`https` proxies leak credentials when requesting `http`

[0x676e67]

When using an HTTPS proxy with proxy credentials, making requests to HTTP websites can leak the proxy authorization headers.

The replicated code:

#![deny(warnings)]

// This is using the `tokio` runtime. You'll need the following dependency:
//
// `tokio = { version = "1", features = ["full"] }`
#[tokio::main]
async fn main() -> wreq::Result<()> {
    // Make sure you are running tor and this is your socks port
    let proxy = wreq::Proxy::all("https://gngpp:gngpp123@192.168.1.1:1080")
        .expect("tor proxy should be there");
    let client = wreq::Client::builder()
        .proxy(proxy)
        .cert_verification(false)
        .build()
        .expect("should be able to build wreq client");

    let res = client.get("http://httpbin.io/get").send().await?;
    println!("Status: {}", res.status());

    let text = res.text().await?;
    println!("Body:\n{}", text);
    Ok(())
}

Result:

Status: 200 OK
Body:
{
  "args": {},
  "headers": {
    "Accept-Encoding": [
      "zstd,gzip,deflate,br"
    ],
    "Host": [
      "httpbin.io"
    ],
    "Proxy-Authorization": [
      "Basic Z25ncHA6Z25ncHAxMjM="
    ]
  },
  "method": "GET",
  "origin": "142.171.157.68:52788",
  "url": "http://httpbin.io/get"
}

[0x676e67]

We could push this PR upstream in hyper-util to address the issue more cleanly: hyperium/hyper-util#253

Another option is to conditionally insert the header by comparing the proxy URL scheme with the target request URL scheme at this location:

reqwest/src/async_impl/client.rs

Line 2637 in 9a9daa7

fn proxy_auth(&self, dst: &Uri, headers: &mut HeaderMap) {

[0x676e67]

I'm confused. We don't use tunnels.