Commit 80ced1a
esm: treat 307 and 308 as redirects in HTTPS imports
Per RFC 7231 and 7238, HTTP `307` and `308` status code are also for
redirect responses.
Fixes: #43679
Refs: https://datatracker.ietf.org/doc/html/rfc7231#section-6.4.7
Refs: https://datatracker.ietf.org/doc/html/rfc7238
PR-URL: #43689
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
Reviewed-By: Zijian Liu <lxxyxzj@gmail.com>
Reviewed-By: LiviaMedeiros <livia@cirno.name>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Jacob Smith <jacob@frende.me>1 parent 7ee0be7 commit 80ced1a
1 file changed
Lines changed: 24 additions & 3 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -89,6 +89,28 @@ function createUnzip() { | |||
| 89 | 89 | return createUnzip(); | |
| 90 | 90 | } | |
| 91 | 91 | ||
| 92 | + /** | ||
| 93 | + * Redirection status code as per section 6.4 of RFC 7231: | ||
| 94 | + * https://datatracker.ietf.org/doc/html/rfc7231#section-6.4 | ||
| 95 | + * and RFC 7238: | ||
| 96 | + * https://datatracker.ietf.org/doc/html/rfc7238 | ||
| 97 | + * @param {number} statusCode | ||
| 98 | + * @returns {boolean} | ||
| 99 | + */ | ||
| 100 | + function isRedirect(statusCode) { | ||
| 101 | + switch (statusCode) { | ||
| 102 | + case 300: // Multiple Choices | ||
| 103 | + case 301: // Moved Permanently | ||
| 104 | + case 302: // Found | ||
| 105 | + case 303: // See Other | ||
| 106 | + case 307: // Temporary Redirect | ||
| 107 | + case 308: // Permanent Redirect | ||
| 108 | + return true; | ||
| 109 | + default: | ||
| 110 | + return false; | ||
| 111 | + } | ||
| 112 | + } | ||
| 113 | + | ||
| 92 | 114 | /** | |
| 93 | 115 | * @param {URL} parsed | |
| 94 | 116 | * @returns {Promise<CacheEntry> | CacheEntry} | |
@@ -107,9 +129,8 @@ function fetchWithRedirects(parsed) { | |||
| 107 | 129 | // `finally` on network error/timeout. | |
| 108 | 130 | const { 0: res } = await once(req, 'response'); | |
| 109 | 131 | try { | |
| 110 | - const isRedirect = res.statusCode >= 300 && res.statusCode <= 303; | ||
| 111 | 132 | const hasLocation = ObjectPrototypeHasOwnProperty(res.headers, 'location'); | |
| 112 | - if (isRedirect && hasLocation) { | ||
| 133 | + if (isRedirect(res.statusCode) && hasLocation) { | ||
| 113 | 134 | const location = new URL(res.headers.location, parsed); | |
| 114 | 135 | if (location.protocol !== 'http:' && location.protocol !== 'https:') { | |
| 115 | 136 | throw new ERR_NETWORK_IMPORT_DISALLOWED( | |
@@ -127,7 +148,7 @@ function fetchWithRedirects(parsed) { | |||
| 127 | 148 | err.message = `Cannot find module '${parsed.href}', HTTP 404`; | |
| 128 | 149 | throw err; | |
| 129 | 150 | } | |
| 130 | - if (res.statusCode > 303 || res.statusCode < 200) { | ||
| 151 | + if (res.statusCode < 200 || res.statusCode >= 400) { | ||
| 131 | 152 | throw new ERR_NETWORK_IMPORT_DISALLOWED( | |
| 132 | 153 | res.headers.location, | |
| 133 | 154 | parsed.href, | |
0 commit comments