René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"NO_PROXY domain suffix can be used to evade proxy by a non-subdomain","articleBody":"Doc says: https://nodejs.org/api/http.html#no-proxy-format\n\n\u003e `.example.com - Domain suffix match (matches sub.example.com)`\n\nBut `.example.com` also matches `totally-not-example.com`.\n\nAlso (more trivially verifiable), `.ample.com` matches `example.com`:\n\n```console\n% cat deepview-broken-proxy.js\nrequire('node:https').request('https://example.com', (res) =\u003e {\n  console.log('status:', res.statusCode)\n  process.exit(0)\n}).end()\n% HTTPS_PROXY='http://10.0.0.0:1' node --use-env-proxy deepview-broken-proxy.js \nnode:events:487\n      throw er; // Unhandled 'error' event\n      ^\n\nError [ERR_PROXY_TUNNEL]: Connection to establish proxy tunnel timed out after 5000ms\n...\n% HTTPS_PROXY='http://10.0.0.0:1' NO_PROXY='.ample.com' node --use-env-proxy deepview-broken-proxy.js\nstatus: 200\n```\n\nhttps://github.com/nodejs/node/blob/HEAD/lib/internal/http.js#L161\n\n\u003cdetails\u003e\n\n\u003e In `ProxyConfig#shouldUseProxy` (the transitive helper that `checkShouldUseProxy` always delegates to), the `.suffix` bypass-list rule uses `host.endsWith(suffix)` after stripping the leading dot. This matches across domain-label boundaries: a `NO_PROXY=.example.com` rule causes `checkShouldUseProxy(..., { host: 'evilexample.com' })` to return `false` (bypass proxy) because `'evilexample.com'.endsWith('example.com')` is `true`. An attacker who can choose/influence the target hostname can therefore route traffic around a proxy that was meant to intercept all `*.example.com` traffic. The check should require the character immediately preceding the suffix to be `.` (or the host to equal the suffix exactly), e.g. `host === suffix || host.endsWith('.' + suffix)` — or reuse the same form as the `*.example.com` branch (which is already safe because its effective suffix retains the leading dot).\n\n\u003c/details\u003e","author":{"url":"https://github.com/ChALkeR","@type":"Person","name":"ChALkeR"},"datePublished":"2026-04-23T06:57:12.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":2},"url":"https://github.com/62907/node/issues/62907"}