Bug report

Bug description:

HTTPConnection._tunnel() checks the set_tunnel() host for spaces and control characters on the str, but then sends its IDNA encoding. The IDNA codec applies NFKC normalization first, which maps U+00A0 NO-BREAK SPACE, U+3000 IDEOGRAPHIC SPACE and similar characters to an ASCII space, so such a host passes the check and the CONNECT request line ends up with a space in its target. The check was added in gh-146211.

from http import client
from test.test_httplib import FakeSocket

conn = client.HTTPConnection('proxy.example')
conn.set_tunnel('internal\xa0x.example')
conn.sock = FakeSocket('HTTP/1.1 200 OK\r\n\r\n')
conn._tunnel()  # Called in .connect()
print(conn.sock.data.splitlines()[0])

This prints b'CONNECT internal x.example:80 HTTP/1.1', while the same host with an ASCII space makes _tunnel() raise ValueError: Tunnel host can't contain control characters. Only a space gets through; CR, LF and NUL are still rejected.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-161104: Check the http.client tunnel host after IDNA encoding #161105