esm: throw on any non-2xx response

Treat redirects without Location and other 3xx responses as errors PR-URL: nodejs/node#43742 Refs: nodejs/node#43689 Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Jacob Smith <[email protected]>
noslate-project · Oct 10, 2022 · 910586f · 910586f
1 parent 710c66d
commit 910586f
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/lib/internal/modules/esm/fetch_module.js b/lib/internal/modules/esm/fetch_module.js
@@ -148,7 +148,9 @@ function fetchWithRedirects(parsed) {
         err.message = `Cannot find module '${parsed.href}', HTTP 404`;
         throw err;
       }
-      if (res.statusCode < 200 || res.statusCode >= 400) {
+      // This condition catches all unsupported status codes, including
+      // 3xx redirection codes without `Location` HTTP header.
+      if (res.statusCode < 200 || res.statusCode >= 300) {
         throw new ERR_NETWORK_IMPORT_DISALLOWED(
           res.headers.location,
           parsed.href,