From 1203fabaccc62d092747f0b855079453846fcbcc Mon Sep 17 00:00:00 2001 From: joelwizard Date: Fri, 3 Apr 2026 14:46:00 -0700 Subject: [PATCH] Do not pass proxy headers to the proxy agent --- dist/merge/index.js | 12 +++++++++--- dist/upload/index.js | 12 +++++++++--- package-lock.json | 13 +++++++++++++ 3 files changed, 31 insertions(+), 6 deletions(-) diff --git a/dist/merge/index.js b/dist/merge/index.js index 3b522d4..a3022f3 100644 --- a/dist/merge/index.js +++ b/dist/merge/index.js @@ -89375,16 +89375,22 @@ function setProxyAgentOnRequest(request, cachedAgents, proxyUrl) { if (request.tlsSettings) { log_logger.warning("TLS settings are not supported in combination with custom Proxy, certificates provided to the client will be ignored."); } - const headers = request.headers.toJSON(); + // Do NOT pass application-level request headers to the proxy agent. + // The `headers` option in HttpsProxyAgent/HttpProxyAgent specifies headers + // to include in the HTTP CONNECT request to the proxy server. Leaking + // application headers (Content-Type, x-ms-version, etc.) into the CONNECT + // handshake violates RFC 7231 §4.3.6 and causes strict proxies (e.g. + // Fortinet, Zscaler) to reject the tunnel, resulting in ECONNRESET. + // See: https://github.com/actions/upload-artifact/issues/XXX if (isInsecure) { if (!cachedAgents.httpProxyAgent) { - cachedAgents.httpProxyAgent = new http_proxy_agent_dist.HttpProxyAgent(proxyUrl, { headers }); + cachedAgents.httpProxyAgent = new http_proxy_agent_dist.HttpProxyAgent(proxyUrl); } request.agent = cachedAgents.httpProxyAgent; } else { if (!cachedAgents.httpsProxyAgent) { - cachedAgents.httpsProxyAgent = new dist.HttpsProxyAgent(proxyUrl, { headers }); + cachedAgents.httpsProxyAgent = new dist.HttpsProxyAgent(proxyUrl); } request.agent = cachedAgents.httpsProxyAgent; } diff --git a/dist/upload/index.js b/dist/upload/index.js index a4ca651..c189d3c 100644 --- a/dist/upload/index.js +++ b/dist/upload/index.js @@ -86950,16 +86950,22 @@ function setProxyAgentOnRequest(request, cachedAgents, proxyUrl) { if (request.tlsSettings) { log_logger.warning("TLS settings are not supported in combination with custom Proxy, certificates provided to the client will be ignored."); } - const headers = request.headers.toJSON(); + // Do NOT pass application-level request headers to the proxy agent. + // The `headers` option in HttpsProxyAgent/HttpProxyAgent specifies headers + // to include in the HTTP CONNECT request to the proxy server. Leaking + // application headers (Content-Type, x-ms-version, etc.) into the CONNECT + // handshake violates RFC 7231 §4.3.6 and causes strict proxies (e.g. + // Fortinet, Zscaler) to reject the tunnel, resulting in ECONNRESET. + // See: https://github.com/actions/upload-artifact/issues/XXX if (isInsecure) { if (!cachedAgents.httpProxyAgent) { - cachedAgents.httpProxyAgent = new http_proxy_agent_dist.HttpProxyAgent(proxyUrl, { headers }); + cachedAgents.httpProxyAgent = new http_proxy_agent_dist.HttpProxyAgent(proxyUrl); } request.agent = cachedAgents.httpProxyAgent; } else { if (!cachedAgents.httpsProxyAgent) { - cachedAgents.httpsProxyAgent = new dist.HttpsProxyAgent(proxyUrl, { headers }); + cachedAgents.httpsProxyAgent = new dist.HttpsProxyAgent(proxyUrl); } request.agent = cachedAgents.httpsProxyAgent; } diff --git a/package-lock.json b/package-lock.json index 5739b1d..7f3030a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -188,6 +188,7 @@ "resolved": "https://registry.npmjs.org/@azure/core-client/-/core-client-1.10.1.tgz", "integrity": "sha512-Nh5PhEOeY6PrnxNPsEHRr9eimxLwgLlpmguQaHKBinFYA/RU9+kOYVOQqOrTsCL+KSxrLLl1gD8Dk5BFW/7l/w==", "license": "MIT", + "peer": true, "dependencies": { "@azure/abort-controller": "^2.1.2", "@azure/core-auth": "^1.10.0", @@ -249,6 +250,7 @@ "resolved": "https://registry.npmjs.org/@azure/core-rest-pipeline/-/core-rest-pipeline-1.22.2.tgz", "integrity": "sha512-MzHym+wOi8CLUlKCQu12de0nwcq9k9Kuv43j4Wa++CsCpJwps2eeBQwD2Bu8snkxTtDKDx4GwjuR9E8yC8LNrg==", "license": "MIT", + "peer": true, "dependencies": { "@azure/abort-controller": "^2.1.2", "@azure/core-auth": "^1.10.0", @@ -390,6 +392,7 @@ "integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==", "dev": true, "license": "MIT", + "peer": true, "dependencies": { "@babel/code-frame": "^7.29.0", "@babel/generator": "^7.29.0", @@ -1799,6 +1802,7 @@ "resolved": "https://registry.npmjs.org/@octokit/core/-/core-7.0.6.tgz", "integrity": "sha512-DhGl4xMVFGVIyMwswXeyzdL4uXD5OGILGX5N8Y+f6W7LhC1Ze2poSNrkF/fedpVDHEEZ+PHFW0vL14I+mm8K3Q==", "license": "MIT", + "peer": true, "dependencies": { "@octokit/auth-token": "^6.0.0", "@octokit/graphql": "^9.0.3", @@ -2203,6 +2207,7 @@ "integrity": "sha512-4K3bqJpXpqfg2XKGK9bpDTc6xO/xoUP/RBWS7AtRMug6zZFaRekiLzjVtAoZMquxoAbzBvy5nxQ7veS5eYzf8A==", "dev": true, "license": "MIT", + "peer": true, "dependencies": { "undici-types": "~7.18.0" } @@ -2794,6 +2799,7 @@ "integrity": "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==", "dev": true, "license": "MIT", + "peer": true, "bin": { "acorn": "bin/acorn" }, @@ -3387,6 +3393,7 @@ } ], "license": "MIT", + "peer": true, "dependencies": { "baseline-browser-mapping": "^2.9.0", "caniuse-lite": "^1.0.30001759", @@ -4272,6 +4279,7 @@ "integrity": "sha512-VmQ+sifHUbI/IcSopBCF/HO3YiHQx/AVd3UVyYL6weuwW+HvON9VYn5l6Zl1WZzPWXPNZrSQpxwkkZ/VuvJZzg==", "dev": true, "license": "MIT", + "peer": true, "dependencies": { "@eslint-community/eslint-utils": "^4.8.0", "@eslint-community/regexpp": "^4.12.1", @@ -6285,6 +6293,7 @@ "integrity": "sha512-F26gjC0yWN8uAA5m5Ss8ZQf5nDHWGlN/xWZIh8S5SRbsEKBovwZhxGd6LJlbZYxBgCYOtreSUyb8hpXyGC5O4A==", "dev": true, "license": "MIT", + "peer": true, "dependencies": { "@jest/core": "30.2.0", "@jest/types": "30.2.0", @@ -7757,6 +7766,7 @@ "integrity": "sha512-UOnG6LftzbdaHZcKoPFtOcCKztrQ57WkHDeRD9t/PTQtmT0NHSeWWepj6pS0z/N7+08BHFDQVUrfmfMRcZwbMg==", "dev": true, "license": "MIT", + "peer": true, "bin": { "prettier": "bin/prettier.cjs" }, @@ -8808,6 +8818,7 @@ "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==", "dev": true, "license": "MIT", + "peer": true, "engines": { "node": ">=12" }, @@ -8939,6 +8950,7 @@ "integrity": "sha512-f0FFpIdcHgn8zcPSbf1dRevwt047YMnaiJM3u2w2RewrB+fob/zePZcrOyQoLMMO7aBIddLcQIEK5dYjkLnGrQ==", "dev": true, "license": "MIT", + "peer": true, "dependencies": { "@cspotcode/source-map-support": "^0.8.0", "@tsconfig/node10": "^1.0.7", @@ -9147,6 +9159,7 @@ "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz", "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==", "license": "Apache-2.0", + "peer": true, "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver"