From 11eb3fd376d651c290fd8d5a4bd402c2fe6319da Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 7 Sep 2026 17:03:33 +0000
Subject: [PATCH] build(deps): bump github.com/elazarl/goproxy from 1.9.0 to
 1.9.1

Bumps [github.com/elazarl/goproxy](https://github.com/elazarl/goproxy) from 1.9.0 to 1.9.1.
- [Release notes](https://github.com/elazarl/goproxy/releases)
- [Commits](https://github.com/elazarl/goproxy/compare/v1.9.0...v1.9.1)

---
updated-dependencies:
- dependency-name: github.com/elazarl/goproxy
  dependency-version: 1.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod                                        |  2 +-
 go.sum                                        |  4 +--
 vendor/github.com/elazarl/goproxy/https.go    | 31 ++++++++++++++++---
 .../github.com/elazarl/goproxy/responses.go   | 22 +++++++++++++
 vendor/modules.txt                            |  2 +-
 5 files changed, 53 insertions(+), 8 deletions(-)

diff --git a/go.mod b/go.mod
index 47bb92e1a8..41ea992c95 100644
--- a/go.mod
+++ b/go.mod
@@ -20,7 +20,7 @@ require (
 	github.com/cucumber/godog v0.16.0
 	github.com/cucumber/messages-go/v10 v10.0.3
 	github.com/docker/go-units v0.5.0
-	github.com/elazarl/goproxy v1.9.0
+	github.com/elazarl/goproxy v1.9.1
 	github.com/gorilla/handlers v1.5.2
 	github.com/h2non/filetype v1.1.3
 	github.com/hectane/go-acl v1.0.0
diff --git a/go.sum b/go.sum
index dc496966a5..d70862147b 100644
--- a/go.sum
+++ b/go.sum
@@ -94,8 +94,8 @@ github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/ebitengine/purego v0.10.2 h1:W809HbnvzAxgdm+aOvlSekrM16wGCdT/e76+9tS7gzE=
 github.com/ebitengine/purego v0.10.2/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
-github.com/elazarl/goproxy v1.9.0 h1:2j3c13lD5v0QTjxphJSSIHS7w8/m/pzSHtLMPOpznC0=
-github.com/elazarl/goproxy v1.9.0/go.mod h1:THdE5ix2clxX9lZzcICPpZ67d6CdrPZxdOYsNgU5e30=
+github.com/elazarl/goproxy v1.9.1 h1:1gQuANpCxN2UQKWwkNPpWqAk1LnAMYuBxqfIdU8mMoE=
+github.com/elazarl/goproxy v1.9.1/go.mod h1:THdE5ix2clxX9lZzcICPpZ67d6CdrPZxdOYsNgU5e30=
 github.com/emicklei/go-restful/v3 v3.12.2 h1:DhwDP0vY3k8ZzE0RunuJy8GhNpPL6zqLkDf9B/a0/xU=
 github.com/emicklei/go-restful/v3 v3.12.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
diff --git a/vendor/github.com/elazarl/goproxy/https.go b/vendor/github.com/elazarl/goproxy/https.go
index 4f88051ba6..5d8e5d839c 100644
--- a/vendor/github.com/elazarl/goproxy/https.go
+++ b/vendor/github.com/elazarl/goproxy/https.go
@@ -185,6 +185,19 @@ type halfClosable interface {
 
 var _ halfClosable = (*net.TCPConn)(nil)
 
+// connectResponseLine builds a CONNECT tunnel status line that echoes the
+// requesting client's HTTP version. These replies were previously hardcoded as
+// HTTP/1.0, so an HTTP/1.1 CONNECT received an HTTP/1.0 status line on an
+// otherwise HTTP/1.1 connection (issue #802). Falls back to HTTP/1.1 when the
+// request version is unset.
+func connectResponseLine(r *http.Request, code int, text string) string {
+	major, minor := r.ProtoMajor, r.ProtoMinor
+	if major == 0 {
+		major, minor = 1, 1
+	}
+	return fmt.Sprintf("HTTP/%d.%d %d %s\r\n\r\n", major, minor, code, text)
+}
+
 func (proxy *ProxyHttpServer) handleHttps(w http.ResponseWriter, r *http.Request) {
 	ctx := &ProxyCtx{Req: r, Session: atomic.AddInt64(&proxy.sess, 1), Proxy: proxy, certStore: proxy.CertStore}
 
