net: emit an error when custom lookup resolves to a non-string address

geeksilva97 · aduh95 · commit a757f0074739 · 2025-03-09T10:58:38.000+01:00
PR-URL: #57192 Fixes: #57112 Reviewed-By: Tim Perry <pimterry@gmail.com> Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com> Reviewed-By: Jason Zhang <xzha4350@gmail.com> Reviewed-By: Michaël Zasso <targos@protonmail.com>
diff --git a/lib/net.js b/lib/net.js
@@ -1416,7 +1416,7 @@ function lookupAndConnect(self, options) {
         // calls net.Socket.connect() on it (that's us). There are no event
         // listeners registered yet so defer the error event to the next tick.
         process.nextTick(connectErrorNT, self, err);
-      } else if (!isIP(ip)) {
+      } else if ((typeof ip !== 'string') || !isIP(ip)) {
         err = new ERR_INVALID_IP_ADDRESS(ip);
         process.nextTick(connectErrorNT, self, err);
       } else if (addressType !== 4 && addressType !== 6) {
diff --git a/test/parallel/test-net-connect-custom-lookup-non-string-address.mjs b/test/parallel/test-net-connect-custom-lookup-non-string-address.mjs
@@ -0,0 +1,44 @@
+import * as common from '../common/index.mjs';
+import net from 'node:net';
+import { describe, it } from 'node:test';
+
+const brokenCustomLookup = (_hostname, options, callback) => {
+  // Incorrectly return an array of IPs instead of a string.
+  callback(null, ['127.0.0.1'], options.family);
+};
+
+describe('when family is ipv4', () => {
+  it('socket emits an error when lookup does not return a string', (t, done) => {
+    const options = {
+      host: 'example.com',
+      port: 80,
+      lookup: brokenCustomLookup,
+      family: 4
+    };
+
+    const socket = net.connect(options, common.mustNotCall());
+    socket.on('error', (err) => {
+      t.assert.strictEqual(err.code, 'ERR_INVALID_IP_ADDRESS');
+
+      done();
+    });
+  });
+});
+
+describe('when family is ipv6', () => {
+  it('socket emits an error when lookup does not return a string', (t, done) => {
+    const options = {
+      host: 'example.com',
+      port: 80,
+      lookup: brokenCustomLookup,
+      family: 6
+    };
+
+    const socket = net.connect(options, common.mustNotCall());
+    socket.on('error', (err) => {
+      t.assert.strictEqual(err.code, 'ERR_INVALID_IP_ADDRESS');
+
+      done();
+    });
+  });
+});
