actions / actions/toolkit

CONNECT request issued for http proxies trying to reach http target

Open
#1,431 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
TypeScript
Stars
5.9k
Forks
1.8k
PR merge metrics
No merged PRs in 30d

Description

Describe the bug
This relates to the @actions/http-client and @actions/github packages.

The hydrated octokit client exposed by @actions/github is configured to respect http_proxy, https_proxy and no_proxy env variables using the getAgent method exposed by HttpClient class from @actions/http-client .

However, the getAgent method tries to establish a TLS tunnel to the target via a proxy by issuing CONNECT requests even when we are trying to reach a http target. In my opinion, in this case a TLS tunnel doesn't make sense since the proxy as well as the target are http and not https.

I think the reason behind this is the tunnel package:
https://github.com/koichik/node-tunnel/blob/master/lib/tunnel.js#L108

To Reproduce

import { getOctokit } from "@actions/github"

process.env["GITHUB_API_URL"] = "http://API_URL"
process.env["http_proxy"] = "http://PROXY_URL"
const github = getOctokit(token, opts);
const { data } = await github.rest.repos.get({
    owner,
    repo
});

If your proxy is not configured for CONNECT requests for http targets then you will see some errors.

This is a small piece of code to reproduce this error. As for my own use case, I need this to help run e2e tests for github actions locally using mock-github and act-js. See issue:

Expected behavior
It shouldn't issue CONNECT request when the target and proxy protocol is http

Additional context
Since the package tunnel is not being maintained, maybe we should use some other package like proxy-agent as recommended in the octokit.js docs:
https://github.com/octokit/octokit.js/#proxy-servers-nodejs-only

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the @actions/http-client HttpClient.getAgent path and reproduce the request using the TypeScript example with an HTTP API target and HTTP proxy. Review the referenced tunnel behavior and determine how proxy handling distinguishes HTTP from HTTPS; done means HTTP targets no longer receive CONNECT requests while the existing HTTPS proxy behavior remains intact.

Written by the indexing model from the issue text.

Assessment

Tech stack
github, node.js, typescript
Domain
api, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.