Repository: psf/requests
File: requests/sessions.py (Python)

Code before:
        This method re-evaluates the proxy configuration by considering the
        environment variables. If we are redirected to a URL covered by
        NO_PROXY, we strip the proxy configuration. Otherwise, we set missing
        proxy keys for this URL (in case they were stripped by a previous
        redirect).

        This method also replaces the Proxy-Authorization header where
        necessary.
        """
        headers = prepared_request.headers
        url = prepared_request.url
        new_proxies = {}

        if not should_bypass_proxies(url):
            environ_proxies = get_environ_proxies(url)
            scheme = urlparse(url).scheme

            try:
                new_proxies.setdefault(scheme, environ_proxies[scheme])
            except KeyError:
                pass

        if 'Proxy-Authorization' in headers:
            del headers['Proxy-Authorization']

        try:
            username, password = get_auth_from_url(new_proxies[scheme])
            if username and password:
                headers['Proxy-Authorization'] = _basic_auth_str(
                    username, password
                )
        except KeyError:
            pass

        return new_proxies


class Session(SessionRedirectMixin):
    """A Requests session.

    Provides cookie persistence, connection-pooling, and configuration.

    Basic Usage::

      >>> import requests
      >>> s = requests.Session()
      >>> s.get('http://httpbin.org/get')
      200
    """

    __attrs__ = [

Review comment (security):
How about this:

```
try:
    username, password = get_auth_from_url(new_proxies[scheme])
except KeyError:
    username = password = None

if username and password:
    headers['Proxy-Authorization'] = _basic_auth_str(username, password)
```

In general, I cringe when I see code inside the `try` block that will not raise the exception being caught. Further this will allow you to keep your `KeyError` (=P) and use the except block in a meaningful way. It also is a bit nicer than the original suggestion I had.


Code after:
        This method re-evaluates the proxy configuration by considering the
        environment variables. If we are redirected to a URL covered by
        NO_PROXY, we strip the proxy configuration. Otherwise, we set missing
        proxy keys for this URL (in case they were stripped by a previous
        redirect).

        This method also replaces the Proxy-Authorization header where
        necessary.
        """
        headers = prepared_request.headers
        url = prepared_request.url
        new_proxies = {}

        if not should_bypass_proxies(url):
            environ_proxies = get_environ_proxies(url)
            scheme = urlparse(url).scheme

            proxy = environ_proxies.get(scheme)

            if proxy:
                new_proxies.setdefault(scheme, environ_proxies[scheme])

        if 'Proxy-Authorization' in headers:
            del headers['Proxy-Authorization']

        try:
            username, password = get_auth_from_url(new_proxies[scheme])
        except KeyError:
            username, password = None, None

        if username and password:
            headers['Proxy-Authorization'] = _basic_auth_str(username, password)

        return new_proxies


class Session(SessionRedirectMixin):
    """A Requests session.

    Provides cookie persistence, connection-pooling, and configuration.

    Basic Usage::

      >>> import requests
      >>> s = requests.Session()
      >>> s.get('http://httpbin.org/get')
      200
    """

    __attrs__ = [
        'headers', 'cookies', 'auth', 'timeout', 'proxies', 'hooks',