[musthaf-bughunter]

Description

HTTP_Client.request() follows a 301/302 by calling itself with the same **headers dict, which already holds the original Host and Path from setdefault() (http.py#L987-L988, #L1054-L1062). The redirected request is sent to the Location host with the old Host/Path and with any Authorization, Proxy_Authorization or Cookie passed by the caller, including on a https -> http redirect.

client = HTTP_Client(verb=False)
client.request("http://127.0.0.1:8000/api", Authorization=b"Bearer s3cret")
# 127.0.0.1:8000 answers: 302 Location: http://localhost:8001/landing
# localhost:8001 receives:
# GET /api HTTP/1.1 ... Authorization: Bearer s3cret ... Host: 127.0.0.1:8000

Host and Path are now recomputed from the Location URL, and the credential headers are dropped when the scheme, host or port changes. The new test covers a cross-origin redirect and a same-origin one.

[codecov]

Codecov Report

❌ Patch coverage is 84.61538% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 80.66%. Comparing base (0e2f6ba) to head (7d4bc5e).

Files with missing lines	Patch %	Lines
scapy/layers/http.py	84.61%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #5298      +/-   ##
==========================================
+ Coverage   80.06%   80.66%   +0.59%     
==========================================
  Files         375      375              
  Lines       98775    98788      +13     
==========================================
+ Hits        79083    79686     +603     
+ Misses      19692    19102     -590     

Files with missing lines	Coverage Δ
scapy/layers/http.py	82.18% <84.61%> (+0.34%)	⬆️

... and 29 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.