From b3f2af9ba8147357b41f1f834a0621aab9644274 Mon Sep 17 00:00:00 2001 From: LiviaMedeiros Date: Sat, 9 Jul 2022 08:32:12 +0800 Subject: [PATCH] esm: throw on any non-2xx response Treat redirects without Location and other 3xx responses as errors PR-URL: https://github.com/nodejs/node/pull/43742 Refs: https://github.com/nodejs/node/pull/43689 Reviewed-By: Antoine du Hamel Reviewed-By: Jacob Smith --- lib/internal/modules/esm/fetch_module.js | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/lib/internal/modules/esm/fetch_module.js b/lib/internal/modules/esm/fetch_module.js index 19ff8c4b946346..7638f94b3fe525 100644 --- a/lib/internal/modules/esm/fetch_module.js +++ b/lib/internal/modules/esm/fetch_module.js @@ -148,7 +148,9 @@ function fetchWithRedirects(parsed) { err.message = `Cannot find module '${parsed.href}', HTTP 404`; throw err; } - if (res.statusCode < 200 || res.statusCode >= 400) { + // This condition catches all unsupported status codes, including + // 3xx redirection codes without `Location` HTTP header. + if (res.statusCode < 200 || res.statusCode >= 300) { throw new ERR_NETWORK_IMPORT_DISALLOWED( res.headers.location, parsed.href,