http: harden ClientRequest options merge

mcollina · aduh95 · commit d7188af5c9a8 · 2026-05-07T15:41:50.000+02:00
Signed-off-by: Matteo Collina <hello@matteocollina.com> PR-URL: #63082 Reviewed-By: Chemi Atlow <chemi@atlow.co.il> Reviewed-By: Tim Perry <pimterry@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
diff --git a/lib/_http_client.js b/lib/_http_client.js
@@ -209,7 +209,7 @@ function ClientRequest(input, options, cb) {
     cb = options;
     options = input || kEmptyObject;
   } else {
-    options = ObjectAssign(input || {}, options);
+    options = ObjectAssign({ __proto__: null }, input, options);
   }
 
   let agent = options.agent;
diff --git a/test/parallel/test-http-client-null-prototype-options.js b/test/parallel/test-http-client-null-prototype-options.js
@@ -0,0 +1,62 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('node:assert');
+const http = require('node:http');
+
+const server = http.createServer(common.mustCall((req, res) => {
+  req.resume();
+  req.on('end', common.mustCall(() => {
+    res.end('ok');
+  }));
+}, 2));
+
+function makeRequest(options, callback) {
+  Object.defineProperty(Object.prototype, 'hostname', {
+    __proto__: null,
+    configurable: true,
+    get: common.mustNotCall('get %Object.prototype%.hostname'),
+  });
+
+  let req;
+  try {
+    req = http.request(options, callback);
+  } finally {
+    delete Object.prototype.hostname;
+  }
+
+  req.on('error', common.mustNotCall());
+  req.end();
+}
+
+server.listen(0, common.localhostIPv4, common.mustCall(() => {
+  const { address, port } = server.address();
+
+  makeRequest(
+    {
+      host: address,
+      port,
+      path: '/',
+    },
+    common.mustCall((res) => {
+      assert.strictEqual(res.statusCode, 200);
+      res.resume();
+      res.on('end', common.mustCall());
+    }),
+  );
+
+  const nullProtoOptions = { __proto__: null, host: address, port, path: '/' };
+
+  assert.strictEqual(Object.getPrototypeOf(nullProtoOptions), null);
+
+  makeRequest(
+    nullProtoOptions,
+    common.mustCall((res) => {
+      assert.strictEqual(res.statusCode, 200);
+      res.resume();
+      res.on('end', common.mustCall(() => {
+        server.close(common.mustCall());
+      }));
+    }),
+  );
+}));

Original file line number	Diff line number	Diff line change
`@@ -209,7 +209,7 @@ function ClientRequest(input, options, cb) {`
`209`	`209`	`cb = options;`
`210`	`210`	`options = input \|\| kEmptyObject;`
`211`	`211`	`} else {`
`212`		`- options = ObjectAssign(input \|\| {}, options);`
	`212`	`+ options = ObjectAssign({ __proto__: null }, input, options);`
`213`	`213`	`}`
`214`	`214`
`215`	`215`	`let agent = options.agent;`