net: emit an error when custom lookup resolves to a non-string address

PR-URL: nodejs#57192
Fixes: nodejs#57112
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Benjamin Gruenbaum <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Daeyeon Jeong <[email protected]>
Reviewed-By: Jason Zhang <[email protected]>
Reviewed-By: Michaël Zasso <[email protected]>

lib/net.js

@@ -1416,7 +1416,7 @@ function lookupAndConnect(self, options) {
         // calls net.Socket.connect() on it (that's us). There are no event
         // listeners registered yet so defer the error event to the next tick.
         process.nextTick(connectErrorNT, self, err);
-      } else if (!isIP(ip)) {
+      } else if ((typeof ip !== 'string') || !isIP(ip)) {
         err = new ERR_INVALID_IP_ADDRESS(ip);
         process.nextTick(connectErrorNT, self, err);
       } else if (addressType !== 4 && addressType !== 6) {

test/parallel/test-net-connect-custom-lookup-non-string-address.mjs

@@ -0,0 +1,44 @@
+import * as common from '../common/index.mjs';
+import net from 'node:net';
+import { describe, it } from 'node:test';
+
+const brokenCustomLookup = (_hostname, options, callback) => {
+  // Incorrectly return an array of IPs instead of a string.
+  callback(null, ['127.0.0.1'], options.family);
+};
+
+describe('when family is ipv4', () => {
+  it('socket emits an error when lookup does not return a string', (t, done) => {
+    const options = {
+      host: 'example.com',
+      port: 80,
+      lookup: brokenCustomLookup,
+      family: 4
+    };
+
+    const socket = net.connect(options, common.mustNotCall());
+    socket.on('error', (err) => {
+      t.assert.strictEqual(err.code, 'ERR_INVALID_IP_ADDRESS');
+
+      done();
+    });
+  });
+});
+
+describe('when family is ipv6', () => {
+  it('socket emits an error when lookup does not return a string', (t, done) => {
+    const options = {
+      host: 'example.com',
+      port: 80,
+      lookup: brokenCustomLookup,
+      family: 6
+    };
+
+    const socket = net.connect(options, common.mustNotCall());
+    socket.on('error', (err) => {
+      t.assert.strictEqual(err.code, 'ERR_INVALID_IP_ADDRESS');
+
+      done();
+    });
+  });
+});