@zowe/db2-for-zowe-cli 6.1.17 → 6.1.19

package/node_modules/axios/lib/adapters/http.js

@@ -28,6 +28,7 @@ import ZlibHeaderTransformStream from '../helpers/ZlibHeaderTransformStream.js';
 import Http2Sessions from '../helpers/Http2Sessions.js';
 import callbackify from '../helpers/callbackify.js';
 import shouldBypassProxy from '../helpers/shouldBypassProxy.js';
+import bind from '../helpers/bind.js';
 import { toByteStringHeaderObject } from '../helpers/sanitizeHeaderValue.js';
 import {
   progressEventReducer,
@@ -67,6 +68,15 @@ const isHttps = /https:?/;
 const kAxiosSocketListener = Symbol('axios.http.socketListener');
 const kAxiosCurrentReq = Symbol('axios.http.currentReq');
 
+// A shared listener avoids retaining an adapter context for the lifetime of a
+// pooled socket. EventEmitter invokes listeners with `this` set to the emitter.
+function handleSocketError(err) {
+  const current = this[kAxiosCurrentReq];
+  if (current && !current.destroyed) {
+    current.destroy(err);
+  }
+}
+
 // Tags HttpsProxyAgent instances installed by setProxy() so the redirect path
 // can strip them without clobbering a user-supplied agent that happens to be
 // an HttpsProxyAgent.
@@ -78,6 +88,18 @@ const kAxiosInstalledTunnel = Symbol('axios.http.installedTunnel');
 // so unbounded growth is not a concern in practice.
 const tunnelingAgentCache = new Map();
 const tunnelingAgentCacheUser = new WeakMap();
+const directAgents = new WeakMap();
+const directAgentHooks = ['createConnection', 'getName'];
+const nativeAgentPoolHooks = [
+  'addRequest',
+  'createSocket',
+  'removeSocket',
+  'keepSocketAlive',
+  'reuseSocket',
+  '_getSession',
+  '_cacheSession',
+  '_evictSession',
+];
 // Minimum minor versions where Node's HTTP Agent supports native proxyEnv
 // handling. Checking the selected agent below also covers startup modes such
 // as NODE_OPTIONS=--use-env-proxy and --no-use-env-proxy precedence.
@@ -114,16 +136,91 @@ function isNodeEnvProxyEnabled(agent, nodeVersion = process.versions && process.
   const agentOptions = agent && agent.options;
 
   return Boolean(
-    agentOptions &&
-      utils.hasOwnProp(agentOptions, 'proxyEnv') &&
-      agentOptions.proxyEnv != null
+    agentOptions && utils.hasOwnProp(agentOptions, 'proxyEnv') && agentOptions.proxyEnv != null
   );
 }
 
