File CVE-2023-32681.patch of Package python-requests.29714
Index: requests-2.25.1/requests/sessions.py
===================================================================
--- requests-2.25.1.orig/requests/sessions.py
+++ requests-2.25.1/requests/sessions.py
@@ -306,7 +306,9 @@ class SessionRedirectMixin(object):
except KeyError:
username, password = None, None
- if username and password:
+ # urllib3 handles proxy authorization for us in the standard adapter.
+ # Avoid appending this to TLS tunneled requests where it may be leaked.
+ if not scheme.startswith('https') and username and password:
headers['Proxy-Authorization'] = _basic_auth_str(username, password)
return new_proxies
Index: requests-2.25.1/tests/test_requests.py
===================================================================
--- requests-2.25.1.orig/tests/test_requests.py
+++ requests-2.25.1/tests/test_requests.py
@@ -551,6 +551,26 @@ class TestRequests:
with pytest.raises(InvalidProxyURL):
requests.get(httpbin(), proxies={'http': 'http:///example.com:8080'})
+
+ @pytest.mark.parametrize(
+ "url,has_proxy_auth",
+ (
+ ('http://example.com', True),
+ ('https://example.com', False),
+ ),
+ )
+ def test_proxy_authorization_not_appended_to_https_request(self, url, has_proxy_auth):
+ session = requests.Session()
+ proxies = {
+ 'http': 'http://test:pass@localhost:8080',
+ 'https': 'http://test:pass@localhost:8090',
+ }
+ req = requests.Request('GET', url)
+ prep = req.prepare()
+ session.rebuild_proxies(prep, proxies)
+
+ assert ('Proxy-Authorization' in prep.headers) is has_proxy_auth
+
def test_basicauth_with_netrc(self, httpbin):
auth = ('user', 'pass')
wrong_auth = ('wronguser', 'wrongpass')