Skip to content

fix(socks5-proxy-agent): use per-origin pools to prevent cross-origin routing#5041

Open
deepview-autofix wants to merge 1 commit intonodejs:mainfrom
deepview-autofix:deepview/cae366f948
Open

fix(socks5-proxy-agent): use per-origin pools to prevent cross-origin routing#5041
deepview-autofix wants to merge 1 commit intonodejs:mainfrom
deepview-autofix:deepview/cae366f948

Conversation

@deepview-autofix
Copy link
Copy Markdown
Contributor

The Socks5ProxyAgent stored a single Pool keyed implicitly to the first origin it saw and reused it for every subsequent request. When a second request targeted a different origin, it was dispatched through the existing pool whose connect callback tunnelled to the original origin, causing the request to reach the wrong host (and potentially leaking headers/credentials intended for origin B to origin A).

Track pools in a Map keyed by origin so each origin gets its own pool and SOCKS5 tunnel.

… routing

The Socks5ProxyAgent stored a single Pool keyed implicitly to the first
origin it saw and reused it for every subsequent request. When a second
request targeted a different origin, it was dispatched through the
existing pool whose connect callback tunnelled to the original origin,
causing the request to reach the wrong host (and potentially leaking
headers/credentials intended for origin B to origin A).

Track pools in a Map keyed by origin so each origin gets its own pool
and SOCKS5 tunnel.

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: DeepView Autofix <276251120+deepview-autofix@users.noreply.github.com>
Co-Authored-By: Nikita Skovoroda <chalkerx@gmail.com>
Signed-off-by: Nikita Skovoroda <chalkerx@gmail.com>
@codecov-commenter
Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 90.47619% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 93.04%. Comparing base (bc0a19c) to head (9457103).

Files with missing lines Patch % Lines
lib/dispatcher/socks5-proxy-agent.js 90.47% 2 Missing ⚠️
Additional details and impacted files
@@           Coverage Diff           @@
##             main    #5041   +/-   ##
=======================================
  Coverage   93.03%   93.04%           
=======================================
  Files         110      110           
  Lines       35793    35802    +9     
=======================================
+ Hits        33301    33312   +11     
+ Misses       2492     2490    -2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copy link
Copy Markdown
Member

@mcollina mcollina left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

Copy link
Copy Markdown
Member

@mcollina mcollina left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are you sure the test was failing without the changes in lib? Why is that happening?

@ChALkeR
Copy link
Copy Markdown
Member

ChALkeR commented Apr 16, 2026

@mcollina Yes, this test was failing prior to the fix and I rechecked it manually.
Origin (and thus host + port) was cached on the first request and reused on the second one.
Which is what this bug is about.

main:

test at test/socks5-proxy-agent.js:228:1
✖ Socks5ProxyAgent - requests to different origins are routed correctly (4.945292ms)
  AssertionError [ERR_ASSERTION]: request to origin B must reach server B, not server A

The result for the second request in test was { server: 'A', path: '/b' }
As it was routed to and answered by server A.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants