{"id":"0b44918370147972","repo":"vitest-dev/vitest","slug":"import-of-fileurl-by-undefined-is-not-support","errorCode":null,"errorMessage":"import of '${fileUrl}' by undefined is not supported: http can only be used to load local resources (use https instead).","messagePattern":"import of '(.+?)' by undefined is not supported: http can only be used to load local resources \\(use https instead\\)\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/vitest/src/runtime/vm/esm-executor.ts","lineNumber":125,"sourceCode":"    const cached = this.moduleCache.get(fileUrl)\n    if (cached) {\n      return cached\n    }\n    const m = this.loadWebAssemblyModule(getCode(), fileUrl)\n    this.moduleCache.set(fileUrl, m)\n    return m\n  }\n\n  public async createNetworkModule(fileUrl: string): Promise<VMModule> {\n    // https://nodejs.org/api/esm.html#https-and-http-imports\n    if (fileUrl.startsWith('http:')) {\n      const url = new URL(fileUrl)\n      if (\n        url.hostname !== 'localhost'\n        && url.hostname !== '::1'\n        && (IPnumber(url.hostname) & IPmask(8)) !== this.#httpIp\n      ) {\n        throw new Error(\n          // we don't know the importer, so it's undefined (the same happens in --pool=threads)\n          `import of '${fileUrl}' by undefined is not supported: `\n          + 'http can only be used to load local resources (use https instead).',\n        )\n      }\n    }\n\n    return this.createEsModule(fileUrl, () =>\n      fetch(fileUrl).then(r => r.text()))\n  }\n\n  public async loadWebAssemblyModule(source: Buffer<ArrayBuffer>, identifier: string): Promise<VMModule> {\n    const cached = this.moduleCache.get(identifier)\n    if (cached) {\n      return cached\n    }\n\n    const wasmModule = await WebAssembly.compile(source)","sourceCodeStart":107,"sourceCodeEnd":143,"githubUrl":"https://github.com/vitest-dev/vitest/blob/d568f8ce3739b532d5bf2c1ee1e45e8a8a473d09/packages/vitest/src/runtime/vm/esm-executor.ts#L107-L143","documentation":"Thrown by EsmExecutor.createNetworkModule when an `http:` import is attempted and the host is not a local loopback address (localhost, ::1, or an address in 127.0.0.0/8). For security, Vitest only permits http: imports that resolve to the local machine; remote http imports must use https. The 'by undefined' part reflects that the importer is not known at network-module creation time.","triggerScenarios":"A test file (or a module it imports) uses a bare `http://example.com/...` import specifier while running under Vitest's vm/threads pool with the ESM executor. The host resolves to a non-loopback IP, so the guard trips.","commonSituations":"Importing a remote module via http during tests. Copying example code that uses http data URLs. Misconfigured local server hostname that does not resolve to 127.0.0.0/8.","solutions":["Switch the import from `http://` to `https://` for remote resources.","If you genuinely need a local http server, ensure the URL host is `localhost` or `127.x.x.x`.","Avoid remote http imports in tests entirely; vendor the module locally and import it as a file.","Fetch the resource at runtime with global fetch instead of using an import specifier."],"exampleFix":"// before\nimport data from 'http://example.com/data.json'\n\n// after\nimport data from 'https://example.com/data.json'\n// or vendored locally:\nimport data from './fixtures/data.json'","handlingStrategy":"validation","validationCode":"function assertSafeHttpImport(url: string) {\n  const u = new URL(url)\n  if (u.protocol === 'http:' && u.hostname !== 'localhost' && u.hostname !== '::1' && !u.hostname.startsWith('127.')) {\n    throw new Error('Use https:// or a loopback http:// URL')\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Prefer https:// over http:// for any remote import.","Restrict http:// imports to localhost / 127.0.0.0/8.","Vendor remote modules locally instead of importing over the network."],"tags":["network","security","esm","vm"],"analyzedSha":"d568f8ce3739b532d5bf2c1ee1e45e8a8a473d09","analyzedAt":"2026-08-03T20:23:56.861Z","schemaVersion":2}