Merge pull request from GHSA-5pf6-2qwx-pxm2

duglin · web-flow · commit de2f28370b0d · 2024-03-06T09:02:25.000-05:00
Avoid modifying the DefaultClient's Transport
diff --git a/v2/protocol/http/protocol.go b/v2/protocol/http/protocol.go
@@ -102,7 +102,10 @@ func New(opts ...Option) (*Protocol, error) {
 	}
 
 	if p.Client == nil {
-		p.Client = http.DefaultClient
+		// This is how http.DefaultClient is initialized. We do not just use
+		// that because when WithRoundTripper is used, it will change the client's
+		// transport, which would cause that transport to be used process-wide.
+		p.Client = &http.Client{}
 	}
 
 	if p.roundTripper != nil {

Original file line number	Diff line number	Diff line change
`@@ -102,7 +102,10 @@ func New(opts ...Option) (*Protocol, error) {`
`102`	`102`	`}`
`103`	`103`
`104`	`104`	`if p.Client == nil {`
`105`		`- p.Client = http.DefaultClient`
	`105`	`+ // This is how http.DefaultClient is initialized. We do not just use`
	`106`	`+ // that because when WithRoundTripper is used, it will change the client's`
	`107`	`+ // transport, which would cause that transport to be used process-wide.`
	`108`	`+ p.Client = &http.Client{}`
`106`	`109`	`}`
`107`	`110`
`108`	`111`	`if p.roundTripper != nil {`