nodejs
diff --git a/‎lib/dispatcher/client-h1.js‎
Lines changed: 64 additions & 1 deletion b/‎lib/dispatcher/client-h1.js‎
Lines changed: 64 additions & 1 deletion
diff --git a/‎test/response-queue-poisoning.js‎
Lines changed: 52 additions & 0 deletions b/‎test/response-queue-poisoning.js‎
Lines changed: 52 additions & 0 deletions
@@ -57,6 +57,9 @@ const constants = require('../llhttp/constants.js')
 const EMPTY_BUF = Buffer.alloc(0)
 const FastBuffer = Buffer[Symbol.species]
 const removeAllListeners = util.removeAllListeners
+const kIdleSocketValidation = Symbol('kIdleSocketValidation')
+const kIdleSocketValidationTimeout = Symbol('kIdleSocketValidationTimeout')
+const kSocketUsed = Symbol('kSocketUsed')
 
 let extractBody
 
@@ -449,6 +452,11 @@ class Parser {
       return -1
     }
 
+    if (client[kRunning] === 0) {
+      util.destroy(socket, new SocketError('bad response', util.getSocketInfo(socket)))
+      return -1
+    }
+
     const request = client[kQueue][client[kRunningIdx]]
     if (!request) {
       return -1
@@ -762,6 +770,7 @@ class Parser {
     request.onResponseEnd(headers)
 
     client[kQueue][client[kRunningIdx]++] = null
+    socket[kSocketUsed] = true
 
     if (socket[kWriting]) {
       assert(client[kRunning] === 0)
@@ -838,6 +847,9 @@ function connectH1 (client, socket) {
   socket[kWriting] = false
   socket[kReset] = false
   socket[kBlocking] = false
+  socket[kIdleSocketValidation] = 0
+  socket[kIdleSocketValidationTimeout] = null
+  socket[kSocketUsed] = false
   socket[kParser] = new Parser(client, socket, llhttpInstance)
 
   util.addListener(socket, 'error', onHttpSocketError)
@@ -880,7 +892,7 @@ function connectH1 (client, socket) {
      * @returns {boolean}
      */
     busy (request) {
-      if (socket[kWriting] || socket[kReset] || socket[kBlocking]) {
+      if (socket[kWriting] || socket[kReset] || socket[kBlocking] || socket[kIdleSocketValidation] === 1) {
         return true
       }
 
@@ -960,6 +972,8 @@ function onHttpSocketEnd () {
 function onHttpSocketClose () {
   const parser = this[kParser]
 
+  clearIdleSocketValidation(this)
+
   if (parser) {
     if (!this[kError] && parser.statusCode && !parser.shouldKeepAlive) {
       this[kError] = parser.finish() || this[kError]
@@ -1006,6 +1020,28 @@ function onSocketClose () {
   this[kClosed] = true
 }
 
+function clearIdleSocketValidation (socket) {
+  if (socket[kIdleSocketValidationTimeout]) {
+    clearTimeout(socket[kIdleSocketValidationTimeout])
+    socket[kIdleSocketValidationTimeout] = null
+  }
+
+  socket[kIdleSocketValidation] = 0
+}
+
+function scheduleIdleSocketValidation (client, socket) {
+  socket[kIdleSocketValidation] = 1
+  socket[kIdleSocketValidationTimeout] = setTimeout(() => {
+    socket[kIdleSocketValidationTimeout] = null
+    socket[kIdleSocketValidation] = 2
+
+    if (client[kSocket] === socket && !socket.destroyed) {
+      client[kResume]()
+    }
+  }, 0)
+  socket[kIdleSocketValidationTimeout].unref?.()
+}
+
 /**
  * @param {import('./client.js')} client
  */
@@ -1023,6 +1059,32 @@ function resumeH1 (client) {
       socket[kNoRef] = false
     }
 
+    if (client[kRunning] === 0 && client[kPending] > 0 && socket[kSocketUsed]) {
+      if (socket[kIdleSocketValidation] === 0) {
+        scheduleIdleSocketValidation(client, socket)
+        socket[kParser].readMore()
+        if (socket.destroyed) {
+          return
+        }
+        return
+      }
+
+      if (socket[kIdleSocketValidation] === 1) {
+        socket[kParser].readMore()
+        if (socket.destroyed) {
+          return
+        }
+        return
+      }
+    }
+
+    if (client[kRunning] === 0) {
+      socket[kParser].readMore()
+      if (socket.destroyed) {
+        return
+      }
+    }
+
     if (client[kSize] === 0) {
       if (socket[kParser].timeoutType !== TIMEOUT_KEEP_ALIVE) {
         socket[kParser].setTimeout(client[kKeepAliveTimeoutValue], TIMEOUT_KEEP_ALIVE)
@@ -1121,6 +1183,7 @@ function writeH1 (client, request) {
   }
 
   const socket = client[kSocket]
+  clearIdleSocketValidation(socket)
 
   /**
    * @param {Error} [err]
 
@@ -0,0 +1,52 @@
+'use strict'
+
+const assert = require('node:assert')
+const { createServer } = require('node:http')
+const { after, test } = require('node:test')
+const { Client } = require('..')
+
+function readBody (body) {
+  return new Promise((resolve, reject) => {
+    let data = ''
+    body.setEncoding('latin1')
+    body.on('data', chunk => { data += chunk })
+    body.on('end', () => resolve(data))
+    body.on('error', reject)
+  })
+}
+
+test('should not reuse an idle socket with buffered unsolicited response bytes', async () => {
+  let evilServerSocket
+
+  const server = createServer((req, res) => {
+    if (!evilServerSocket) {
+      evilServerSocket = req.socket
+    }
+
+    res.end(req.url)
+  })
+  after(() => server.close())
+
+  await new Promise(resolve => server.listen(0, resolve))
+
+  const client = new Client(`http://localhost:${server.address().port}`, {
+    keepAliveTimeout: 300e3
+  })
+  after(() => client.close())
+
+  const response1 = await client.request({ path: '/request1', method: 'GET' })
+  assert.strictEqual(await readBody(response1.body), '/request1')
+
+  evilServerSocket.write(
+    'HTTP/1.1 200 OK\r\n' +
+    'Poison-Free-Socket: true\r\n' +
+    'Connection: keep-alive\r\n' +
+    'Keep-Alive: timeout=300\r\n' +
+    'Content-Length: 0\r\n' +
+    '\r\n'
+  )
+
+  const response2 = await client.request({ path: '/request2', method: 'GET' })
+  assert.strictEqual(response2.headers['poison-free-socket'], undefined)
+  assert.strictEqual(await readBody(response2.body), '/request2')
+})