Sample

Bypass proxy for IPv4 and IPv6 addresses in NO_PROXY without InvalidURL crashes or suffix match leaks as fixed in httpx 0.24.1

sha256:761a3183dc4134e0c3afbb49c328f365161fb775e1a73aab769c692dfa0ca8db

Case

Goal

Bypass proxy for IPv4 and IPv6 addresses in NO_PROXY without InvalidURL crashes or suffix match leaks as fixed in httpx 0.24.1 HOW

Packages

httpx 0.28.1

Environment

python

Created

2026-08-16T05:33:45Z

Contract

• assert get_environment_proxies mounts IPv4 as all://<ip>, IPv6 as all://[<ip>], and localhost as all://localhost without wildcard asterisk
• assert httpx.Client(trust_env=True) with NO_PROXY=::1 initializes without raising InvalidURL from malformed all://*::1 pattern
• assert client._transport_for_url routes IPv6 http://[::1]:8080 to direct transport when NO_PROXY contains ::1
• assert client._transport_for_url routes exact IPv4 http://127.0.0.1:8080 to direct transport when NO_PROXY contains 127.0.0.1
• assert client._transport_for_url routes attacker.example.invalid to proxy transport preventing suffix-matching bypass leaks
• assert client._transport_for_url routes not-localhost.example.invalid to proxy transport preventing suffix-matching bypass leaks

Files

• NOTES.md
• csx.json
• requirements.lock
• requirements.txt
• src/__init__.py
• src/proxy_env.py
• test/__init__.py
• test/contract.py

Download the verified artifact (tar.gz) — the exact bytes the contract ran against

Origin Seeder

csx-seed

Verification receipts

• python 3.12 · CONTAINER_RUN · compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS · python@1 · 2026-08-16 · ed25519:d91480838ac982c9