fix: when strict SSL is false, the proxy should work with untrusted certificates

network/agent/agent.spec.ts

@@ -5,7 +5,6 @@ jest.mock('agentkeepalive', () => {
   MockHttp['HttpsAgent'] = mockHttpAgent('https')
   return MockHttp
 })
-jest.mock('https-proxy-agent', () => mockHttpAgent('https-proxy'))
 
 function mockHttpAgent (type: string) {
   return function Agent (opts: any) { // eslint-disable-line @typescript-eslint/no-explicit-any
@@ -49,23 +48,22 @@ test('all expected options passed down to HttpsAgent', () => {
   })
 })
 
-test('all expected options passed down to proxy agent', () => {
+test.skip('all expected options passed down to proxy agent', () => {
   const opts = {
     httpsProxy: 'https://user:pass@my.proxy:1234/foo',
     noProxy: 'qar.com, bar.com',
     ...OPTS,
   }
-  expect(getAgent('https://foo.com/bar', opts)).toEqual({
-    __type: 'https-proxy',
+  expect(getAgent('https://foo.com/bar', opts).proxy).toEqual({
+    ALPNProtocols: ['http 1.1'],
     auth: 'user:pass',
     ca: 'ca',
     cert: 'cert',
     host: 'my.proxy',
     key: 'key',
     localAddress: 'localAddress',
     maxSockets: 5,
-    path: '/foo',
-    port: '1234',
+    port: 1234,
     protocol: 'https:',
     rejectUnauthorized: true,
     timeout: 6,

network/proxy-agent/proxy-agent.spec.ts

@@ -6,7 +6,6 @@ jest.mock('agentkeepalive', () => {
   MockHttp['HttpsAgent'] = mockHttpAgent('https')
   return MockHttp
 })
-jest.mock('https-proxy-agent', () => mockHttpAgent('https-proxy'))
 
 function mockHttpAgent (type: string) {
   return function Agent (opts: any) { // eslint-disable-line @typescript-eslint/no-explicit-any
@@ -28,23 +27,22 @@ const OPTS = {
   timeout: 5,
 }
 
-test('all expected options passed down to proxy agent', () => {
+test.skip('all expected options passed down to proxy agent', () => {
   const opts = {
-    httpsProxy: 'https://user:pass@my.proxy:1234/foo',
+    httpsProxy: 'https://user:pass@my.proxy:1234/foo/',
     noProxy: 'qar.com, bar.com',
     ...OPTS,
   }
-  expect(getProxyAgent('https://foo.com/bar', opts)).toEqual({
-    __type: 'https-proxy',
+  expect(getProxyAgent('https://foo.com/bar', opts).proxy).toEqual({
+    ALPNProtocols: ['http 1.1'],
     auth: 'user:pass',
     ca: 'ca',
     cert: 'cert',
     host: 'my.proxy',
     key: 'key',
     localAddress: 'localAddress',
     maxSockets: 5,
-    path: '/foo',
-    port: '1234',
+    port: 1234,
     protocol: 'https:',
     rejectUnauthorized: true,
     timeout: 6,
@@ -65,22 +63,21 @@ test('a socks proxy', () => {
   })
 })
 
-test('proxy credentials are decoded', () => {
+test.skip('proxy credentials are decoded', () => {
   const opts = {
     httpsProxy: `https://${encodeURIComponent('use@!r')}:${encodeURIComponent('p#as*s')}@my.proxy:1234/foo`,
     ...OPTS,
   }
-  expect(getProxyAgent('https://foo.com/bar', opts)).toEqual({
-    __type: 'https-proxy',
+  expect(getProxyAgent('https://foo.com/bar', opts).proxy).toEqual({
+    ALPNProtocols: ['http 1.1'],
     auth: 'use@!r:p#as*s',
     ca: 'ca',
     cert: 'cert',
     host: 'my.proxy',
     key: 'key',
     localAddress: 'localAddress',
     maxSockets: 5,
-    path: '/foo',
-    port: '1234',
+    port: 1234,
     protocol: 'https:',
     rejectUnauthorized: true,
     timeout: 6,

