stop named-pipe tls.connect({ socket }) re-emitting post-upgrade bytes on the original socket

src/js/node/net.ts

@@ -138,6 +138,7 @@ const kAttach = Symbol("kAttach");
 const kCloseRawConnection = Symbol("kCloseRawConnection");
 const kpendingRead = Symbol("kpendingRead");
 const kupgraded = Symbol("kupgraded");
+const kupgradeDuplexFeeder = Symbol("kupgradeDuplexFeeder");
 const ksocket = Symbol("ksocket");
 const khandlers = Symbol("khandlers");
 const kclosed = Symbol("closed");
@@ -1021,6 +1022,14 @@ const SocketHandlers2: SocketHandler<NonNullable<import("node:net").Socket["_han
     const { self } = socket.data;
     self._unrefTimer();
     self.bytesRead += buffer.length;
+    // Named-pipe TLS upgrade: feed ciphertext straight to the TLS layer instead of
+    // pushing it onto the connection's readable, so post-upgrade bytes don't re-emit
+    // as cleartext on pre-existing user `data` listeners. See #32242.
+    const feeder = self[kupgradeDuplexFeeder];
+    if (feeder !== undefined) {
+      feeder(buffer);
+      return;
+    }
     if (!self.push(buffer)) socket.pause();
   },
   drain(socket) {
@@ -1340,6 +1349,7 @@ function Socket(options?) {
   this._parentWrap = null;
   this[kpendingRead] = undefined;
   this[kupgraded] = null;
+  this[kupgradeDuplexFeeder] = undefined;
 
   this[kSetNoDelay] = Boolean(noDelay);
   this[kSetKeepAlive] = Boolean(keepAlive);
@@ -1431,6 +1441,14 @@ function Socket(options?) {
         const { self } = socket.data;
         if (!self) return;
         self._unrefTimer();
+        // After a named-pipe TLS upgrade, route ciphertext to the TLS feeder
+        // rather than the user's onread.callback (same re-emission concern as
+        // SocketHandlers2.data above; #32242).
+        const feeder = self[kupgradeDuplexFeeder];
+        if (feeder !== undefined) {
+          feeder(buffer);
+          return;
+        }
         try {
           onread.callback(buffer.length, buffer);
         } catch (e) {
@@ -1555,6 +1573,19 @@ Socket.prototype[kCloseRawConnection] = function () {
   connection.destroy();
 };
 
+// Wires the TLS feeder for a duplex-upgraded connection. A named-pipe net.Socket
+// delivers bytes through SocketHandlers2.data, so route them straight to the feeder
+// (bypassing the public `data` event) to avoid re-emitting post-upgrade ciphertext
+// on pre-existing user listeners (#32242). A pure Duplex has no such handler, so it
+// must be fed via its public `data` event.
+function attachUpgradeDuplexDataFeeder(connection, onData) {
+  if (connection instanceof Socket) {
+    connection[kupgradeDuplexFeeder] = onData;
+  } else {
+    connection.on("data", onData);
+  }
+}
+
 Socket.prototype.connect = function connect(...args) {
   $debug("Socket.prototype.connect");
   {
@@ -1681,7 +1712,7 @@ Socket.prototype.connect = function connect(...args) {
             tls,
             socket: this[khandlers],
           });
-          connection.on("data", events[0]);
+          attachUpgradeDuplexDataFeeder(connection, events[0]);
           connection.on("end", events[1]);
           connection.on("drain", events[2]);
           connection.on("close", events[3]);
@@ -1731,7 +1762,7 @@ Socket.prototype.connect = function connect(...args) {
                   tls,
                   socket: this[khandlers],
                 });
-                connection.on("data", events[0]);
+                attachUpgradeDuplexDataFeeder(connection, events[0]);
                 connection.on("end", events[1]);
                 connection.on("drain", events[2]);
                 connection.on("close", events[3]);

test/js/node/tls/node-tls-namedpipes.test.ts

@@ -94,3 +94,57 @@ it.if(isWindows)("should be able to upgrade a named pipe connection to TLS", asy
   await test(`\\\\.\\pipe\\test\\${randomUUID()}`);
   await expectMaxObjectTypeCount(expect, "TLSSocket", 3);
 });
+
+// https://github.com/oven-sh/bun/issues/32242
+it.if(isWindows)("named-pipe TLS upgrade does not re-emit bytes on the original socket", async () => {
+  const { promise: messageReceived, resolve: resolveMessageReceived } = Promise.withResolvers<string>();
+  const { promise: clientReceived, resolve: resolveClientReceived } = Promise.withResolvers<string>();
+  const { promise: done, resolve: resolveDone, reject: rejectDone } = Promise.withResolvers<void>();
+
+  let client: ReturnType<typeof connect> | null = null;
+  let nonTLSClient: ReturnType<typeof net.connect> | null = null;
+  let server: ReturnType<typeof createServer> | null = null;
+
+  const leakedToOriginal: Buffer[] = [];
+
+  const pipe_name = `\\\\.\\pipe\\test\\${randomUUID()}`;
+  try {
+    server = createServer(tls, socket => {
+      socket.on("error", rejectDone);
+      socket.on("data", data => {
+        socket.write("Goodbye World!");
+        resolveMessageReceived(data.toString());
+      });
+    });
+    server.on("error", rejectDone);
+
+    server.listen(pipe_name);
+    await once(server, "listening");
+
+    nonTLSClient = net.connect(pipe_name);
+    nonTLSClient.on("error", rejectDone);
+    nonTLSClient.on("data", chunk => {
+      leakedToOriginal.push(chunk);
+    });
+
+    client = connect({ socket: nonTLSClient, ca: tls.cert });
+    client.on("error", rejectDone);
+    client.on("data", data => {
+      resolveClientReceived(data.toString());
+    });
+
+    await Promise.race([once(client, "secureConnect"), done]);
+    client.write("Hello World!");
+
+    expect(await Promise.race([messageReceived, done])).toBe("Hello World!");
+    expect(await Promise.race([clientReceived, done])).toBe("Goodbye World!");
+
+    expect(Buffer.concat(leakedToOriginal).length).toBe(0);
+    resolveDone();
+    await done;
+  } finally {
+    client?.destroy();
+    nonTLSClient?.destroy();
+    server?.close();
+  }
+});