bug#54921: eww/url mishandles IDN over proxy

[Andreas Schwab]

On Apr 14 2022, Lars Ingebrigtsen wrote:

> So it is.  Then I have no idea where the Host in the http case is coming
> from.  I'd have thought that the proxy would just look at the Host
> header (which should be puny-encoded), but I don't know much about http
> proxying.

The proxy just receives the full URL in the GET request.  Something like
this, but puny-encode-domain must only be called with the domain name.

diff --git a/lisp/url/url-http.el b/lisp/url/url-http.el
index daeba17031..c59613da62 100644
--- a/lisp/url/url-http.el
+++ b/lisp/url/url-http.el
@@ -332,7 +332,8 @@ url-http-create-request
               (if (and using-proxy
                        ;; Bug#35969.
                        (not (equal "https" (url-type url-http-target-url))))
-                  (url-recreate-url url-http-target-url) real-fname))
+                  (puny-encode-domain (url-recreate-url url-http-target-url))
+                real-fname))
              " HTTP/" url-http-version "\r\n"
              ;; Version of MIME we speak
              "MIME-Version: 1.0\r\n"

-- 
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 7578 EB47 D4E5 4D69 2510  2552 DF73 E780 A9DA AEC1
"And now for something completely different."