 function getProxyEnvAgent(options, configHttpAgent, configHttpsAgent) {
   return isHttps.test(options.protocol)
-    ? (configHttpsAgent || https.globalAgent)
-    : (configHttpAgent || http.globalAgent);
+    ? configHttpsAgent || https.globalAgent
+    : configHttpAgent || http.globalAgent;
+}
+
+function getDirectAgent(configuredAgent, transport) {
+  if (
+    !process.allowedNodeEnvironmentFlags ||
+    !process.allowedNodeEnvironmentFlags.has('--use-env-proxy')
+  ) {
+    return configuredAgent;
+  }
+
+  const agent = configuredAgent || transport.globalAgent;
+  const options = agent && agent.options;
+  if (
+    !(agent instanceof transport.Agent) ||
+    agent.protocol !== transport.globalAgent.protocol ||
+    !options ||
+    !utils.hasOwnProp(options, 'proxyEnv') ||
+    typeof options.proxyEnv !== 'object' ||
+    options.proxyEnv === null
+  ) {
+    return configuredAgent;
+  }
+
+  // These hooks own pool queues or TLS session state. Neither binding them to
+  // the source agent nor copying them without subclass state preserves their
+  // behavior on a separate direct pool.
+  for (const hook of nativeAgentPoolHooks) {
+    if (
+      utils.isFunction(transport.Agent.prototype[hook]) &&
+      agent[hook] !== transport.Agent.prototype[hook]
+    ) {
+      throw new AxiosError(
+        'proxy: false cannot adapt an agent overriding ' +
+          hook +
+          '; use an agent constructed without proxyEnv',
+        AxiosError.ERR_BAD_OPTION_VALUE
+      );
+    }
+  }
+
+  // Node snapshots proxyEnv when constructing the agent. Keep this check
+  // conservative even when the caller later removes protocol-specific entries.
+  let direct = directAgents.get(agent);
+  if (!direct) {
+    direct = new transport.Agent({ ...options, proxyEnv: undefined });
+
+    // Agent.destroy() does not emit an event. Keep the associated pool under
+    // the configured agent's lifetime, including agents reused after destroy().
+    const destroy = agent.destroy;
+    agent.destroy = function destroyWithDirectAgent() {
+      try {
+        return destroy.apply(this, arguments);
+      } finally {
+        direct.destroy();
+      }
+    };
+    directAgents.set(agent, direct);
+  }
+
+  // Connections and pool keys do not own the direct pool's queues. Preserve
+  // their configured receiver and refresh hooks that change between requests.
+  for (const hook of directAgentHooks) {
+    direct[hook] =
+      agent[hook] === transport.Agent.prototype[hook]
+        ? transport.Agent.prototype[hook]
+        : bind(agent[hook], agent);
+  }
+  return direct;
+}
+
+function setDirectAgent(options, configHttpAgent, configHttpsAgent) {
+  const secure = isHttps.test(options.protocol);
+  const agent = getDirectAgent(secure ? configHttpsAgent : configHttpAgent, secure ? https : http);
+  options.agent = agent;
+  if (options.agents) {
+    options.agents[secure ? 'https' : 'http'] = agent;
+  }
 }
 
