Standardize Windows proxy bypass (ProxyOverride) parsing to support wildcards and CIDR

[Bais-Huang]

Bug report

Bug description:

Summary:

Currently, urllib.request.getproxies_registry on Windows does not fully support the patterns defined in the Windows Registry key ProxyOverride. While modern browsers (Chrome/Edge) and Windows system components interpret wildcard patterns (e.g., 10.0.*) and CIDR notations, Python's urllib fails to match these when they are imported into the no_proxy list. This leads to inconsistent behavior where a script goes through a proxy even if the system settings explicitly dictate a bypass for that network.

The Problem:

1. Wildcard IPs: Windows users often use 10.0.0.* to bypass a subnet. Python currently imports this string as-is, but the internal proxy_bypass logic treats it as a literal string or a domain suffix, failing to match an IP like 10.0.0.1.

2. Missing support: The token in the registry (intended to bypass all local/intranet addresses) is often ignored or incorrectly handled when converted to the Python proxies dictionary.

Minimal Reproducible Example:

1. Set Windows Proxy "Exceptions" to include 10.0.0.*.

2. Run the following code:

import urllib.request

# Simulate registry lookup (current behavior)
# In reality, this is called internally by urllib.request.getproxies()
proxies = urllib.request.getproxies()
print(f"Detected NO_PROXY: {proxies.get('no')}")

# Attempt to bypass 10.0.0.1
url = "http://10.0.0.1"
should_bypass = urllib.request.proxy_bypass("10.0.0.1")
print(f"Should bypass {url}? {should_bypass}")

Expected: True (to match browser behavior)
Actual: False

Proposed Solution:

Enhance getproxies_registry in Lib/urllib/request.py to pre-process ProxyOverride items:

• Convert * wildcard IP patterns (e.g., 10.*) into CIDR or standardized prefix strings.

• Expand into localhost, 127.0.0.1, [::1].

CPython versions tested on:

CPython main branch

Operating systems tested on:

Windows

[picnixz]

AFAIK there is no RFC about what NO_PROXY should really look like. IIRC, we only support literal matching and not patterns. As such, I would consider it a feature. If however a pattern is accepted when directly setting the NO_PROXY env (apart from the general wildcars '*'), I would be willing to consider it a bug.

[Bais-Huang]

AFAIK there is no RFC about what NO_PROXY should really look like. IIRC, we only support literal matching and not patterns. As such, I would consider it a feature. If however a pattern is accepted when directly setting the NO_PROXY env (apart from the general wildcars '*'), I would be willing to consider it a bug.

Thank you very much for your response, and I apologize for not describing the issue clearly.

On Windows, when using getproxies, the implementation reads the ProxyServer entry from the registry, but does not properly incorporate the ProxyOverride entry. As a result, the returned proxies dictionary may miss the no (no_proxy) configuration.

Additionally, when proxy_bypass is used, entries from ProxyOverride are typically defined using pattern-based rules. However, the current implementation in proxy_bypass_registry performs literal matching only, which can cause requests that are expected to bypass the proxy to incorrectly go through it.

This is the issue I was trying to describe.