From 3a0aa81b23fdd35af028cea09c2e8985c4af87a5 Mon Sep 17 00:00:00 2001 From: icanhasmath Date: Wed, 28 Oct 2026 12:42:22 -0500 Subject: [PATCH] test: drop the forwarding case from test_proxy_https_target_tls_error test_proxy_https_target_tls_error[https-True] expected an SSLError when forwarding an HTTPS request through an HTTPS proxy with a target ssl_context that trusts nothing. When forwarding, the client never makes a TLS connection to the target, so that error only happened because the target's TLS settings were applied to the proxy connection: CVE-2026-97687, fixed in 1.26.20.post3. Since then the case fails ("DID NOT RAISE") on Python 3.9 and 3.10. Upstream skipped this case as urllib3/urllib3#2577 (2.7.0) and removed it together with the CVE-2026-97687 fix in 2.8.0. Remove it here too. Co-Authored-By: Claude Opus 5.5 --- test/with_dummyserver/test_proxy_poolmanager.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/test/with_dummyserver/test_proxy_poolmanager.py b/test/with_dummyserver/test_proxy_poolmanager.py index 390a971be0..58b23c690c 100644 --- a/test/with_dummyserver/test_proxy_poolmanager.py +++ b/test/with_dummyserver/test_proxy_poolmanager.py @@ -738,9 +738,15 @@ def test_https_proxy_tls_error(self, target_scheme, use_forwarding_for_https): @pytest.mark.parametrize( ["proxy_scheme", "use_forwarding_for_https"], [ + # No ("https", True) case: when forwarding, the client never makes + # a TLS connection to the target, so the target's ssl_context + # cannot cause a TLS error. The error this case expected came + # from applying the target's TLS settings to the proxy + # connection, which is CVE-2026-97687 (fixed in 1.26.20.post3). + # Upstream skipped this case as urllib3/urllib3#2577 and removed + # it with the fix in 2.8.0. ("http", False), ("https", False), - ("https", True), ], ) def test_proxy_https_target_tls_error(self, proxy_scheme, use_forwarding_for_https):