Commit d7188af
http: harden ClientRequest options merge
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: #63082
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>1 parent 5a93bde commit d7188af
2 files changed
Lines changed: 63 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -209,7 +209,7 @@ function ClientRequest(input, options, cb) { | |||
| 209 | 209 | cb = options; | |
| 210 | 210 | options = input || kEmptyObject; | |
| 211 | 211 | } else { | |
| 212 | - options = ObjectAssign(input || {}, options); | ||
| 212 | + options = ObjectAssign({ __proto__: null }, input, options); | ||
| 213 | 213 | } | |
| 214 | 214 | ||
| 215 | 215 | let agent = options.agent; | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -0,0 +1,62 @@ | |||
| 1 | + 'use strict'; | ||
| 2 | + | ||
| 3 | + const common = require('../common'); | ||
| 4 | + const assert = require('node:assert'); | ||
| 5 | + const http = require('node:http'); | ||
| 6 | + | ||
| 7 | + const server = http.createServer(common.mustCall((req, res) => { | ||
| 8 | + req.resume(); | ||
| 9 | + req.on('end', common.mustCall(() => { | ||
| 10 | + res.end('ok'); | ||
| 11 | + })); | ||
| 12 | + }, 2)); | ||
| 13 | + | ||
| 14 | + function makeRequest(options, callback) { | ||
| 15 | + Object.defineProperty(Object.prototype, 'hostname', { | ||
| 16 | + __proto__: null, | ||
| 17 | + configurable: true, | ||
| 18 | + get: common.mustNotCall('get %Object.prototype%.hostname'), | ||
| 19 | + }); | ||
| 20 | + | ||
| 21 | + let req; | ||
| 22 | + try { | ||
| 23 | + req = http.request(options, callback); | ||
| 24 | + } finally { | ||
| 25 | + delete Object.prototype.hostname; | ||
| 26 | + } | ||
| 27 | + | ||
| 28 | + req.on('error', common.mustNotCall()); | ||
| 29 | + req.end(); | ||
| 30 | + } | ||
| 31 | + | ||
| 32 | + server.listen(0, common.localhostIPv4, common.mustCall(() => { | ||
| 33 | + const { address, port } = server.address(); | ||
| 34 | + | ||
| 35 | + makeRequest( | ||
| 36 | + { | ||
| 37 | + host: address, | ||
| 38 | + port, | ||
| 39 | + path: '/', | ||
| 40 | + }, | ||
| 41 | + common.mustCall((res) => { | ||
| 42 | + assert.strictEqual(res.statusCode, 200); | ||
| 43 | + res.resume(); | ||
| 44 | + res.on('end', common.mustCall()); | ||
| 45 | + }), | ||
| 46 | + ); | ||
| 47 | + | ||
| 48 | + const nullProtoOptions = { __proto__: null, host: address, port, path: '/' }; | ||
| 49 | + | ||
| 50 | + assert.strictEqual(Object.getPrototypeOf(nullProtoOptions), null); | ||
| 51 | + | ||
| 52 | + makeRequest( | ||
| 53 | + nullProtoOptions, | ||
| 54 | + common.mustCall((res) => { | ||
| 55 | + assert.strictEqual(res.statusCode, 200); | ||
| 56 | + res.resume(); | ||
| 57 | + res.on('end', common.mustCall(() => { | ||
| 58 | + server.close(common.mustCall()); | ||
| 59 | + })); | ||
| 60 | + }), | ||
| 61 | + ); | ||
| 62 | + })); | ||
0 commit comments