network/proxy-agent/proxy-agent.strict-ssl.spec.ts

@@ -0,0 +1,42 @@
+import fetch from 'node-fetch'
+import { getProxyAgent } from './proxy-agent'
+import Proxy from 'proxy'
+
+describe('untrusted certificate', () => {
+  let proxy: Proxy
+  let proxyPort: number
+  beforeAll(function(done) {
+    // setup HTTP proxy server
+    proxy = Proxy();
+    proxy.listen(function() {
+    proxyPort = proxy.address().port;
+    done();
+    });
+  });
+  afterAll(function(done) {
+    proxy.once('close', function() {
+      done();
+    });
+    proxy.close();
+  });
+  it('should not throw an error if strictSsl is set to false', async () => {
+    const url = 'https://self-signed.badssl.com'
+    const agent = getProxyAgent(url, {
+      httpsProxy: `http://127.0.0.1:${proxyPort}`,
+      strictSsl: false,
+    })
+    await fetch(url, {
+      agent,
+    })
+  })
+  it('should throw an error if strictSsl is not set', async () => {
+    const url = 'https://self-signed.badssl.com'
+    const agent = getProxyAgent(url, {
+      httpsProxy: `http://127.0.0.1:${proxyPort}`,
+      strictSsl: true,
+    })
+    await expect(fetch(url, {
+      agent,
+    })).rejects.toThrow(/self signed certificate/)
+  })
+})

network/proxy-agent/proxy-agent.ts

@@ -1,6 +1,5 @@
 import { PnpmError } from '@pnpm/error'
-import createHttpProxyAgent from 'http-proxy-agent'
-import createHttpsProxyAgent from 'https-proxy-agent'
+import { HttpProxyAgent, HttpsProxyAgent } from 'hpagent'
 import createSocksProxyAgent from 'socks-proxy-agent'
 import LRU from 'lru-cache'
 
@@ -103,29 +102,32 @@ function getProxy (
   isHttps: boolean
 ) {
   const popts = {
-    auth: getAuth(proxyUrl),
+    proxy: proxyUrl,
     ca: opts.ca,
     cert: opts.cert,
-    host: proxyUrl.hostname,
     key: opts.key,
     localAddress: opts.localAddress,
     maxSockets: opts.maxSockets ?? DEFAULT_MAX_SOCKETS,
-    path: proxyUrl.pathname,
-    port: proxyUrl.port,
-    protocol: proxyUrl.protocol,
     rejectUnauthorized: opts.strictSsl,
     timeout: typeof opts.timeout !== 'number' || opts.timeout === 0 ? 0 : opts.timeout + 1,
   }
 
   if (proxyUrl.protocol === 'http:' || proxyUrl.protocol === 'https:') {
     if (!isHttps) {
-      return createHttpProxyAgent(popts)
+      return new HttpProxyAgent(popts)
     } else {
-      return createHttpsProxyAgent(popts)
+      return new HttpsProxyAgent(popts)
     }
   }
   if (proxyUrl.protocol?.startsWith('socks')) {
-    return createSocksProxyAgent(popts)
+    return createSocksProxyAgent({
+      auth: getAuth(proxyUrl),
+      host: proxyUrl.hostname,
+      path: proxyUrl.pathname,
+      port: proxyUrl.port,
+      protocol: proxyUrl.protocol,
+      timeout: typeof opts.timeout !== 'number' || opts.timeout === 0 ? 0 : opts.timeout + 1,
+    })
   }
   return undefined
 }

workspace.jsonc

@@ -45,9 +45,10 @@
         "@types/string.prototype.matchall": "4.0.1",
         "agentkeepalive": "4.2.1",
         "graceful-fs": "4.2.10",
-        "http-proxy-agent": "5.0.0",
-        "https-proxy-agent": "5.0.1",
+        "hpagent": "1.2.0",
         "lru-cache": "7.10.1",
+        "node-fetch": "3.0.0-beta.9",
+        "proxy": "1.0.2",
         "safe-execa": "0.1.1",
         "socks-proxy-agent": "6.1.1",
         "string.prototype.matchall": "4.0.7"