stackblitz.com/edit/vitejs-vite-xrrkvk?file=main.js

import workerUrl2 from './test2.js?wow2&worker&url';

const worker2 = new Worker(workerUrl2, { type: 'module' });

// -- log --
// commmon resolve id ./test2.js?wow2&worker&url
// commmon transform id /home/projects/vitejs-vite-xrrkvk/test2.js?wow2&worker&url
// commmon resolve id /test2.js?type=module&worker_file
// commmon resolve id /test2.js?type=module&worker_file
// commmon transform id /home/projects/vitejs-vite-xrrkvk/test2.js?type=module&worker_file