 function getTunnelingAgent(agentOptions, userHttpsAgent) {
@@ -136,26 +233,29 @@ function getTunnelingAgent(agentOptions, userHttpsAgent) {
     '#' +
     (agentOptions.auth || '');
   const cache = userHttpsAgent
-    ? (tunnelingAgentCacheUser.get(userHttpsAgent) ||
-        tunnelingAgentCacheUser.set(userHttpsAgent, new Map()).get(userHttpsAgent))
+    ? tunnelingAgentCacheUser.get(userHttpsAgent) ||
+      tunnelingAgentCacheUser.set(userHttpsAgent, new Map()).get(userHttpsAgent)
     : tunnelingAgentCache;
   let agent = cache.get(key);
   if (agent) return agent;
-  // Forward the user's TLS options (custom CA, rejectUnauthorized, client cert,
-  // etc.) into the tunneling agent so they apply to the origin TLS upgrade
-  // performed after CONNECT. Our proxy fields take precedence on conflict.
-  const merged = userHttpsAgent && userHttpsAgent.options
-    ? { ...userHttpsAgent.options, ...agentOptions }
-    : agentOptions;
+  // Preserve per-request TLS options for the proxy connection, with our proxy
+  // fields taking precedence. Global-agent options belong only to the origin
+  // TLS upgrade in the callback below.
+  const merged =
+    userHttpsAgent && userHttpsAgent.options
+      ? { ...userHttpsAgent.options, ...agentOptions }
+      : agentOptions;
   agent = new HttpsProxyAgent(merged);
-  if (userHttpsAgent && userHttpsAgent.options) {
-    const originTLSOptions = { ...userHttpsAgent.options };
-    const callback = agent.callback;
-    agent.callback = function axiosTunnelingAgentCallback(req, opts) {
-      // HttpsProxyAgent v5 reads callback opts for the post-CONNECT origin TLS upgrade.
-      return callback.call(this, req, { ...originTLSOptions, ...opts });
-    };
-  }
+  const callback = agent.callback;
+  agent.callback = function axiosTunnelingAgentCallback(req, opts) {
+    // Without a proxy the origin TLS connection would be made by https.globalAgent,
+    // so its options have to reach the tunneled origin too. Resolved per request
+    // because the tunneling agent outlives any one of them.
+    const originTLSAgent = userHttpsAgent || https.globalAgent;
+    const originTLSOptions = originTLSAgent && originTLSAgent.options;
+    // HttpsProxyAgent v5 reads callback opts for the post-CONNECT origin TLS upgrade.
+    return callback.call(this, req, { ...originTLSOptions, ...opts });
+  };
   agent[kAxiosInstalledTunnel] = true;
   cache.set(key, agent);
   return agent;
@@ -198,6 +298,10 @@ const http2Sessions = new Http2Sessions();
  * @returns {Object<string, any>}
  */
 function dispatchBeforeRedirect(options, responseDetails, requestDetails) {
+  if (!isSameOriginRedirect(options, requestDetails)) {
+    stripMatchingHeaders(options.headers, new Set(['authorization', 'cookie']));
+    delete options.auth;
+  }
   if (options.beforeRedirects.proxy) {
     options.beforeRedirects.proxy(options);
   }
@@ -207,6 +311,9 @@ function dispatchBeforeRedirect(options, responseDetails, requestDetails) {
   if (options.beforeRedirects.sensitiveHeaders) {
     options.beforeRedirects.sensitiveHeaders(options, requestDetails);
   }
+  if (options.beforeRedirects.direct) {
+    options.beforeRedirects.direct(options);
+  }
   if (options.beforeRedirects.config) {
     options.beforeRedirects.config(options, responseDetails, requestDetails);
   }
@@ -243,13 +350,22 @@ function isSameOriginRedirect(redirectOptions, requestDetails) {
  * @param {http.ClientRequestArgs} options
  * @param {AxiosProxyConfig} configProxy configuration from Axios options object
  * @param {string} location
+ * @param {boolean} [allowEnvProxy=true] whether environment proxy configuration can be used
  *
- * @returns {http.ClientRequestArgs}
+ * @returns {boolean} whether a proxy applies to the selected transport
  */
-function setProxy(options, configProxy, location, isRedirect, configHttpsAgent, configHttpAgent) {
+function setProxy(
+  options,
+  configProxy,
+  location,
+  isRedirect,
+  configHttpsAgent,
+  configHttpAgent,
+  allowEnvProxy = true
+) {
   let proxy = configProxy;
   const proxyEnvAgent = getProxyEnvAgent(options, configHttpAgent, configHttpsAgent);
-  if (!proxy && proxy !== false && !isNodeEnvProxyEnabled(proxyEnvAgent)) {
+  if (!proxy && proxy !== false && allowEnvProxy && !isNodeEnvProxyEnabled(proxyEnvAgent)) {
     const proxyUrl = getProxyForUrl(location);
     if (proxyUrl) {
       if (!shouldBypassProxy(location)) {
@@ -275,6 +391,14 @@ function setProxy(options, configProxy, location, isRedirect, configHttpsAgent,
   if (isRedirect && options.agent && options.agent[kAxiosInstalledTunnel]) {
     options.agent = undefined;
   }
+  if (
+    isRedirect &&
+    options.agents &&
+    options.agents.https &&
+    options.agents.https[kAxiosInstalledTunnel]
+  ) {
+    options.agents.https = configHttpsAgent;
+  }
   if (proxy) {
     // Read proxy fields without traversing the prototype chain. URL instances expose
     // username/password/hostname/host/port/protocol via getters on URL.prototype (so
@@ -406,9 +530,14 @@ function setProxy(options, configProxy, location, isRedirect, configHttpsAgent,
       redirectOptions.href,
       true,
       configHttpsAgent,
-      configHttpAgent
+      configHttpAgent,
+      allowEnvProxy
     );
   };
+
+  return Boolean(
+    proxy || (configProxy !== false && allowEnvProxy && isNodeEnvProxyEnabled(proxyEnvAgent))
+  );
 }
 
 const isHttpAdapterSupported =
@@ -443,7 +572,7 @@ const wrapAsync = (asyncExecutor) => {
 
 const resolveFamily = ({ address, family }) => {
   if (!utils.isString(address)) {
-    throw TypeError('address must be a string');
+    throw new AxiosError('address must be a string', AxiosError.ERR_BAD_OPTION_VALUE);
   }
   return {
     address,
@@ -454,6 +583,43 @@ const resolveFamily = ({ address, family }) => {
 const buildAddressEntry = (address, family) =>
   resolveFamily(utils.isObject(address) ? address : { address, family });
 