@@ -325,7 +338,7 @@ func (proxy *ProxyHttpServer) handleHttps(w http.ResponseWriter, r *http.Request
 			}()
 			wg.Wait()
 		} else {
-			_, _ = proxyClient.Write([]byte("HTTP/1.0 200 Connection established\r\n\r\n"))
+			_, _ = proxyClient.Write([]byte(connectResponseLine(r, http.StatusOK, "Connection established")))
 
 			targetTCP, targetOK := targetSiteCon.(halfClosable)
 			proxyClientTCP, clientOK := proxyClient.(halfClosable)
@@ -384,7 +397,7 @@ func (proxy *ProxyHttpServer) handleHttps(w http.ResponseWriter, r *http.Request
 				f.Flush()
 			}
 		} else {
-			_, _ = proxyClient.Write([]byte("HTTP/1.0 200 OK\r\n\r\n"))
+			_, _ = proxyClient.Write([]byte(connectResponseLine(r, http.StatusOK, "OK")))
 		}
 		ctx.Logf("Received CONNECT request, mitm proxying it")
 		// For HTTP/1.x (after Hijack), the MITM loop runs in a goroutine so the HTTP/1.x
@@ -474,7 +487,17 @@ func (proxy *ProxyHttpServer) handleHttps(w http.ResponseWriter, r *http.Request
 
 				if !req.URL.IsAbs() {
 					// Origin-form request target (/path)
-					req.URL, err = url.Parse(scheme + "://" + r.Host + req.URL.String())
+					// We prioritize req.Host (from the internal request), over r.Host (from the CONNECT request).
+					hostToUse := req.Host
+					if hostToUse == "" {
+						hostToUse = r.Host // Fallback, if the internal Host header is missing
+					}
+
+					req.URL, err = url.Parse(scheme + "://" + hostToUse + req.URL.String())
+					if err != nil {
+						ctx.Warnf("Cannot parse URL %s: %v", scheme+"://"+hostToUse+req.URL.String(), err)
+						return
+					}
 				} else {
 					// Absolute-form request target
 					req.URL.Scheme = scheme
@@ -520,7 +543,7 @@ func (proxy *ProxyHttpServer) handleHttps(w http.ResponseWriter, r *http.Request
 					resp = proxy.filterResponse(resp, ctx)
 					bodyModified := resp.Body != origBody
 					defer resp.Body.Close()
-					if resp.Body != http.NoBody && (bodyModified ||
+					if responseBodyAllowed(ctx.Req, resp) && resp.Body != http.NoBody && (bodyModified ||
 						(resp.ContentLength <= 0 && resp.Header.Get("Content-Length") == "")) {
 						// Return chunked encoded response when we don't know the length of the resp, if the body
 						// has been modified by the response handler or if there is no content length in the response.
diff --git a/vendor/github.com/elazarl/goproxy/responses.go b/vendor/github.com/elazarl/goproxy/responses.go
index 734414caed..f86e517078 100644
--- a/vendor/github.com/elazarl/goproxy/responses.go
+++ b/vendor/github.com/elazarl/goproxy/responses.go
@@ -42,3 +42,25 @@ const (
 func TextResponse(r *http.Request, text string) *http.Response {
 	return NewResponse(r, ContentTypeText, http.StatusAccepted, text)
 }
+
+// responseBodyAllowed reports whether a response may carry a message body.
+// RFC 9112 6.3: a response to HEAD, or with a 1xx, 204, or 304 status, ends at
+// the first empty line "regardless of the header fields present", so framing one
+// leaves those bytes to be misread as the next response.
+//
+// Keyed on status and method, not on the body value: an empty HTTP/1 body is
+// http.NoBody, but the HTTP/2 transport uses its own unexported value, so a
+// bodiless HTTP/2 response is not http.NoBody.
+func responseBodyAllowed(req *http.Request, resp *http.Response) bool {
+	if req != nil && req.Method == http.MethodHead {
+		return false
+	}
+	switch {
+	case resp.StatusCode >= 100 && resp.StatusCode <= 199:
+		return false
+	case resp.StatusCode == http.StatusNoContent, resp.StatusCode == http.StatusNotModified:
+		return false
+	default:
+		return true
+	}
+}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index ad86ceaa06..ad7374d91d 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -210,7 +210,7 @@ github.com/ebitengine/purego/internal/cgo
 github.com/ebitengine/purego/internal/fakecgo
 github.com/ebitengine/purego/internal/strings
 github.com/ebitengine/purego/internal/xreflect
-# github.com/elazarl/goproxy v1.9.0
+# github.com/elazarl/goproxy v1.9.1
 ## explicit; go 1.24.0
 github.com/elazarl/goproxy
 github.com/elazarl/goproxy/internal/http1parser