Skip to content

fix(engine.io-client): prevent mutation of user-provided options#5471

Open
idirdev wants to merge 1 commit intosocketio:mainfrom
idirdev:fix/prevent-options-mutation
Open

fix(engine.io-client): prevent mutation of user-provided options#5471
idirdev wants to merge 1 commit intosocketio:mainfrom
idirdev:fix/prevent-options-mutation

Conversation

@idirdev
Copy link

@idirdev idirdev commented Mar 10, 2026

Problem

When creating a socket with io(url, options), the transports array in the user-provided options object is mutated from string names (["websocket", "polling"]) to transport constructor classes ([class WS, class XHR]).

This is unexpected behavior — the caller's options object should remain untouched after being passed to io().

const options = { transports: ["websocket", "polling"] };
const socket = io("http://localhost", options);
console.log(options.transports); // [class WS, class XHR] — mutated!

Root cause

In packages/engine.io-client/lib/socket.ts, the Socket constructor assigns o directly to the caller's options reference:

const o = typeof uri === "object" ? uri : opts;

Then o.transports is reassigned with mapped constructor classes, which mutates the original object.

Fix

Shallow-clone the options before processing:

const o = typeof uri === "object" ? { ...uri } : { ...opts };

This ensures modifications stay internal and the caller's object is never touched.

Test

Added a regression test in packages/engine.io-client/test/socket.js that verifies options.transports remains unchanged after constructing a Socket.

Fixes #5462

The Socket constructor was directly referencing the caller's options
object, causing the transports array to be replaced from string names
to transport constructor classes. This shallow-clones the options
before processing so the original object remains untouched.

Fixes socketio#5462
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

socket.io-client - transports options array modified from [string] to [object] by io constructor

2 participants