urllib2 ProxyBasicAuthHandler broken

[jjlee]

BPO	1470846
Nosy	@birkenfeld
Files	proxy_path.patch proxy_path_2.patch

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2006-04-30.07:06:25.000>
created_at = <Date 2006-04-15.14:22:28.000>
labels = ['library']
title = 'urllib2 ProxyBasicAuthHandler broken'
updated_at = <Date 2006-04-30.07:06:25.000>
user = 'https://bugs.python.org/jjlee'

bugs.python.org fields:

activity = <Date 2006-04-30.07:06:25.000>
actor = 'georg.brandl'
assignee = 'none'
closed = True
closed_date = None
closer = None
components = ['Library (Lib)']
creation = <Date 2006-04-15.14:22:28.000>
creator = 'jjlee'
dependencies = []
files = ['7160', '7161']
hgrepos = []
issue_num = 1470846
keywords = ['patch']
message_count = 3.0
messages = ['50014', '50015', '50016']
nosy_count = 2.0
nosy_names = ['georg.brandl', 'jjlee']
pr_nums = []
priority = 'normal'
resolution = 'accepted'
stage = None
status = 'closed'
superseder = None
type = None
url = 'https://bugs.python.org/issue1470846'
versions = []

[jjlee]

urllib2.ProxyBasicAuthHandler has been broken since
revision 38092 back in December 2004 (unlike the
alternative, using a userinfo URL component in the
string passed to ProxyHandler, e.g.
"joe:password@example.com", which works fine ATM).

There are two problems: First, with a proxy, you're
always authenticating yourself for the whole proxy, not
just for a specific path. Second, you're
authenticating yourself to the proxy, not to the HTTP
server. The ProxyBasicAuthHandler subclass dutifully
passes in the right thing for the host argument, but
AbstractBasicAuthHandler ignores it, which means that
it never finds the password -- e.g. if you're trying to
connect to http://python.org/dev through myproxy.com,
it'll be looking for a username/password for
http://python.org/dev instead of the needed myproxy.com.

Since fixing this entails the host argument to
http_error_auth_reqed no longer being ignored,
HTTPBasicAuthHandler must now pass the full URL, which
means AbstractBasicAuthHandler must accept either an
authority or a URL. ProxyBasicAuthHandler could also
supply a full URL like "http://proxy.example.com/", but
the 'host' argument prior to December 2004 was not
ignored, and accepted a hostname (!), so we should keep
that working rather than insisting on a full URL. I
also documented this behaviour.

The patch fixes the bug, adds several new tests, and
updates and fixes mis-named method documentation for
http_error_auth_reqed, and a typo in the examples.

Note one of the tests in the attached patch relies on a
currently non-existent URL at python.org requiring
basic authorization (not *proxy* basic auth in this
test, just basic auth). So I guess the code in the
test_urllib2net.py patch hunk has to be commented out
or something until somebody adds the necessary few
lines of Apache config.

Would also be nice to add a functional test for Proxy
auth itself. I'm sure python.org doesn't want to be
the world's proxy, but something could be configured
that does the basic auth dance then responds with 403.
What would be most suitable: something like
SimpleHTTPServer sitting behind Apache, some mod_python
magic...??

[jjlee]

Logged In: YES
user_id=261020

I should have mentioned in my initial comment that this
patch also fixes bug 900898 (an HTTPPasswordMgr bug that
arises when an authority with a port is passed to
.find_user_password()). The patch includes tests for this
issue, but I've just added a couple more: patch
"proxy_path_2.patch" includes those new tests and supercedes
"proxy_path.patch".

[birkenfeld]

Logged In: YES
user_id=849994

Applied patch as rev. 45815.