File Explorer

1'use strict'2 3const { kProxy, kClose, kDestroy, kDispatch } = require('../core/symbols')4const Agent = require('./agent')5const Pool = require('./pool')6const DispatcherBase = require('./dispatcher-base')7const { InvalidArgumentError, RequestAbortedError, SecureProxyConnectionError } = require('../core/errors')8const buildConnector = require('../core/connect')9const Client = require('./client')10const { channels } = require('../core/diagnostics')11const Socks5ProxyAgent = require('./socks5-proxy-agent')12 13const kAgent = Symbol('proxy agent')14const kClient = Symbol('proxy client')15const kProxyHeaders = Symbol('proxy headers')16const kRequestTls = Symbol('request tls settings')17const kProxyTls = Symbol('proxy tls settings')18const kConnectEndpoint = Symbol('connect endpoint function')19const kTunnelProxy = Symbol('tunnel proxy')20 21function defaultProtocolPort (protocol) {22  return protocol === 'https:' ? 443 : 8023}24 25function defaultFactory (origin, opts) {26  return new Pool(origin, opts)27}28 29const noop = () => {}30 31function defaultAgentFactory (origin, opts) {32  if (opts.connections === 1) {33    return new Client(origin, opts)34  }35  return new Pool(origin, opts)36}37 38class Http1ProxyWrapper extends DispatcherBase {39  #client40 41  constructor (proxyUrl, { headers = {}, connect, factory }) {42    if (!proxyUrl) {43      throw new InvalidArgumentError('Proxy URL is mandatory')44    }45 46    super()47 48    this[kProxyHeaders] = headers49    if (factory) {50      this.#client = factory(proxyUrl, { connect })51    } else {52      this.#client = new Client(proxyUrl, { connect })53    }54  }55 56  [kDispatch] (opts, handler) {57    const onHeaders = handler.onHeaders58    handler.onHeaders = function (statusCode, data, resume) {59      if (statusCode === 407) {60        if (typeof handler.onError === 'function') {61          handler.onError(new InvalidArgumentError('Proxy Authentication Required (407)'))62        }63        return64      }65      if (onHeaders) onHeaders.call(this, statusCode, data, resume)66    }67 68    // Rewrite request as an HTTP1 Proxy request, without tunneling.69    const {70      origin,71      path = '/',72      headers = {}73    } = opts74 75    opts.path = origin + path76 77    if (!('host' in headers) && !('Host' in headers)) {78      const { host } = new URL(origin)79      headers.host = host80    }81    opts.headers = { ...this[kProxyHeaders], ...headers }82 83    return this.#client[kDispatch](opts, handler)84  }85 86  [kClose] () {87    return this.#client.close()88  }89 90  [kDestroy] (err) {91    return this.#client.destroy(err)92  }93}94 95class ProxyAgent extends DispatcherBase {96  constructor (opts) {97    if (!opts || (typeof opts === 'object' && !(opts instanceof URL) && !opts.uri)) {98      throw new InvalidArgumentError('Proxy uri is mandatory')99    }100 101    const { clientFactory = defaultFactory } = opts102    if (typeof clientFactory !== 'function') {103      throw new InvalidArgumentError('Proxy opts.clientFactory must be a function.')104    }105 106    const { proxyTunnel = true } = opts107 108    super()109 110    const url = this.#getUrl(opts)111    const { href, origin, port, protocol, username, password, hostname: proxyHostname } = url112 113    this[kProxy] = { uri: href, protocol }114    this[kRequestTls] = opts.requestTls115    this[kProxyTls] = opts.proxyTls116    this[kProxyHeaders] = opts.headers || {}117    this[kTunnelProxy] = proxyTunnel118 119    if (opts.auth && opts.token) {120      throw new InvalidArgumentError('opts.auth cannot be used in combination with opts.token')121    } else if (opts.auth) {122      /* @deprecated in favour of opts.token */123      this[kProxyHeaders]['proxy-authorization'] = `Basic ${opts.auth}`124    } else if (opts.token) {125      this[kProxyHeaders]['proxy-authorization'] = opts.token126    } else if (username && password) {127      this[kProxyHeaders]['proxy-authorization'] = `Basic ${Buffer.from(`${decodeURIComponent(username)}:${decodeURIComponent(password)}`).toString('base64')}`128    }129 130    const connect = buildConnector({ ...opts.proxyTls })131    this[kConnectEndpoint] = buildConnector({ ...opts.requestTls })132 133    const agentFactory = opts.factory || defaultAgentFactory134    const factory = (origin, options) => {135      const { protocol } = new URL(origin)136 137      // Handle SOCKS5 proxy138      if (this[kProxy].protocol === 'socks5:' || this[kProxy].protocol === 'socks:') {139        return new Socks5ProxyAgent(this[kProxy].uri, {140          headers: this[kProxyHeaders],141          connect,142          factory: agentFactory,143          username: opts.username || username,144          password: opts.password || password,145          proxyTls: opts.proxyTls,146          requestTls: opts.requestTls147        })148      }149 150      if (!this[kTunnelProxy] && protocol === 'http:' && this[kProxy].protocol === 'http:') {151        return new Http1ProxyWrapper(this[kProxy].uri, {152          headers: this[kProxyHeaders],153          