From a325746ff416d6fef2bc70a0f8dab71a8903b194 Mon Sep 17 00:00:00 2001
From: KuthorX <49077331+KuthorX@users.noreply.github.com>
Date: Tue, 19 Dec 2023 17:55:21 +0800
Subject: [PATCH] http: do not override user-provided options object

PR-URL: https://github.com/nodejs/node/pull/33633
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 lib/_http_client.js                           | 15 ++++------
 .../test-http-client-input-function.js        | 29 +++++++++++++++++++
 ...-http-client-insecure-http-parser-error.js | 14 +++++++++
 3 files changed, 49 insertions(+), 9 deletions(-)
 create mode 100644 test/parallel/test-http-client-input-function.js
 create mode 100644 test/parallel/test-http-client-insecure-http-parser-error.js

diff --git a/lib/_http_client.js b/lib/_http_client.js
index 8db3f8a2766887..cb50dab1a1caa9 100644
--- a/lib/_http_client.js
+++ b/lib/_http_client.js
@@ -186,9 +186,11 @@ function ClientRequest(input, options, cb) {
   const defaultPort = options.defaultPort ||
                     (this.agent && this.agent.defaultPort);
 
-  const port = options.port = options.port || defaultPort || 80;
-  const host = options.host = validateHost(options.hostname, 'hostname') ||
-                            validateHost(options.host, 'host') || 'localhost';
+  const optsWithoutSignal = { __proto__: null, ...options };
+
+  const port = optsWithoutSignal.port = options.port || defaultPort || 80;
+  const host = optsWithoutSignal.host = validateHost(options.hostname, 'hostname') ||
+                                        validateHost(options.host, 'host') || 'localhost';
 
   const setHost = (options.setHost === undefined || Boolean(options.setHost));
 
@@ -200,6 +202,7 @@ function ClientRequest(input, options, cb) {
   const signal = options.signal;
   if (signal) {
     addAbortSignal(signal, this);
+    delete optsWithoutSignal.signal;
   }
   let method = options.method;
   const methodIsString = (typeof method === 'string');
@@ -326,12 +329,6 @@ function ClientRequest(input, options, cb) {
 
   this[kUniqueHeaders] = parseUniqueHeadersOption(options.uniqueHeaders);
 
-  let optsWithoutSignal = options;
-  if (optsWithoutSignal.signal) {
-    optsWithoutSignal = ObjectAssign({}, options);
-    delete optsWithoutSignal.signal;
-  }
-
   // initiate connection
   if (this.agent) {
     this.agent.addRequest(this, optsWithoutSignal);
diff --git a/test/parallel/test-http-client-input-function.js b/test/parallel/test-http-client-input-function.js
new file mode 100644
index 00000000000000..3a2f93aa0efdae
--- /dev/null
+++ b/test/parallel/test-http-client-input-function.js
@@ -0,0 +1,29 @@
+'use strict';
+
+const common = require('../common');
+const http = require('http');
+const assert = require('assert');
+
+{
+  const server = http.createServer(common.mustCall((req, res) => {
+    res.writeHead(200);
+    res.end('hello world');
+  })).listen(0, '127.0.0.1');
+
+  server.on('listening', common.mustCall(() => {
+    const req = new http.ClientRequest(server.address(), common.mustCall((response) => {
+      let body = '';
+      response.setEncoding('utf8');
+      response.on('data', (chunk) => {
+        body += chunk;
+      });
+
+      response.on('end', common.mustCall(() => {
+        assert.strictEqual(body, 'hello world');
+        server.close();
+      }));
+    }));
+
+    req.end();
+  }));
+}
diff --git a/test/parallel/test-http-client-insecure-http-parser-error.js b/test/parallel/test-http-client-insecure-http-parser-error.js
new file mode 100644
index 00000000000000..d483d817f0ce79
--- /dev/null
+++ b/test/parallel/test-http-client-insecure-http-parser-error.js
@@ -0,0 +1,14 @@
+'use strict';
+
+require('../common');
+const assert = require('assert');
+const ClientRequest = require('http').ClientRequest;
+
+{
+  assert.throws(() => {
+    new ClientRequest({ insecureHTTPParser: 'wrongValue' });
+  }, {
+    code: 'ERR_INVALID_ARG_TYPE',
+    message: /insecureHTTPParser/
+  }, 'http request should throw when passing invalid insecureHTTPParser');
+}