Skip to content

fix(input): reject non-OK HTTP responses when reading from a URL#3014

Merged
schani merged 1 commit into
masterfrom
agent/fix-issue-2572
Jul 20, 2026
Merged

fix(input): reject non-OK HTTP responses when reading from a URL#3014
schani merged 1 commit into
masterfrom
agent/fix-issue-2572

Conversation

@schani

@schani schani commented Jul 20, 2026

Copy link
Copy Markdown
Member

Bug

When quicktype reads JSON/JSON Schema input from a URL (--src http://...)
and the server returns an HTTP error status (e.g. a 401 caused by an expired
auth token passed via --http-header), quicktype did not report an error.
Instead it silently treated the error response body as legitimate input:

  • If the error body happened to be valid JSON, quicktype generated types
    from it and exited 0.
  • If it wasn't valid JSON, quicktype emitted a misleading "Syntax error in
    input JSON" with no indication the real cause was an HTTP failure.

Root cause

In packages/quicktype-core/src/input/io/NodeIO.ts,
readableFromFileOrURL called globalThis.fetch() and passed
response.body straight to the parser with no response.ok / status check:

const response = await globalThis.fetch(fileOrURL, {
    headers: parseHeaders(httpHeaders),
});

return readableFromResponseBody(defined(response.body));

Fix

Check response.ok right after the fetch call and throw a clear error
(including the HTTP status) when the response is not OK, instead of handing
the error body to the parser:

if (!response.ok) {
    throw new Error(`HTTP ${response.status} ${response.statusText}`);
}

Test coverage

Added a unit test in test/unit/url-input.test.ts (this bug is Node-only
HTTP-fetch behavior that the JSON/JSON Schema fixture-test machinery has no
mechanism to exercise, since fixtures drive file-based input, not an HTTP
server): the local test server now returns HTTP 401 with a JSON body for
unauthorized.json, and a new test asserts readFromFileOrURL rejects with
an error containing HTTP 401 Unauthorized instead of resolving.

Verification

  • Confirmed the bug on unfixed master: a local server returning HTTP 401
    with a JSON body caused node dist/index.js --lang typescript --src http://localhost:8473/data.json --just-types to print a bogus TypeScript
    interface derived from the error body and exit 0.
  • After the fix, the same repro now fails as expected:
    Error: Cannot read from file or URL http://localhost:8473/data.json: Error: HTTP 401 Unauthorized.
    
    with exit code 1.
  • npm run build passes.
  • npx vitest run test/unit/url-input.test.ts passes (3/3, including the
    new test).
  • Full CI (broader fixture suite) will validate the rest.

Fixes #2572

🤖 Generated with Claude Code

quicktype's URL input reader handed the fetch response body straight to
the JSON parser without checking response.ok, so an HTTP error (e.g. a
401 from an expired auth token) whose body happened to be valid JSON
was silently treated as legitimate input, generating types from the
error payload and exiting 0. Now readableFromFileOrURL throws a clear
error including the HTTP status when the response is not OK.

Co-Authored-By: gpt-5.6-sol via pi <noreply@openai.com>
@schani
schani merged commit d235426 into master Jul 20, 2026
28 checks passed
@schani
schani deleted the agent/fix-issue-2572 branch July 20, 2026 21:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG]: http error is unhandled and empty content is returned

1 participant