SIGN IN SIGN UP
denoland / deno UNCLAIMED

A modern runtime for JavaScript and TypeScript.

0 0 16 Rust

fix(ext/http): reject Response-like return from respondWith (#34589)

## Summary

When `respondWith` for the legacy `Deno.serveHttp` is called with an
object whose prototype chain matches `Response` but which doesn't carry
Deno's internal slot — e.g. `Object.create(Response.prototype)`, a
subclass that skipped `super()`, or a polyfilled/foreign-realm Response
—
the call crashes with:

```
TypeError: Cannot read properties of undefined (reading 'body')
    at respondWith (ext:deno_http/01_http.js:...)
```

`toInnerResponse(resp)` returns `undefined` in that case and the next
line reads `innerResp.body`. This mirrors the bug pattern that
`Deno.serve` had upstream (denoland/deno#34327), fixed for the
`00_serve.ts` path in #34416. The legacy `01_http.js` path was missed by
that change but is still callable: `Deno.serveHttp` is "soft-removed"
in Deno 2, not removed, and exposed via `Deno[Deno.internal]`.

Re-add the same focused guard against the internal slot here so
the case is rejected with a clear `TypeError` instead of crashing with
the cryptic `'body'` access.

## Test plan

New `httpServerRespondWithResponseLike` in `tests/unit/http_test.ts`
builds a `Response`-prototyped object with no internal slot (matching
the helper used by `handleServeCallbackReturnsResponseLike` in
`serve_test.ts`), passes it to `respondWith` from a `Deno.serveHttp`
request event, and asserts that the call rejects with a `TypeError`
whose message points the user at the realm/constructor mismatch —
instead of crashing with `Cannot read properties of undefined
(reading 'body')`.

Verified locally:

```
$ cargo test --test unit -- http_test
test unit::http_test ... ok (19594ms)
1 tests passed
```

Closes denoland/orchid#340

Co-authored-by: divybot <divybot@users.noreply.github.com>
Co-authored-by: Divy Srivastava <me@littledivy.com>
E
em committed
effd531beadc12c53373cc6680b47f8c2c97137a
Parent: e3a9cc5
Committed by GitHub <noreply@github.com> on 5/31/2026, 5:35:14 AM