fix: close APT adversarial runtime gaps

src/update-policy.js

@@ -140,27 +140,44 @@ function parseRelease(body) {
   };
 }
 
-function defaultRequest({ url, timeoutMs, maxBodyBytes }) {
+function defaultRequest({
+  url,
+  timeoutMs,
+  maxBodyBytes,
+  httpsGet = https.get,
+  setTimer = setTimeout,
+  clearTimer = clearTimeout,
+}) {
   if (url !== LATEST_RELEASE_URL) {
     return Promise.reject(policyError('UNTRUSTED_REQUEST_URL', 'Update checks are restricted to GitPeji'));
   }
 
   return new Promise((resolve, reject) => {
     let settled = false;
+    let responseStream = null;
+    let deadlineTimer = null;
+    const clearDeadline = () => {
+      if (deadlineTimer !== null) {
+        clearTimer(deadlineTimer);
+        deadlineTimer = null;
+      }
+    };
     const finishReject = (error) => {
       if (!settled) {
         settled = true;
+        clearDeadline();
         reject(error);
       }
     };
 
-    const request = https.get(url, {
+    const request = httpsGet(url, {
       headers: {
         accept: 'application/json',
         'user-agent': 'Alta-Proxy-Tool-update-check',
       },
       agent: false,
     }, (response) => {
+      responseStream = response;
       const chunks = [];
       let receivedBytes = 0;
       const contentLength = Number(response.headers['content-length']);
@@ -183,6 +200,7 @@ function defaultRequest({ url, timeoutMs, maxBodyBytes }) {
       response.on('end', () => {
         if (settled) return;
         settled = true;
+        clearDeadline();
         resolve({
           statusCode: response.statusCode,
           headers: response.headers,
@@ -193,9 +211,12 @@ function defaultRequest({ url, timeoutMs, maxBodyBytes }) {
       response.on('error', finishReject);
     });
 
-    request.setTimeout(timeoutMs, () => {
-      request.destroy(policyError('REQUEST_TIMEOUT', 'Release check timed out'));
-    });
+    deadlineTimer = setTimer(() => {
+      const timeoutError = policyError('REQUEST_TIMEOUT', 'Release check timed out');
+      if (responseStream && typeof responseStream.destroy === 'function') responseStream.destroy();
+      request.destroy(timeoutError);
+      finishReject(timeoutError);
+    }, timeoutMs);
     request.on('error', (error) => {
       if (error instanceof UpdatePolicyError) {
         finishReject(error);