https-proxy-agent - npm Package Compare versions

Comparing version 2.2.2 to 2.2.3

index.d.ts

@@ -7,3 +7,3 @@ declare module 'https-proxy-agent' {
             host: string
-            port: number
+            port: number | string
             secureProxy?: boolean
@@ -10,0 +10,0 @@ headers?: {

index.js

@@ -8,2 +8,3 @@ /**
 var url = require('url');
+var events = require('events');
 var Agent = require('agent-base');
@@ -95,3 +96,2 @@ var inherits = require('util').inherits;
   function cleanup() {
-    socket.removeListener('data', ondata);
     socket.removeListener('end', onend);
@@ -125,7 +125,3 @@ socket.removeListener('error', onerror);
       debug('have not received end of HTTP headers yet...');
-      if (socket.read) {
-        read();
-      } else {
-        socket.once('data', ondata);
-      }
+      read();
       return;
@@ -161,9 +157,19 @@ }
       cleanup();
+      req.once('socket', resume);
       fn(null, sock);
     } else {
       // some other status code that's not 200... need to re-play the HTTP header
-      // "data" events onto the socket once the HTTP machinery is attached so that
-      // the user can parse and handle the error status code
+      // "data" events onto the socket once the HTTP machinery is attached so
+      // that the node core `http` can parse and handle the error status code
       cleanup();
 
+      // the original socket is closed, and a "fake socket" EventEmitter is
+      // returned instead, so that the proxy doesn't get the HTTP request
+      // written to it (which may contain `Authorization` headers or other
+      // sensitive data).
+      //
+      // See: https://hackerone.com/reports/541502
+      socket.destroy();
+      socket = new events.EventEmitter();
+
       // save a reference to the concat'd Buffer for the `onsocket` callback
@@ -174,2 +180,3 @@ buffers = buffered;
       req.once('socket', onsocket);
+
       fn(null, socket);
@@ -180,9 +187,7 @@ }
   function onsocket(socket) {
+    debug('replaying proxy buffer for failed request');
+
     // replay the "buffers" Buffer onto the `socket`, since at this point
     // the HTTP module machinery has been hooked up for the user
-    if ('function' == typeof socket.ondata) {
-      // node <= v0.11.3, the `ondata` function is set on the socket
-      socket.ondata(buffers, 0, buffers.length);
-    } else if (socket.listeners('data').length > 0) {
-      // node > v0.11.3, the "data" event is listened for directly
+    if (socket.listenerCount('data') > 0) {
       socket.emit('data', buffers);
@@ -202,7 +207,3 @@ } else {
 
-  if (socket.read) {
-    read();
-  } else {
-    socket.once('data', ondata);
-  }
+  read();
 
@@ -234,4 +235,15 @@ var hostname = opts.host + ':' + opts.port;
 
+/**
+ * Resumes a socket.
+ *
+ * @param {(net.Socket|tls.Socket)} socket The socket to resume
+ * @api public
+ */
+
+function resume(socket) {
+  socket.resume();
+}
+
 function isDefaultPort(port, secure) {
   return Boolean((!secure && port === 80) || (secure && port === 443));
 }

package.json

 {
   "name": "https-proxy-agent",
-  "version": "2.2.2",
+  "version": "2.2.3",
   "description": "An HTTP(s) proxy `http.Agent` implementation for HTTPS",
@@ -30,4 +30,4 @@ "main": "./index.js",
   "devDependencies": {
-    "mocha": "^3.4.2",
-    "proxy": "^0.2.4"
+    "mocha": "^6.2.0",
+    "proxy": "1"
   },
@@ -34,0 +34,0 @@ "engines": {

README.md

@@ -106,3 +106,3 @@ https-proxy-agent
   * `port` - Number - Proxy port to connect to. Required.
-  * `secureProxy` - Boolean - If `true`, then use TLS to connect to the proxy. Defaults to `false`.
+  * `protocol` - String - If `https:`, then use TLS to connect to the proxy.
   * `headers` - Object - Additional HTTP headers to be sent on the HTTP CONNECT method.
@@ -109,0 +109,0 @@ * Any other options given are passed to the `net.connect()`/`tls.connect()` functions.

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

16357

increased by1.32%

Lines of code

216

increased by3.35%

No dependency changes