fetchJson in packages/cli/src/config/extensions/github_fetch.ts uses post-increment (redirectCount++) when passing the redirect count to the recursive call. Post-increment evaluates to the current value before incrementing, so every recursive call receives the original value (0). This means the redirect limit check (redirectCount >= 10) on line 28 never triggers, allowing unbounded redirects.
The sibling function downloadFile in github.ts:546 correctly uses redirectCount + 1.
Steps to reproduce
- Set up a server that returns infinite 301/302 redirects
- Call
fetchJson with that URL
- Observe that the function follows redirects indefinitely instead of stopping at 10
Expected behavior
fetchJson should stop following redirects after 10 hops, consistent with downloadFile.
Actual behavior
fetchJson follows redirects indefinitely because the counter is never incremented in the recursive call.
fetchJsoninpackages/cli/src/config/extensions/github_fetch.tsuses post-increment (redirectCount++) when passing the redirect count to the recursive call. Post-increment evaluates to the current value before incrementing, so every recursive call receives the original value (0). This means the redirect limit check (redirectCount >= 10) on line 28 never triggers, allowing unbounded redirects.The sibling function
downloadFileingithub.ts:546correctly usesredirectCount + 1.Steps to reproduce
fetchJsonwith that URLExpected behavior
fetchJsonshould stop following redirects after 10 hops, consistent withdownloadFile.Actual behavior
fetchJsonfollows redirects indefinitely because the counter is never incremented in the recursive call.