http: add __proto__ null

lib/_http_agent.js

@@ -551,5 +551,5 @@ function asyncResetHandle(socket) {
 
 module.exports = {
   Agent,
-  globalAgent: new Agent({ keepAlive: true, scheduling: 'lifo', timeout: 5000 }),
+  globalAgent: new Agent({ __proto__: null, keepAlive: true, scheduling: 'lifo', timeout: 5000 }),
 };

lib/_http_client.js

@@ -146,7 +146,7 @@ function ClientRequest(input, options, cb) {
     cb = options;
     options = input || kEmptyObject;
   } else {
-    options = ObjectAssign(input || {}, options);
+    options = ObjectAssign(input || { __proto__: null }, options);
   }
 
   let agent = options.agent;
@@ -328,7 +328,7 @@ function ClientRequest(input, options, cb) {
 
   let optsWithoutSignal = options;
   if (optsWithoutSignal.signal) {
-    optsWithoutSignal = ObjectAssign({}, options);
+    optsWithoutSignal = ObjectAssign({ __proto__: null }, options);
     delete optsWithoutSignal.signal;
   }
 
@@ -370,19 +370,23 @@ ClientRequest.prototype._finish = function _finish() {
   FunctionPrototypeCall(OutgoingMessage.prototype._finish, this);
   if (hasObserver('http')) {
     startPerf(this, kClientRequestStatistics, {
+      __proto__: null,
       type: 'http',
       name: 'HttpClient',
       detail: {
+        __proto__: null,
         req: {
+          __proto__: null,
           method: this.method,
           url: `${this.protocol}//${this.host}${this.path}`,
-          headers: typeof this.getHeaders === 'function' ? this.getHeaders() : {},
+          headers: typeof this.getHeaders === 'function' ? this.getHeaders() : { __proto__: null },
         },
       },
     });
   }
   if (onClientRequestStartChannel.hasSubscribers) {
     onClientRequestStartChannel.publish({
+      __proto__: null,
       request: this,
     });
   }
@@ -637,6 +641,7 @@ function parserOnIncomingClient(res, shouldKeepAlive) {
     }
     // Send information events to all 1xx responses except 101 Upgrade.
     req.emit('information', {
+      __proto__: null,
       statusCode: res.statusCode,
       statusMessage: res.statusMessage,
       httpVersion: res.httpVersion,
@@ -658,8 +663,11 @@ function parserOnIncomingClient(res, shouldKeepAlive) {
 
   if (req[kClientRequestStatistics] && hasObserver('http')) {
     stopPerf(req, kClientRequestStatistics, {
+      __proto__: null,
       detail: {
+        __proto__: null,
         res: {
+          __proto__: null,
           statusCode: res.statusCode,
           statusMessage: res.statusMessage,
           headers: res.headers,
@@ -669,12 +677,14 @@ function parserOnIncomingClient(res, shouldKeepAlive) {
   }
   if (onClientResponseFinishChannel.hasSubscribers) {
     onClientResponseFinishChannel.publish({
+      __proto__: null,
       request: req,
       response: res,
     });
   }
   if (isTraceHTTPEnabled() && typeof req._traceEventId === 'number') {
     traceEnd(HTTP_CLIENT_TRACE_EVENT_NAME, req._traceEventId, {
+      __proto__: null,
       path: req.path,
       statusCode: res.statusCode,
     });

lib/_http_incoming.js

@@ -55,6 +55,7 @@ function IncomingMessage(socket) {
 
   if (socket) {
     streamOptions = {
+      __proto__: null,
       highWaterMark: socket.readableHighWaterMark,
     };
   }
@@ -131,7 +132,7 @@ ObjectDefineProperty(IncomingMessage.prototype, 'headersDistinct', {
   __proto__: null,
   get: function() {
     if (!this[kHeadersDistinct]) {
-      this[kHeadersDistinct] = {};
+      this[kHeadersDistinct] = { __proto__: null };
 
       const src = this.rawHeaders;
       const dst = this[kHeadersDistinct];
@@ -151,7 +152,7 @@ ObjectDefineProperty(IncomingMessage.prototype, 'trailers', {
   __proto__: null,
   get: function() {
     if (!this[kTrailers]) {
-      this[kTrailers] = {};
+      this[kTrailers] = { __proto__: null };
 
       const src = this.rawTrailers;
       const dst = this[kTrailers];
@@ -171,7 +172,7 @@ ObjectDefineProperty(IncomingMessage.prototype, 'trailersDistinct', {
   __proto__: null,
   get: function() {
     if (!this[kTrailersDistinct]) {
-      this[kTrailersDistinct] = {};
+      this[kTrailersDistinct] = { __proto__: null };
 
       const src = this.rawTrailers;
       const dst = this[kTrailersDistinct];

