http: match subdomains for plain NO_PROXY entries - #65617
Open
dibenkobit wants to merge 4 commits into
Open
Conversation
NO_PROXY=example.com only exact-matched the hostname in the http(s) builtins, so requests to subdomains still used the proxy. fetch() already matches the host and its subdomains. Reuse the existing suffix matcher (label boundary) for plain entries as well as leading-dot ones. Fixes: nodejs#65616 Assisted-by: Grok 4.6 Extra High Signed-off-by: Nikita Snetkov <lukyanish@gmail.com>
Collaborator
|
Review requested:
|
nodejs-github-bot
added
http
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #65617 +/- ##
==========================================
- Coverage 90.07% 90.06% -0.01%
==========================================
Files 751 751
Lines 254916 254918 +2
Branches 48133 48129 -4
==========================================
- Hits 229605 229588 -17
- Misses 16496 16498 +2
- Partials 8815 8832 +17
🚀 New features to boost your workflow:
|
inoway46
reviewed
Aug 30, 2026
| const suffix = entry.substring(1); | ||
| // Strip a leading "." if present, then match as a suffix with a | ||
| // label boundary. "*.example.com" is handled below (subdomains only). | ||
| if (!entry.startsWith('*.')) { |
Contributor
There was a problem hiding this comment.
Could we limit suffix matching to domain entries?
As written, NO_PROXY=127.0.0.1 also bypasses foo.127.0.0.1, although IP entries are documented as exact matches. Empty entries from trailing commas can also match hostnames ending in a dot.
Author
There was a problem hiding this comment.
Fixed :)
- Empty entries are now dropped when parsing the list.
- Suffix matching are only applies between domains, so IP entries are back to exact matches.
inoway46
reviewed
Aug 30, 2026
|
|
||
| // The request should go through the proxy (not bypass it), | ||
| // because badexample.com is not a subdomain of example.com. | ||
| assert.match(stdout, /Status Code: 200/); |
Contributor
There was a problem hiding this comment.
This test seems to pass whether the proxy is used or bypassed, since both paths reach the same server. Could we also assert that the custom lookup for badexample.com was not used?
For example:
assert.doesNotMatch(
stdout,
/Resolving lookup for badexample\.com/,
);
Author
There was a problem hiding this comment.
Added it to all three negative blocks
Limit NO_PROXY suffix matching to domain entries and domain hosts: - drop empty entries (e.g. from trailing commas) at parse time, so they can no longer match hostnames ending with a dot - IP entries only match a host exactly; IP hosts can only be bypassed by exact IP, IP:port, or IP range entries - degenerate "." and "*." entries no longer match every host ending with a dot Assisted-by: Claude Fable 5 Signed-off-by: Nikita Snetkov <lukyanish@gmail.com>
Assert that the negative NO_PROXY domain tests actually go through the proxy: both paths return 200 from the same server, so assert on the absence of the custom lookup log line instead. Assisted-by: Claude Fable 5 Signed-off-by: Nikita Snetkov <lukyanish@gmail.com>
Reword the NO_PROXY IP-matching note: the previous wording contradicted the IP range and host:port forms listed above it. Assisted-by: Claude Fable 5 Signed-off-by: Nikita Snetkov <lukyanish@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
NO_PROXY=example.com only exact-matched in the http(s) builtins, so
subdomains still went through the proxy. Match subdomains like fetch()
does.
*.example.comis unchanged.Also tightened while at it: empty entries are ignored, IP entries are
exact matches only, degenerate
./*.entries no longer match.Fixes: #65616
Refs: #57872
Assisted-by: Grok 4.6 Extra High
Assisted-by: Fable 5
cc @nodejs/http