esm: throw on any non-2xx response

Treat redirects without Location and other 3xx responses as errors PR-URL: #43742 Refs: #43689 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Jacob Smith <jacob@frende.me>
nodejs · Jul 26, 2022 · 9b5b8d7 · 9b5b8d7
1 parent f28198c
commit 9b5b8d7
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/lib/internal/modules/esm/fetch_module.js b/lib/internal/modules/esm/fetch_module.js
@@ -148,7 +148,9 @@ function fetchWithRedirects(parsed) {
         err.message = `Cannot find module '${parsed.href}', HTTP 404`;
         throw err;
       }
-      if (res.statusCode < 200 || res.statusCode >= 400) {
+      // This condition catches all unsupported status codes, including
+      // 3xx redirection codes without `Location` HTTP header.
+      if (res.statusCode < 200 || res.statusCode >= 300) {
         throw new ERR_NETWORK_IMPORT_DISALLOWED(
           res.headers.location,
           parsed.href,