You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
requests.utils.should_bypass_proxies temporary modifies the environment, calls into httplib and then restores the environment. However, it takes no locks while doing so, so two threads both using requests could lead to a permanent change to the environment. Even with a lock, any other thread that depends on the environment may observe the change (e.g. it may launch curl in a subprocess, and curl will then pick up this no_proxy setting).
Expected Result
The environment is not modified by requests.
Actual Result
I haven't observed this bug in practice - it's a theoretical race condition I can see in the code. In the reproduction code below, I believe the following sequence could occur:
Now after all the requests have been finished, the environment has been modified.
Reproduction Steps
I think this code can in theory trigger the race condition, although I haven't observed it. It needs an HTTP server on localhost:8080 (or just edit the URL)
requests.utils.should_bypass_proxies
temporary modifies the environment, calls into httplib and then restores the environment. However, it takes no locks while doing so, so two threads both using requests could lead to a permanent change to the environment. Even with a lock, any other thread that depends on the environment may observe the change (e.g. it may launch curl in a subprocess, and curl will then pick up thisno_proxy
setting).Expected Result
The environment is not modified by requests.
Actual Result
I haven't observed this bug in practice - it's a theoretical race condition I can see in the code. In the reproduction code below, I believe the following sequence could occur:
old_value = None
,os.environ['no_proxy'] = 'xyz'
.old_value = 'xyz'
, `os.environ['no_proxy'] = 'xyz'.os.environ['no_proxy']
.os.environ['no_proxy'] = 'xyz'
.Now after all the requests have been finished, the environment has been modified.
Reproduction Steps
I think this code can in theory trigger the race condition, although I haven't observed it. It needs an HTTP server on localhost:8080 (or just edit the URL)
System Information
The text was updated successfully, but these errors were encountered: