https: prevent options object from being mutated

vighnesh153 · Trott · commit fa946983cc56 · 2020-01-03T20:09:27.000-08:00
Previously, when passing options object to the agent.createConnection method, the same options object got modified within the method. Now, any modification will happen on only a copy of the object. Fixes: nodejs#31119 PR-URL: nodejs#31151 Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Anto Aravinth <anto.aravinth.cse@gmail.com> Reviewed-By: David Carlier <devnexen@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com>
diff --git a/lib/https.js b/lib/https.js
@@ -95,9 +95,11 @@ function createConnection(port, host, options) {
   if (port !== null && typeof port === 'object') {
     options = port;
   } else if (host !== null && typeof host === 'object') {
-    options = host;
+    options = { ...host };
   } else if (options === null || typeof options !== 'object') {
     options = {};
+  } else {
+    options = { ...options };
   }
 
   if (typeof port === 'number') {
diff --git a/test/parallel/test-https-agent-create-connection.js b/test/parallel/test-https-agent-create-connection.js
@@ -132,3 +132,27 @@ function createServer() {
     }));
   }));
 }
+
+// `options` should not be modified
+{
+  const server = createServer();
+  server.listen(0, common.mustCall(() => {
+    const port = server.address().port;
+    const host = 'localhost';
+    const options = {
+      port: 3000,
+      rejectUnauthorized: false
+    };
+
+    const socket = agent.createConnection(port, host, options);
+    socket.on('connect', common.mustCall((data) => {
+      socket.end();
+    }));
+    socket.on('end', common.mustCall(() => {
+      assert.deepStrictEqual(options, {
+        port: 3000, rejectUnauthorized: false
+      });
+      server.close();
+    }));
+  }));
+}
