esm: throw on any non-2xx response

Treat redirects without Location and other 3xx responses as errors PR-URL: nodejs#43742 Refs: nodejs#43689 Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Jacob Smith <[email protected]>
LiviaMedeiros · Jul 12, 2022 · b3f2af9 · b3f2af9
1 parent 3aec7da
commit b3f2af9
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/lib/internal/modules/esm/fetch_module.js b/lib/internal/modules/esm/fetch_module.js
@@ -148,7 +148,9 @@ function fetchWithRedirects(parsed) {
         err.message = `Cannot find module '${parsed.href}', HTTP 404`;
         throw err;
       }
-      if (res.statusCode < 200 || res.statusCode >= 400) {
+      // This condition catches all unsupported status codes, including
+      // 3xx redirection codes without `Location` HTTP header.
+      if (res.statusCode < 200 || res.statusCode >= 300) {
         throw new ERR_NETWORK_IMPORT_DISALLOWED(
           res.headers.location,
           parsed.href,