@@ -2497,28 +2497,34 @@ def getproxies_environment():
2497
2497
this seems to be the standard convention. If you need a
2498
2498
different way, you can pass a proxies dictionary to the
2499
2499
[Fancy]URLopener constructor.
2500
-
2501
2500
"""
2502
- proxies = {}
2503
2501
# in order to prefer lowercase variables, process environment in
2504
2502
# two passes: first matches any, second pass matches lowercase only
2505
- for name , value in os .environ .items ():
2506
- name = name .lower ()
2507
- if value and name [- 6 :] == '_proxy' :
2508
- proxies [name [:- 6 ]] = value
2503
+
2504
+ # select only environment variables which end in (after making lowercase) _proxy
2505
+ proxies = {}
2506
+ environment = []
2507
+ for name in os .environ .keys ():
2508
+ # fast screen underscore position before more expensive case-folding
2509
+ if len (name ) > 5 and name [- 6 ] == "_" and name [- 5 :].lower () == "proxy" :
2510
+ value = os .environ [name ]
2511
+ proxy_name = name [:- 6 ].lower ()
2512
+ environment .append ((name , value , proxy_name ))
2513
+ if value :
2514
+ proxies [proxy_name ] = value
2509
2515
# CVE-2016-1000110 - If we are running as CGI script, forget HTTP_PROXY
2510
2516
# (non-all-lowercase) as it may be set from the web server by a "Proxy:"
2511
2517
# header from the client
2512
2518
# If "proxy" is lowercase, it will still be used thanks to the next block
2513
2519
if 'REQUEST_METHOD' in os .environ :
2514
2520
proxies .pop ('http' , None )
2515
- for name , value in os .environ .items ():
2521
+ for name , value , proxy_name in environment :
2522
+ # not case-folded, checking here for lower-case env vars only
2516
2523
if name [- 6 :] == '_proxy' :
2517
- name = name .lower ()
2518
2524
if value :
2519
- proxies [name [: - 6 ] ] = value
2525
+ proxies [proxy_name ] = value
2520
2526
else :
2521
- proxies .pop (name [: - 6 ] , None )
2527
+ proxies .pop (proxy_name , None )
2522
2528
return proxies
2523
2529
2524
2530
def proxy_bypass_environment (host , proxies = None ):
0 commit comments