lib/_http_outgoing.js

@@ -284,7 +284,7 @@ OutgoingMessage.prototype._renderHeaders = function _renderHeaders() {
   }
 
   const headersMap = this[kOutHeaders];
-  const headers = {};
+  const headers = { __proto__: null };
 
   if (headersMap !== null) {
     const keys = ObjectKeys(headersMap);
@@ -368,6 +368,7 @@ OutgoingMessage.prototype._send = function _send(data, encoding, callback, byteL
     } else {
       const header = this._header;
       this.outputData.unshift({
+        __proto__: null,
         data: header,
         encoding: 'latin1',
         callback: null,
@@ -403,7 +404,7 @@ function _writeRaw(data, encoding, callback, size) {
     return conn.write(data, encoding, callback);
   }
   // Buffer, as long as we're not destroyed.
-  this.outputData.push({ data, encoding, callback });
+  this.outputData.push({ __proto__: null, data, encoding, callback });
   this.outputSize += data.length;
   this._onPendingData(data.length);
   return this.outputSize < this[kHighWaterMark];
@@ -415,6 +416,7 @@ function _storeHeader(firstLine, headers) {
   // firstLine in the case of request is: 'GET /index.html HTTP/1.1\r\n'
   // in the case of response it is: 'HTTP/1.1 200 OK\r\n'
   const state = {
+    __proto__: null,
     connection: false,
     contLen: false,
     te: false,

lib/_http_server.js

@@ -111,6 +111,7 @@ const {
 } = require('internal/perf/observe');
 
 const STATUS_CODES = {
+  __proto__: null,
   100: 'Continue',                   // RFC 7231 6.2.1
   101: 'Switching Protocols',        // RFC 7231 6.2.2
   102: 'Processing',                 // RFC 2518 10.1 (obsoleted by RFC 4918)
@@ -210,10 +211,13 @@ function ServerResponse(req, options) {
 
   if (hasObserver('http')) {
     startPerf(this, kServerResponseStatistics, {
+      __proto__: null,
       type: 'http',
       name: 'HttpRequest',
       detail: {
+        __proto__: null,
         req: {
+          __proto__: null,
           method: req.method,
           url: req.url,
           headers: req.headers,
@@ -232,18 +236,22 @@ ObjectSetPrototypeOf(ServerResponse, OutgoingMessage);
 ServerResponse.prototype._finish = function _finish() {
   if (this[kServerResponseStatistics] && hasObserver('http')) {
     stopPerf(this, kServerResponseStatistics, {
+      __proto__: null,
       detail: {
+        __proto__: null,
         res: {
+          __proto__: null,
           statusCode: this.statusCode,
           statusMessage: this.statusMessage,
-          headers: typeof this.getHeaders === 'function' ? this.getHeaders() : {},
+          headers: typeof this.getHeaders === 'function' ? this.getHeaders() : { __proto__: null },
         },
       },
     });
   }
   OutgoingMessage.prototype._finish.call(this);
   if (isTraceHTTPEnabled() && typeof this._traceEventId === 'number') {
     const data = {
+      __proto__: null,
       url: this.req?.url,
       statusCode: this.statusCode,
     };
@@ -530,7 +538,7 @@ function Server(options, requestListener) {
   storeHTTPOptions.call(this, options);
   net.Server.call(
     this,
-    { allowHalfOpen: true, noDelay: options.noDelay ?? true,
+    { __proto__: null, allowHalfOpen: true, noDelay: options.noDelay ?? true,
       keepAlive: options.keepAlive,
       keepAliveInitialDelay: options.keepAliveInitialDelay,
       highWaterMark: options.highWaterMark });
@@ -674,6 +682,7 @@ function connectionListenerInternal(server, socket) {
   }
 
   const state = {
+    __proto__: null,
     onData: null,
     onEnd: null,
     onClose: null,
@@ -961,6 +970,7 @@ function clearIncoming(req) {
 function resOnFinish(req, res, socket, state, server) {
   if (onResponseFinishChannel.hasSubscribers) {
     onResponseFinishChannel.publish({
+      __proto__: null,
       request: req,
       response: res,
       socket,
@@ -1044,6 +1054,7 @@ function parserOnIncoming(server, socket, state, req, keepAlive) {
 
   const res = new server[kServerResponse](req,
                                           {
+                                            __proto__: null,
                                             highWaterMark: socket.writableHighWaterMark,
                                             rejectNonStandardBodyWrites: server.rejectNonStandardBodyWrites,
                                           });
@@ -1057,6 +1068,7 @@ function parserOnIncoming(server, socket, state, req, keepAlive) {
 
   if (onRequestStartChannel.hasSubscribers) {
     onRequestStartChannel.publish({
+      __proto__: null,
       request: req,
       response: res,
       socket,

