esm: throw on any non-2xx response

LiviaMedeiros · danielleadams · commit 9b5b8d78c3ad · 2022-07-25T21:43:29.000-04:00
Treat redirects without Location and other 3xx responses as errors PR-URL: #43742 Refs: #43689 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Jacob Smith <jacob@frende.me>
diff --git a/lib/internal/modules/esm/fetch_module.js b/lib/internal/modules/esm/fetch_module.js
@@ -148,7 +148,9 @@ function fetchWithRedirects(parsed) {
         err.message = `Cannot find module '${parsed.href}', HTTP 404`;
         throw err;
       }
-      if (res.statusCode < 200 || res.statusCode >= 400) {
+      // This condition catches all unsupported status codes, including
+      // 3xx redirection codes without `Location` HTTP header.
+      if (res.statusCode < 200 || res.statusCode >= 300) {
         throw new ERR_NETWORK_IMPORT_DISALLOWED(
           res.headers.location,
           parsed.href,
