Summary
URI::Generic.use_proxy? silently ignores IPv6 literal addresses in no_proxy / NO_PROXY, causing IPv6 targets to always be proxied even when they should be excluded.
Root cause
The parsing regex in use_proxy? splits no_proxy entries on colons to extract an optional port:
no_proxy.scan(/([^:,\s]+)(?::(\d+))?/) {|p_host, p_port|
IPv6 addresses contain colons as part of their syntax (e.g. 2001:db8::1), so this regex mangles them; the address is split into fragments rather than parsed as a host. As a result:
- Bare entries like
2001:db8::1 are never correctly captured into p_host
- Bracketed entries like
[2001:db8::1] are captured literally (with brackets) and never reach the IPAddr.new(p_host).include?(addr) check since IPAddr.new("[2001:db8::1]") raises InvalidAddressError
- Bracketed entries with port like
[2001:db8::1]:8080 are similarly broken
Reproduction
require 'uri'
require 'resolv'
# IPv6 target that should bypass the proxy
no_proxy = "2001:db8::1"
hostname = "2001:db8::1"
addr = Resolv.getaddress(hostname) rescue hostname
port = 80
puts URI::Generic.use_proxy?(hostname, addr, port, no_proxy)
# Expected: false (should bypass proxy)
# Actual: true (incorrectly routes through proxy)
Expected behavior
All three real-world no_proxy formats for IPv6 should be recognized:
| Format |
Example |
| Bare address |
2001:db8::1 |
| Bracketed (RFC 2732 / RFC 3986) |
[2001:db8::1] |
| Bracketed with port |
[2001:db8::1]:8080 |
| CIDR |
2001:db8::/32 |
Summary
URI::Generic.use_proxy?silently ignores IPv6 literal addresses inno_proxy/NO_PROXY, causing IPv6 targets to always be proxied even when they should be excluded.Root cause
The parsing regex in
use_proxy?splitsno_proxyentries on colons to extract an optional port:IPv6 addresses contain colons as part of their syntax (e.g.
2001:db8::1), so this regex mangles them; the address is split into fragments rather than parsed as a host. As a result:2001:db8::1are never correctly captured intop_host[2001:db8::1]are captured literally (with brackets) and never reach theIPAddr.new(p_host).include?(addr)check sinceIPAddr.new("[2001:db8::1]")raisesInvalidAddressError[2001:db8::1]:8080are similarly brokenReproduction
Expected behavior
All three real-world
no_proxyformats for IPv6 should be recognized:2001:db8::1[2001:db8::1][2001:db8::1]:80802001:db8::/32