lib/https.js

@@ -74,6 +74,7 @@ function Server(opts, requestListener) {
   FunctionPrototypeCall(storeHTTPOptions, this, opts);
   FunctionPrototypeCall(tls.Server, this,
                         {
+                          __proto__: null,
                           noDelay: true,
                           // http/1.0 is not defined as Protocol IDs in IANA
                           // https://www.iana.org/assignments/tls-extensiontype-values
@@ -138,11 +139,11 @@ function createConnection(port, host, options) {
   if (port !== null && typeof port === 'object') {
     options = port;
   } else if (host !== null && typeof host === 'object') {
-    options = { ...host };
+    options = { __proto__: null, ...host };
   } else if (options === null || typeof options !== 'object') {
-    options = {};
+    options = { __proto__: null };
   } else {
-    options = { ...options };
+    options = { __proto__: null, ...options };
   }
 
   if (typeof port === 'number') {
@@ -160,6 +161,7 @@ function createConnection(port, host, options) {
     if (session) {
       debug('reuse session for %j', options._agentKey);
       options = {
+        __proto__: null,
         session,
         ...options,
       };
@@ -211,7 +213,8 @@ function Agent(options) {
     this.maxCachedSessions = 100;
 
   this._sessionCache = {
-    map: {},
+    __proto__: null,
+    map: { __proto__: null },
     list: [],
   };
 }
@@ -350,15 +353,15 @@ Agent.prototype._evictSession = function _evictSession(key) {
   delete this._sessionCache.map[key];
 };
 
-const globalAgent = new Agent({ keepAlive: true, scheduling: 'lifo', timeout: 5000 });
+const globalAgent = new Agent({ __proto__: null, keepAlive: true, scheduling: 'lifo', timeout: 5000 });
 
 /**
  * Makes a request to a secure web server.
  * @param {...any} args
  * @returns {ClientRequest}
  */
 function request(...args) {
-  let options = {};
+  let options = { __proto__: null };
 
   if (typeof args[0] === 'string') {
     const urlStr = ArrayPrototypeShift(args);

lib/internal/http2/compat.js

@@ -203,6 +203,7 @@ function resumeStream(stream) {
 }
 
 const proxySocketHandler = {
+  __proto__: null,
   has(stream, prop) {
     const ref = stream.session !== undefined ? stream.session[kSocket] : stream;
     return (prop in stream) || (prop in ref);
@@ -316,8 +317,9 @@ function onStreamTimeout(kind) {
 
 class Http2ServerRequest extends Readable {
   constructor(stream, headers, options, rawHeaders) {
-    super({ autoDestroy: false, ...options });
+    super({ __proto__: null, autoDestroy: false, ...options });
     this[kState] = {
+      __proto__: null,
       closed: false,
       didRead: false,
     };
@@ -326,7 +328,7 @@ class Http2ServerRequest extends Readable {
     // initialization using Object.create(null) in HTTP/2 is intentional.
     this[kHeaders] = headers;
     this[kRawHeaders] = rawHeaders;
-    this[kTrailers] = {};
+    this[kTrailers] = { __proto__: null };
     this[kRawTrailers] = [];
     this[kStream] = stream;
     this[kAborted] = false;
@@ -475,6 +477,7 @@ class Http2ServerResponse extends Stream {
   constructor(stream, options) {
     super(options);
     this[kState] = {
+      __proto__: null,
       closed: false,
       ending: false,
       destroyed: false,
@@ -815,7 +818,7 @@ class Http2ServerResponse extends Stream {
       process.nextTick(callback, new ERR_HTTP2_INVALID_STREAM());
       return;
     }
-    this[kStream].pushStream(headers, {}, (err, stream, headers, options) => {
+    this[kStream].pushStream(headers, { __proto__: null }, (err, stream, headers, options) => {
       if (err) {
         callback(err);
         return;
@@ -829,6 +832,7 @@ class Http2ServerResponse extends Stream {
     const headers = this[kHeaders];
     headers[HTTP2_HEADER_STATUS] = state.statusCode;
     const options = {
+      __proto__: null,
       endStream: state.ending,
       waitForTrailers: true,
       sendDate: state.sendDate,
@@ -842,6 +846,7 @@ class Http2ServerResponse extends Stream {
     if (stream.headersSent || this[kState].closed)
       return false;
     stream.additionalHeaders({
+      __proto__: null,
       [HTTP2_HEADER_STATUS]: HTTP_STATUS_CONTINUE,
     });
     return true;
@@ -870,6 +875,7 @@ class Http2ServerResponse extends Stream {
       return false;
 
     stream.additionalHeaders({
+      '__proto__': null,
       ...headers,
       [HTTP2_HEADER_STATUS]: HTTP_STATUS_EARLY_HINTS,
       'Link': linkHeaderValue,