Strip IPv6 link-local zone id from absolute-form proxy request target - #13428
Strip IPv6 link-local zone id from absolute-form proxy request target#13428Swastikbhat-lab wants to merge 4 commits into
Conversation
psf-chronographer
Bot
added
the
bot:chronographer:provided
The absolute-form request target sent to an HTTP proxy was built from str(self.url), which includes the IPv6 link-local zone id (e.g. %eth0). Per RFC 6874 the zone id only has local significance at the sending host and must be stripped from outgoing URIs; leaving it in the request line makes the request invalid for strict proxies and servers.
622addb to
0ae8684
Compare
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains; the previously reported missing PR-numbered changelog symlink is present and correctly targets the issue-numbered fragment. Reviews (4): Last reviewed commit: "Merge branch 'master' into fix/ipv6-zone..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| Strip the IPv6 link-local zone id from the absolute-form request | ||
| target sent to an HTTP proxy, per :rfc:`6874` -- by :user:`Swastikbhat-lab`. |
There was a problem hiding this comment.
This issue-numbered fragment lacks the required CHANGES/13428.bugfix.rst symlink, so the repository's issue/PR changelog association does not include this pull request under its own number.
Context Used: AGENTS.md (source)
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #13428 +/- ##
=======================================
Coverage 98.99% 98.99%
=======================================
Files 132 132
Lines 49455 49473 +18
Branches 2571 2572 +1
=======================================
+ Hits 48960 48978 +18
Misses 371 371
Partials 124 124
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. |
Merging this PR will not alter performance
Comparing 
Footnotes
|
2 participants
What type of PR is this? (check all applicable)
Description
When a request to an IPv6 link-local URL with a zone id (e.g.
http://[fe80::1%eth0]/) is sent through an HTTP proxy, aiohttp puts the zone id verbatim into the absolute-form request target of the request line:Per RFC 6874 §4, the zone id only has local significance at the sending host and must be stripped from outgoing URIs — and
%eth0is not even valid URI syntax inside an IPv6 literal (RFC 3986). Strict proxies and gateways that validate the request target reject such requests, so the client gets a connection/400 failure even though the zone is required for routing at the socket layer.This is the sibling of the Host-header leak already covered by #13409 (which strips the zone from the
Hostheader and the CONNECT authority in_send()): the absolute-form branch in the same function still built the request target from the raw URL. This PR completes the RFC 6874 fix for that remaining path.Related Issues / Pull Requests
Before/After
Before:
After:
Both the raw (
%eth0) and RFC 6874-encoded (%25eth0) zone forms are covered.Additional Context
tests/test_client_request.py,tests/test_client_functional.py,tests/test_client_session.py,tests/test_connector.py,tests/test_proxy.py,tests/test_proxy_functional.py: all green.Checklist
CHANGES/(seeCHANGES/README.rst).