[bug] NO_PROXY does not respect CIDRs

[turettn]

👋 The comments for get_environment_proxies implies that CIDRs are supported in the NO_PROXY environment variable:

            # NO_PROXY=.google.com is marked as "all://*.google.com,
            #   which disables "www.google.com" but not "google.com"
            # NO_PROXY=google.com is marked as "all://*google.com,
            #   which disables "www.google.com" and "google.com".
            #   (But not "wwwgoogle.com")
            # NO_PROXY can include domains, IPv6, IPv4 addresses and "localhost"
            #   NO_PROXY=example.com,::1,localhost,192.168.0.0/16

Unfortunately, they aren't actually respected. If you use the NO_PROXY string from the comment, and connect to http://192.168.0.10, it will still attempt to go through the proxy.

This feels like a bug, and the functionality should be added or the comments fixed. Happy to discuss here, and I'll also throw up a PR that attempts to handle CIDRs as a starting point.

[kaminagakur4]

Confirmed, and the mechanism is a bit worse than "not respected" — the mask isn't ignored, it's parsed as a URL path and dropped, which silently turns the entry into a single-host match.

get_environment_proxies builds the key all://192.168.0.0/16, then URLPattern.__init__ runs URL(pattern) and keeps only scheme/host/port. /16 lands in url.path and is never read, so you fall into the exact-match branch:

>>> from httpx2._utils import URLPattern
>>> from httpx2 import URL
>>> p = URLPattern("all://192.168.0.0/16")
>>> p.host, p.host_regex.pattern
('192.168.0.0', '^192\\.168\\.0\\.0$')
>>> [p.matches(URL(u)) for u in ("http://192.168.0.10", "http://192.168.0.0", "http://192.168.5.5")]
[False, True, False]

So NO_PROXY=192.168.0.0/16 doesn't bypass nothing — it bypasses exactly one address, the network address itself, and proxies the other 65 535. End to end with ALL_PROXY=http://127.0.0.1:8080:

http://192.168.0.10 -> proxied via 127.0.0.1:8080
http://192.168.0.0  -> direct

That's a fail-open shape: traffic you believe is excluded still reaches the proxy.

Three things that follow, in case they're useful for #1165:

1. The current coverage can't fail. test_get_environment_proxies asserts the CIDR case only at the key level ({"no_proxy": "192.168.0.0/16"} -> {"all://192.168.0.0/16": None}), and test_url_matches has no CIDR row at all. The mask has always been tested up to the point where it stops working, which is why this stayed quiet. The parametrized cases @mbeijen asked you for go exactly in that gap.

2. IPv6 is broken the same way, and the docstring got more misleading after it was fixed. Allow IPv6 CIDR notation in no_proxy #967 fixed the crash from no_proxy=fe11::/16 by bracketing only the address, producing all://[fe11::]/16. That key is well-formed, so it looks deliberate — but it degrades identically: host fe11::, regex ^fe11::$, and http://[fe11::abcd] does not match. The comment you quoted describes intent that no code path has ever implemented, for either family.

3. There's an older open PR doing this. Add IPNetPattern for accurate CIDR proxy/mount matching #969 (@mbeijen, 19 May) adds an IPNetPattern backed by ipaddress.ip_network plus a build_url_pattern() factory, keeping URLPattern as an alias — ported from upstream httpx. It's been idle since 13 June. Worth linking the two so whichever lands closes the other; Add IPNetPattern for accurate CIDR proxy/mount matching #969 also claims Not support "no_proxy" including pattern of ipv6 prefix style #829/Error parsing some ipv6 #899.

So: bug, not a docs fix — the comment describes the behaviour people reasonably expect, and silently matching one host out of a /16 is the part that needs to go.