fix(input): reject non-OK HTTP responses when reading from a URL#3014
Merged
Conversation
quicktype's URL input reader handed the fetch response body straight to the JSON parser without checking response.ok, so an HTTP error (e.g. a 401 from an expired auth token) whose body happened to be valid JSON was silently treated as legitimate input, generating types from the error payload and exiting 0. Now readableFromFileOrURL throws a clear error including the HTTP status when the response is not OK. Co-Authored-By: gpt-5.6-sol via pi <noreply@openai.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bug
When quicktype reads JSON/JSON Schema input from a URL (
--src http://...)and the server returns an HTTP error status (e.g. a 401 caused by an expired
auth token passed via
--http-header), quicktype did not report an error.Instead it silently treated the error response body as legitimate input:
from it and exited 0.
input JSON" with no indication the real cause was an HTTP failure.
Root cause
In
packages/quicktype-core/src/input/io/NodeIO.ts,readableFromFileOrURLcalledglobalThis.fetch()and passedresponse.bodystraight to the parser with noresponse.ok/ status check:Fix
Check
response.okright after the fetch call and throw a clear error(including the HTTP status) when the response is not OK, instead of handing
the error body to the parser:
Test coverage
Added a unit test in
test/unit/url-input.test.ts(this bug is Node-onlyHTTP-fetch behavior that the JSON/JSON Schema fixture-test machinery has no
mechanism to exercise, since fixtures drive file-based input, not an HTTP
server): the local test server now returns HTTP 401 with a JSON body for
unauthorized.json, and a new test assertsreadFromFileOrURLrejects withan error containing
HTTP 401 Unauthorizedinstead of resolving.Verification
with a JSON body caused
node dist/index.js --lang typescript --src http://localhost:8473/data.json --just-typesto print a bogus TypeScriptinterface derived from the error body and exit 0.
npm run buildpasses.npx vitest run test/unit/url-input.test.tspasses (3/3, including thenew test).
Fixes #2572
🤖 Generated with Claude Code