fix: discard provider redirect reply bodies

I try to cancel a present redirect response body before following or
rejecting each hop, using the existing disposal helper. The cancellation
promise is not awaited and errors are ignored. Cleanup is best-effort,
not guaranteed connection release; a custom synchronous cancel can still
block.

Origin and credential checks, redirect limits and the shared deadline
are unchanged. The final non-redirect body stays with the caller.

Fixes #1126

Author: rowkav09

src/providers/request.js

@@ -17,6 +17,10 @@ export async function fetchWithTimeout(fetchImpl, url, init = {}, timeoutMs = RE
       // own. A different port on the same host is a different origin too.
       const response = await fetchImpl(target.toString(), { ...init, signal, redirect: "manual" });
       if (!REDIRECTS.has(response.status)) return response;
+      // Redirect replies are never read. Try to cancel a present hop body
+      // before following or failing. The cancellation promise is not awaited
+      // and errors are ignored; a custom synchronous cancel may still block.
+      discardResponseBody(response);
       if (hops >= MAX_REDIRECTS) throw new Error("Provider request redirected too many times");
       const location = response.headers?.get?.("location");
       if (!location) throw new Error("Provider request redirected without a location");

test/provider-redirect-cleanup.test.js

@@ -0,0 +1,57 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { fetchWithTimeout } from "../src/providers/request.js";
+
+function trackedRedirect(cancels, location) {
+  const body = new ReadableStream({ cancel() { cancels.count += 1; } });
+  return new Response(body, { status: 302, headers: location === null ? {} : { location } });
+}
+
+test("followed redirect hop bodies are discarded", async () => {
+  const cancels = { count: 0 };
+  let calls = 0;
+  const fetchImpl = async () => {
+    calls += 1;
+    if (calls < 3) return trackedRedirect(cancels, `/hop${calls}`);
+    return new Response(JSON.stringify({ ok: true }), { status: 200, headers: { "content-type": "application/json" } });
+  };
+  const response = await fetchWithTimeout(fetchImpl, "https://media.example.test/Sessions");
+  assert.equal(response.status, 200);
+  assert.deepEqual(await response.json(), { ok: true });
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.equal(cancels.count, 2);
+});
+
+for (const [mode, expectedCalls, matcher] of [
+  ["loop", 4, /redirected too many times/],
+  ["no-location", 1, /redirected without a location/],
+  ["cross-origin", 1, /outside its origin/],
+]) {
+  test(`failing redirect reply bodies are discarded (${mode})`, async () => {
+    const cancels = { count: 0 };
+    let calls = 0;
+    const fetchImpl = async () => {
+      calls += 1;
+      const location = mode === "no-location" ? null : mode === "cross-origin" ? "https://other.invalid/x" : "/loop";
+      return trackedRedirect(cancels, location);
+    };
+    await assert.rejects(fetchWithTimeout(fetchImpl, "https://media.example.test/Sessions"), matcher);
+    await new Promise((resolve) => setImmediate(resolve));
+    assert.equal(calls, expectedCalls);
+    assert.equal(cancels.count, expectedCalls);
+  });
+}
+
+for (const mode of ["throw", "reject", "pending"]) {
+  test(`redirect cleanup ignores errors and does not await its promise (${mode})`, async () => {
+    let discarded = false;
+    const fetchImpl = async () => ({ status: 302, headers: { get: () => "https://other.invalid/x" }, body: { cancel() {
+      discarded = true;
+      if (mode === "throw") throw new Error("cleanup failed");
+      if (mode === "reject") return Promise.reject(new Error("cleanup failed"));
+      return new Promise(() => {});
+    } } });
+    await assert.rejects(fetchWithTimeout(fetchImpl, "https://media.example.test/Sessions"), /outside its origin/);
+    assert.equal(discarded, true);
+  });
+}