@bagder refactoring is always risky. Kinda wonder what an exploit scenario would look like though; it has to be a malicious server, the user has to be intentionally trying to reach it via SOCKS, and they must have some kind of ongoing service relationship for the server to have fingerprinted the client well enough to push an effective payload.
@hyc yeah. Perhaps most realistically, a Tor user (which normally uses SOCKS5) going to a HTTPS site that has been breached or similar