diff --git a/lib/https.js b/lib/https.js index 6be488aa753..dcf02e4ca20 100644 --- a/lib/https.js +++ b/lib/https.js @@ -489,7 +489,7 @@ function Agent(options) { if (!(this instanceof Agent)) return new Agent(options); - options = { __proto__: null, ...options }; + options = ObjectSetPrototypeOf({ ...options }, null); validateOpenSSLEngineOptions(options); options.defaultPort ??= 443; options.protocol ??= 'https:'; diff --git a/lib/internal/http/agent.js b/lib/internal/http/agent.js index 3871c5b56a2..7260b6c9d30 100644 --- a/lib/internal/http/agent.js +++ b/lib/internal/http/agent.js @@ -158,7 +158,7 @@ function Agent(options) { EventEmitter.call(this); - this.options = { __proto__: null, ...options }; + this.options = ObjectSetPrototypeOf({ ...options }, null); this.defaultPort = this.options.defaultPort || 80; this.protocol = this.options.protocol || 'http:'; @@ -375,7 +375,7 @@ Agent.prototype.addRequest = function addRequest(req, options, port/* legacy */, } // Here the agent options will override per-request options. - options = { __proto__: null, ...options, ...this.options }; + options = ObjectSetPrototypeOf({ ...options, ...this.options }, null); if (options.socketPath) options.path = options.socketPath; @@ -445,7 +445,7 @@ Agent.prototype.addRequest = function addRequest(req, options, port/* legacy */, Agent.prototype.createSocket = function createSocket(req, options, cb) { // Here the agent options will override per-request options. - options = { __proto__: null, ...options, ...this.options }; + options = ObjectSetPrototypeOf({ ...options, ...this.options }, null); if (options.socketPath) options.path = options.socketPath; diff --git a/lib/internal/http/client.js b/lib/internal/http/client.js index 1952e7b69af..27f00cf9b3f 100644 --- a/lib/internal/http/client.js +++ b/lib/internal/http/client.js @@ -26,7 +26,6 @@ const { Boolean, Error, NumberIsFinite, - ObjectAssign, ObjectDefineProperty, ObjectHasOwn, ObjectKeys, @@ -363,7 +362,8 @@ function ClientRequest(input, options, cb) { pathIsFromURL = false; } - options = ObjectAssign({ __proto__: null }, input, options); + // Avoid creating a dictionary-mode object. + options = ObjectSetPrototypeOf({ ...input, ...options }, null); } // Propagate the user's highWaterMark to OutgoingMessage so that @@ -411,7 +411,7 @@ function ClientRequest(input, options, cb) { const defaultPort = options.defaultPort || (this.agent?.defaultPort); - const optsWithoutSignal = { __proto__: null, ...options }; + const optsWithoutSignal = ObjectSetPrototypeOf({ ...options }, null); const port = optsWithoutSignal.port = options.port || defaultPort || 80; const host = optsWithoutSignal.host = validateHost(options.hostname, 'hostname') ||