Repository navigation
fix(ext/fetch): require --allow-net for Unix proxy in createHttpClient - #35231
Merged
Merged
Conversation
Deno.createHttpClient with a Unix-socket proxy transport checked only filesystem access to the socket path. It now also requires an --allow-net=unix:<path> rule, matching the direct Unix socket ops and the Tcp/Vsock proxy branches.
bartlomieju
enabled auto-merge (squash)
June 15, 2026 11:49
The fetchUnixProxyScopedAllowNetGrantsAccess subprocess fetches http://localhost/, which performs the normal net check on the request URL host (localhost:80) independently of the Unix proxy grant. Add localhost to the --allow-net rule so the request is permitted.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR #34395 added a Unix-domain-socket network boundary: Unix socket endpoints
are represented as
--allow-net=unix:<absolute-path>, and the direct Unixsocket ops (
Deno.connect,Deno.listen,Deno.listenDatagram, andDatagramConn.send) now require that grant in addition to the existingfilesystem check on the socket path.
Deno.createHttpClient({ proxy: { transport: "unix", path } })is a siblingUnix-socket transport that the original change did not cover. The
Proxy::Unixbranch in
op_fetch_custom_clientonly performed the filesystemcheck_openon the socket path and never called
check_net_unix_socket, so a custom clientcould route
fetch()traffic to a local Unix socket with filesystem accessalone, without an
--allow-net=unix:<path>grant. The two neighboring branchesin the same match already do the right thing:
Proxy::Tcpcallscheck_netand
Proxy::Vsockcallscheck_net_vsock.This makes the Unix proxy connector consistent with its siblings and with the
direct Unix socket ops: after resolving the socket path with
check_open, itnow also calls
check_net_unix_socketbefore storing the normalized path.Added regression tests covering a Unix-proxy
createHttpClientdenied withread/write but no
--allow-net=unix:<path>, denial when the scoped rule namesa different socket path, and success when the rule matches the exact path. The
existing
fetchUnixSockettest continues to exercise the allowed path underunscoped
--allow-net.