Strip IPv6 link-local zone id from absolute-form proxy request target - #13428
Strip IPv6 link-local zone id from absolute-form proxy request target#13428Swastikbhat-lab wants to merge 1 commit into
Conversation
psf-chronographer
Bot
added
the
bot:chronographer:provided
The absolute-form request target sent to an HTTP proxy was built from str(self.url), which includes the IPv6 link-local zone id (e.g. %eth0). Per RFC 6874 the zone id only has local significance at the sending host and must be stripped from outgoing URIs; leaving it in the request line makes the request invalid for strict proxies and servers.
622addb to
0ae8684
Compare
Confidence Score: 4/5The runtime fix appears safe to merge, with only the non-blocking changelog symlink requirement outstanding. The proxy request-target behavior is covered for both supported zone representations, while the sole accepted concern is repository release-note bookkeeping rather than runtime correctness. Files Needing Attention: CHANGES/13401.bugfix.rst Reviews (1): Last reviewed commit: "Strip IPv6 link-local zone id from proxy..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| Strip the IPv6 link-local zone id from the absolute-form request | ||
| target sent to an HTTP proxy, per :rfc:`6874` -- by :user:`Swastikbhat-lab`. |
There was a problem hiding this comment.
This issue-numbered fragment lacks the required CHANGES/13428.bugfix.rst symlink, so the repository's issue/PR changelog association does not include this pull request under its own number.
Context Used: AGENTS.md (source)
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #13428 +/- ##
=======================================
Coverage 98.41% 98.41%
=======================================
Files 133 133
Lines 49748 49766 +18
Branches 2629 2630 +1
=======================================
+ Hits 48960 48978 +18
Misses 663 663
Partials 125 125
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. |
Merging this PR will degrade performance by 9.61%
|
| Benchmark | BASE |
HEAD |
Efficiency | |
|---|---|---|---|---|
| ❌ | test_client_request_update_cookies |
360.7 µs | 399 µs | -9.61% |
Tip
Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.
Comparing Swastikbhat-lab:fix/ipv6-zone-proxy-request-line (0ae8684) with master (356d355)
Footnotes
-
83 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩
2 participants
What type of PR is this? (check all applicable)
Description
When a request to an IPv6 link-local URL with a zone id (e.g.
http://[fe80::1%eth0]/) is sent through an HTTP proxy, aiohttp puts the zone id verbatim into the absolute-form request target of the request line:Per RFC 6874 §4, the zone id only has local significance at the sending host and must be stripped from outgoing URIs — and
%eth0is not even valid URI syntax inside an IPv6 literal (RFC 3986). Strict proxies and gateways that validate the request target reject such requests, so the client gets a connection/400 failure even though the zone is required for routing at the socket layer.This is the sibling of the Host-header leak already covered by #13409 (which strips the zone from the
Hostheader and the CONNECT authority in_send()): the absolute-form branch in the same function still built the request target from the raw URL. This PR completes the RFC 6874 fix for that remaining path.Related Issues / Pull Requests
Before/After
Before:
After:
Both the raw (
%eth0) and RFC 6874-encoded (%25eth0) zone forms are covered.Additional Context
tests/test_client_request.py,tests/test_client_functional.py,tests/test_client_session.py,tests/test_connector.py,tests/test_proxy.py,tests/test_proxy_functional.py: all green.Checklist
CHANGES/(seeCHANGES/README.rst).