+const normalizedLookupCache = new WeakMap();
+
+const normalizeLookup = (lookup) => {
+  let normalized = normalizedLookupCache.get(lookup);
+
+  if (normalized) {
+    return normalized;
+  }
+
+  const callbackLookup = callbackify(lookup, (value) => (utils.isArray(value) ? value : [value]));
+
+  // Support opt.all, which is required by current Node.js releases.
+  normalized = (hostname, opt, cb) => {
+    callbackLookup(hostname, opt, (err, arg0, arg1) => {
+      if (err) {
+        return cb(err);
+      }
+
+      let addresses;
+
+      try {
+        addresses = utils.isArray(arg0)
+          ? arg0.map((addr) => buildAddressEntry(addr))
+          : [buildAddressEntry(arg0, arg1)];
+      } catch (error) {
+        return cb(error);
+      }
+
+      opt.all ? cb(err, addresses) : cb(err, addresses[0].address, addresses[0].family);
+    });
+  };
+
+  normalizedLookupCache.set(lookup, normalized);
+
+  return normalized;
+};
+
 const http2Transport = {
   request(options, cb) {
     const authority =
@@ -518,10 +684,11 @@ export default isHttpAdapterSupported &&
       let family = own('family');
       let httpVersion = own('httpVersion');
       if (httpVersion === undefined) httpVersion = 1;
+      const rawHttpVersion = httpVersion;
       let http2Options = own('http2Options');
+      const configProxy = own('proxy');
       const httpAgent = own('httpAgent');
       const httpsAgent = own('httpsAgent');
-      const configProxy = own('proxy');
       const responseType = own('responseType');
       const responseEncoding = own('responseEncoding');
       const socketPath = own('socketPath');
@@ -535,34 +702,36 @@ export default isHttpAdapterSupported &&
       let req;
       let connectPhaseTimer;
 
-      httpVersion = +httpVersion;
+      try {
+        httpVersion = +httpVersion;
+      } catch (err) {
+        throw new AxiosError(
+          'Invalid protocol version: value is not a number',
+          AxiosError.ERR_BAD_OPTION_VALUE,
+          config
+        );
+      }
 
       if (Number.isNaN(httpVersion)) {
-        throw TypeError(`Invalid protocol version: '${config.httpVersion}' is not a number`);
+        throw new AxiosError(
+          `Invalid protocol version: '${rawHttpVersion}' is not a number`,
+          AxiosError.ERR_BAD_OPTION_VALUE,
+          config
+        );
       }
 
       if (httpVersion !== 1 && httpVersion !== 2) {
-        throw TypeError(`Unsupported protocol version '${httpVersion}'`);
+        throw new AxiosError(
+          `Unsupported protocol version '${httpVersion}'`,
+          AxiosError.ERR_BAD_OPTION_VALUE,
+          config
+        );
       }
 
       const isHttp2 = httpVersion === 2;
 
       if (lookup) {
-        const _lookup = callbackify(lookup, (value) => (utils.isArray(value) ? value : [value]));
-        // hotfix to support opt.all option which is required for node 20.x
-        lookup = (hostname, opt, cb) => {
-          _lookup(hostname, opt, (err, arg0, arg1) => {
-            if (err) {
-              return cb(err);
-            }
-
-            const addresses = utils.isArray(arg0)
-              ? arg0.map((addr) => buildAddressEntry(addr))
-              : [buildAddressEntry(arg0, arg1)];
-
-            opt.all ? cb(err, addresses) : cb(err, addresses[0].address, addresses[0].family);
-          });
-        };
+        lookup = normalizeLookup(lookup);
       }
 