connect,154          factory: agentFactory155        })156      }157      return agentFactory(origin, options)158    }159 160    // For SOCKS5 proxies, we don't need a client to the proxy itself161    // The SOCKS5 connection is handled within Socks5ProxyAgent162    if (protocol === 'socks5:' || protocol === 'socks:') {163      this[kClient] = null164    } else {165      this[kClient] = clientFactory(url, { connect })166    }167 168    this[kAgent] = new Agent({169      ...opts,170      factory,171      connect: async (opts, callback) => {172        // SOCKS5 proxies handle their own connections via Socks5ProxyAgent,173        // so this connect function should never be called for them.174        if (!this[kClient]) {175          callback(new InvalidArgumentError('Cannot establish tunnel connection without a proxy client'))176          return177        }178 179        let requestedPath = opts.host180        if (!opts.port) {181          requestedPath += `:${defaultProtocolPort(opts.protocol)}`182        }183        try {184          const connectParams = {185            origin,186            port,187            path: requestedPath,188            signal: opts.signal,189            headers: {190              ...this[kProxyHeaders],191              host: opts.host,192              ...(opts.connections == null || opts.connections > 0 ? { 'proxy-connection': 'keep-alive' } : {})193            },194            servername: this[kProxyTls]?.servername || proxyHostname195          }196          const { socket, statusCode } = await this[kClient].connect(connectParams)197          if (statusCode !== 200) {198            socket.on('error', noop).destroy()199            callback(new RequestAbortedError(`Proxy response (${statusCode}) !== 200 when HTTP Tunneling`))200            return201          }202 203          if (channels.proxyConnected.hasSubscribers) {204            channels.proxyConnected.publish({205              socket,206              connectParams207            })208          }209 210          if (opts.protocol !== 'https:') {211            callback(null, socket)212            return213          }214          let servername215          if (this[kRequestTls]) {216            servername = this[kRequestTls].servername217          } else {218            servername = opts.servername219          }220          this[kConnectEndpoint]({ ...opts, servername, httpSocket: socket }, callback)221        } catch (err) {222          if (err.code === 'ERR_TLS_CERT_ALTNAME_INVALID') {223            // Throw a custom error to avoid loop in client.js#connect224            callback(new SecureProxyConnectionError(err))225          } else {226            callback(err)227          }228        }229      }230    })231  }232 233  dispatch (opts, handler) {234    const headers = buildHeaders(opts.headers)235    throwIfProxyAuthIsSent(headers)236 237    if (headers && !('host' in headers) && !('Host' in headers)) {238      const { host } = new URL(opts.origin)239      headers.host = host240    }241 242    return this[kAgent].dispatch(243      {244        ...opts,245        headers246      },247      handler248    )249  }250 251  /**252   * @param {import('../../types/proxy-agent').ProxyAgent.Options | string | URL} opts253   * @returns {URL}254   */255  #getUrl (opts) {256    if (typeof opts === 'string') {257      return new URL(opts)258    } else if (opts instanceof URL) {259      return opts260    } else {261      return new URL(opts.uri)262    }263  }264 265  [kClose] () {266    const promises = [this[kAgent].close()]267    if (this[kClient]) {268      promises.push(this[kClient].close())269    }270    return Promise.all(promises)271  }272 273  [kDestroy] () {274    const promises = [this[kAgent].destroy()]275    if (this[kClient]) {276      promises.push(this[kClient].destroy())277    }278    return Promise.all(promises)279  }280}281 282/**283 * @param {string[] | Record<string, string>} headers284 * @returns {Record<string, string>}285 */286function buildHeaders (headers) {287  // When using undici.fetch, the headers list is stored288  // as an array.289  if (Array.isArray(headers)) {290    /** @type {Record<string, string>} */291    const headersPair = {}292 293    for (let i = 0; i < headers.length; i += 2) {294      headersPair[headers[i]] = headers[i + 1]295    }296 297    return headersPair298  }299 300  return headers301}302 303/**304 * @param {Record<string, string>} headers305 *306 * Previous versions of ProxyAgent suggests the Proxy-Authorization in request headers307 * Nevertheless, it was changed and to avoid a security vulnerability by end users308 * this check was created.309 * It should be removed in the next major version for performance reasons310 */311function throwIfProxyAuthIsSent (headers) {312  const existProxyAuth = headers && Object.keys(headers)313    .find((key) => key.toLowerCase() === 'proxy-authorization')314  if (existProxyAuth) {315    throw new InvalidArgumentError('Proxy-Authorization should be sent in ProxyAgent constructor')316  }317}318 319module.exports = ProxyAgent320