One function
_normalize_socks_string_url in CloakHQ/CloakBrowser
The author described this change as “fix(proxy): log when SOCKS5 credential auto-encoding rewrites URL (#157) (#209)”. It counts as a record because the check below fails on the code as it stood at 13b1b98b6 and passes on c07c2b6b4, with nothing else changed between the two runs.
ProjectCloakHQ/CloakBrowser
Fix saved2026-05-10
Sharing licenceMIT · LICENSE
Change size+19 −3
What the code was meant to do, written into the code itself as a docstring
Re-encode credentials in a SOCKS5 URL string so Chromium's parser doesn't truncate them at special chars like '='. Idempotent: pre-encoded input stays the same (decoded then re-encoded). On unparseable input (invalid port, broken IPv6 literal, etc.) logs a warning and returns the original string — preserves pre-fix pass-through behavior so Chromium's own error handling kicks in.
The change
| 3 | 3 | truncate them at special chars like '='. Idempotent: pre-encoded input stays | |
| 4 | 4 | the same (decoded then re-encoded). | |
| 5 | 5 | ||
| 6 | + | Emits an INFO log when re-encoding actually changes the URL, so users who | |
| 7 | + | previously hit silent SOCKS5 fallback (#157) can see what the wrapper did. | |
| 8 | + | Silent on already-encoded inputs (no false-positive noise). | |
| 9 | + | ||
| 6 | 10 | On unparseable input (invalid port, broken IPv6 literal, etc.) logs a | |
| 7 | 11 | warning and returns the original string — preserves pre-fix pass-through | |
| 8 | 12 | behavior so Chromium's own error handling kicks in. | |
| ⋯ | |||
| 18 | 22 | # urlparse returns None for absent components, "" for present-but-empty. | |
| 19 | 23 | if parsed.username is None and parsed.password is None: | |
| 20 | 24 | return url | |
| 21 | - | enc_user = quote(unquote(parsed.username), safe="") if parsed.username else "" | |
| 25 | + | raw_user = parsed.username or "" | |
| 26 | + | enc_user = quote(unquote(raw_user), safe="") if raw_user else "" | |
| 22 | 27 | # Preserve the colon separator when password component is present, even if | |
| 23 | 28 | # empty, so `user:@host` stays `user:@host`. | |
| 24 | 29 | if parsed.password is not None: | |
| 25 | - | enc_pass = quote(unquote(parsed.password), safe="") if parsed.password else "" | |
| 30 | + | raw_pass = parsed.password | |
| 31 | + | enc_pass = quote(unquote(raw_pass), safe="") if raw_pass else "" | |
| 26 | 32 | else: | |
| 33 | + | raw_pass = None | |
| 27 | 34 | enc_pass = None | |
| 28 | - | return _assemble_socks_url( | |
| 35 | + | normalized = _assemble_socks_url( | |
| 29 | 36 | parsed.scheme, parsed.hostname or "", parsed.port, | |
| 30 | 37 | enc_user, enc_pass, | |
| 31 | 38 | parsed.path, parsed.params, parsed.query, parsed.fragment, | |
| 32 | 39 | ) | |
| 40 | + | # Compare credentials, not the full URL: urlparse cosmetically lowercases | |
| 41 | + | # scheme and hostname, so a full-string compare would falsely fire on | |
| 42 | + | # `socks5://USER:pass@HOST.com:1080` even when no encoding work happened. | |
| 43 | + | if enc_user != raw_user or enc_pass != raw_pass: | |
| 44 | + | logger.info( | |
| 45 | + | "Auto URL-encoded SOCKS5 proxy credentials (special characters " | |
| 46 | + | "detected). Pre-encode the URL to suppress this notice." | |
| 47 | + | ) | |
| 48 | + | return normalized | |
The check that tells the two apart
fail→pass·tests/test_proxy.py::TestResolveProxyConfig::test_socks5_string_logs_info_when_reencoding
Check file tests/test_proxy.py, taken without changes from the fix and copied onto the older code, so the exact same check runs against both versions.
Origin and history
The code before it13b1b98b6840b68316e43fd46f43ffa7f50fd967
Broken version dated2026-05-07
Modulecloakbrowser.browser
Units changed_normalize_socks_string_url
Fingerprint6831e7d6e3e301f1
Checked2026-08-17 by goldset/0.1
Every field above is generated by our program. None of it is written by hand.
Other bugs found in CloakHQ/CloakBrowser
- 2026-07-27_extract_proxy_url