       const abortEmitter = new EventEmitter();
@@ -655,7 +824,9 @@ export default isHttpAdapterSupported &&
       // prototype cannot influence URL base selection.
       const urlBase = socketPath
         ? 'http://localhost'
-        : (platform.hasBrowserEnv ? platform.origin : undefined);
+        : platform.hasBrowserEnv
+          ? platform.origin
+          : undefined;
       const parsed = new URL(fullPath, urlBase);
       const protocol = parsed.protocol || supportedProtocols[0];
 
@@ -696,6 +867,20 @@ export default isHttpAdapterSupported &&
           throw AxiosError.from(err, AxiosError.ERR_BAD_REQUEST, config);
         }
 
+        // Check bytes before converting the result to text or a stream.
+        if (
+          maxContentLength > -1 &&
+          (responseType === 'blob' ? convertedData.size : convertedData.length) > maxContentLength
+        ) {
+          return reject(
+            new AxiosError(
+              'maxContentLength size of ' + maxContentLength + ' exceeded',
+              AxiosError.ERR_BAD_RESPONSE,
+              config
+            )
+          );
+        }
+
         if (responseType === 'text') {
           convertedData = convertedData.toString(responseEncoding);
 
@@ -866,7 +1051,7 @@ export default isHttpAdapterSupported &&
         return reject(
           AxiosError.from(err, AxiosError.ERR_BAD_REQUEST, config, null, null, {
             url: own('url'),
-            exists: true
+            exists: true,
           })
         );
       }
@@ -874,10 +1059,16 @@ export default isHttpAdapterSupported &&
       headers.set(
         'Accept-Encoding',
         utils.hasOwnProp(transitional, 'advertiseZstdAcceptEncoding') &&
-        transitional.advertiseZstdAcceptEncoding === true ? ACCEPT_ENCODING_WITH_ZSTD : ACCEPT_ENCODING,
+          transitional.advertiseZstdAcceptEncoding === true
+          ? ACCEPT_ENCODING_WITH_ZSTD
+          : ACCEPT_ENCODING,
         false
       );
 
+      if (isHttp2 && lookup) {
+        http2Options = Object.assign(Object.create(null), http2Options, { lookup });
+      }
+
       // Null-prototype to block prototype pollution gadgets on properties read
       // directly by Node's http.request (e.g. insecureHTTPParser, lookup).
       const options = Object.assign(Object.create(null), {
@@ -891,11 +1082,14 @@ export default isHttpAdapterSupported &&
         beforeRedirect: dispatchBeforeRedirect,
         beforeRedirects: Object.create(null),
         http2Options,
+        createConnection: undefined,
       });
 
       // cacheable-lookup integration hotfix
       !utils.isUndefined(lookup) && (options.lookup = lookup);
 
+      let proxyApplied = false;
+
       if (socketPath) {
         if (typeof socketPath !== 'string') {
           return reject(
@@ -931,30 +1125,44 @@ export default isHttpAdapterSupported &&
           ? parsed.hostname.slice(1, -1)
           : parsed.hostname;
         options.port = parsed.port;
-        setProxy(
+        proxyApplied = setProxy(
           options,
           configProxy,
           protocol + '//' + parsed.hostname + (parsed.port ? ':' + parsed.port : '') + options.path,
           false,
           httpsAgent,
-          httpAgent
+          httpAgent,
+          // The HTTP/2 transport connects independently of HTTP/1 agents, so it
+          // cannot apply either axios-resolved or agent-local environment proxies.
+          // Explicit proxy config is still processed and rejected below.
+          !isHttp2
         );
       }
       let transport;
       let isNativeTransport = false;
-      // True only for the follow-redirects transport, which applies
-      // options.maxBodyLength itself. Every other transport (http2, native
-      // http/https, a user-supplied custom transport) needs the explicit
-      // byte-counting pipeline below to enforce maxBodyLength on streamed uploads.
-      let transportEnforcesMaxBodyLength = false;
       const isHttpsRequest = isHttps.test(options.protocol);
       // Don't clobber a CONNECT-tunneling agent installed by setProxy() for an
       // HTTPS target.
-      if (options.agent == null) {
+      if (!isHttp2 && configProxy === false) {
+        setDirectAgent(options, httpAgent, httpsAgent);
+        options.beforeRedirects.direct = (redirectOptions) => {
+          setDirectAgent(redirectOptions, httpAgent, httpsAgent);
+        };
+      } else if (options.agent == null) {
         options.agent = isHttpsRequest ? httpsAgent : httpAgent;
       }
 
       if (isHttp2) {
+        if (proxyApplied) {
+          return reject(
+            new AxiosError(
+              'HTTP/2 requests with a proxy are not supported',
+              AxiosError.ERR_NOT_SUPPORT,
+              config
+            )
+          );
+        }
+
         transport = http2Transport;
       } else {
         const configTransport = own('transport');
@@ -964,7 +1172,6 @@ export default isHttpAdapterSupported &&
           transport = isHttpsRequest ? https : http;
           isNativeTransport = true;
         } else {
-          transportEnforcesMaxBodyLength = true;
           options.sensitiveHeaders = [];
           if (maxRedirects) {
             options.maxRedirects = maxRedirects;
@@ -1069,7 +1276,11 @@ export default isHttpAdapterSupported &&
                 transformStream,
                 progressEventDecorator(
                   responseLength,
-                  progressEventReducer(asyncDecorator(onDownloadProgress, scheduleProgress), true, 3)
+                  progressEventReducer(
+                    asyncDecorator(onDownloadProgress, scheduleProgress),
+                    true,
+                    3
+                  )
                 )
               )
             );
@@ -1267,18 +1478,10 @@ export default isHttpAdapterSupported &&
           socket.setKeepAlive(true, 1000 * 60);
         }
 
-        // Install a single 'error' listener per socket (not per request) to avoid
-        // accumulating listeners on pooled keep-alive sockets that get reassigned
-        // to new requests before the previous request's 'close' fires (issue #10780).
-        // The listener is bound to the socket's currently-active request via a
-        // symbol, which is swapped as the socket is reassigned.
+        // Install one shared 'error' listener per socket. The symbol follows the
+        // currently-active request as pooled sockets are reassigned (issue #10780).
         if (!socket[kAxiosSocketListener]) {
-          socket.on('error', function handleSocketError(err) {
-            const current = socket[kAxiosCurrentReq];
-            if (current && !current.destroyed) {
-              current.destroy(err);
-            }
-          });
+          socket.on('error', handleSocketError);
           socket[kAxiosSocketListener] = true;
         }
 
@@ -1358,12 +1561,10 @@ export default isHttpAdapterSupported &&
           }
         });
 
-        // Enforce maxBodyLength for streamed uploads on every transport that
-        // does not apply options.maxBodyLength itself (native http/https, http2,
-        // and user-supplied custom transports). The follow-redirects transport
-        // enforces it on the redirected HTTP/1 path.
+        // Transform decodes string chunks to Buffers before counting, so every
+        // transport receives at most maxBodyLength encoded bytes.
         let uploadStream = data;
-        if (maxBodyLength > -1 && !transportEnforcesMaxBodyLength) {
+        if (maxBodyLength > -1) {
           const limit = maxBodyLength;
           let bytesSent = 0;
           uploadStream = stream.pipeline(
@@ -1402,5 +1603,7 @@ export default isHttpAdapterSupported &&
   };
 
 export const __setProxy = setProxy;
+export const __getDirectAgent = getDirectAgent;
+export const __isNodeNativeEnvProxySupported = isNodeNativeEnvProxySupported;
 export const __isNodeEnvProxyEnabled = isNodeEnvProxyEnabled;
 export const __isSameOriginRedirect = isSameOriginRedirect;