From 78ef9a50e8fb3f8db78c600d6c6549c4c4d0b4c7 Mon Sep 17 00:00:00 2001
From: Rene Pfeuffer <rene.pfeuffer@cloudogu.com>
Date: Tue, 10 Feb 2026 14:34:47 +0000
Subject: [PATCH] Fix proxy exclusions with glob patterns

---
 gradle/changelog/proxy_exclusions.yaml        |  2 +
 .../scm/net/HttpURLConnectionFactory.java     | 10 ++--
 .../src/main/java/sonia/scm/net/Proxies.java  | 52 ++++++++-----------
 .../scm/net/HttpURLConnectionFactoryTest.java | 12 +++++
 4 files changed, 39 insertions(+), 37 deletions(-)
 create mode 100644 gradle/changelog/proxy_exclusions.yaml

diff --git a/gradle/changelog/proxy_exclusions.yaml b/gradle/changelog/proxy_exclusions.yaml
new file mode 100644
index 0000000000..890c97ade7
--- /dev/null
+++ b/gradle/changelog/proxy_exclusions.yaml
@@ -0,0 +1,2 @@
+- type: fixed
+  description: Proxy exclusions with glob patterns
diff --git a/scm-core/src/main/java/sonia/scm/net/HttpURLConnectionFactory.java b/scm-core/src/main/java/sonia/scm/net/HttpURLConnectionFactory.java
index 4fd4fd5838..bc51d9a91f 100644
--- a/scm-core/src/main/java/sonia/scm/net/HttpURLConnectionFactory.java
+++ b/scm-core/src/main/java/sonia/scm/net/HttpURLConnectionFactory.java
@@ -124,15 +124,11 @@ public final class HttpURLConnectionFactory {
     private boolean isProxyEnabled(ProxyConfiguration proxyConfiguration, URL url) {
       return !options.isIgnoreProxySettings()
         && proxyConfiguration.isEnabled()
-        && !isHostExcluded(proxyConfiguration, url);
+        && isHostIncluded(proxyConfiguration, url);
     }
 
-    private boolean isHostExcluded(ProxyConfiguration proxyConfiguration, URL url) {
-      Collection<String> excludes = proxyConfiguration.getExcludes();
-      if (excludes == null) {
-        return false;
-      }
-      return excludes.contains(url.getHost());
+    private boolean isHostIncluded(ProxyConfiguration proxyConfiguration, URL url) {
+      return Proxies.isEnabledForHost(proxyConfiguration.getExcludes(), url.getHost());
     }
 
     private HttpURLConnection openProxyConnection(ProxyConfiguration configuration, URL url) throws IOException {
diff --git a/scm-core/src/main/java/sonia/scm/net/Proxies.java b/scm-core/src/main/java/sonia/scm/net/Proxies.java
index c6f4c5eb59..ab86794d35 100644
--- a/scm-core/src/main/java/sonia/scm/net/Proxies.java
+++ b/scm-core/src/main/java/sonia/scm/net/Proxies.java
@@ -24,6 +24,8 @@ import sonia.scm.config.ScmConfiguration;
 import sonia.scm.util.GlobUtil;
 
 import java.net.URL;
+import java.util.Collection;
+import java.util.Set;
 
 /**
  * Util class for proxy settings.
@@ -48,54 +50,44 @@ public final class Proxies
    *
    * @return true if proxy settings should be used
    */
-  public static boolean isEnabled(ScmConfiguration configuration, String url)
-  {
-    boolean result = false;
-
-    if (configuration.isEnableProxy())
-    {
-      result = true;
-
+  public static boolean isEnabled(ScmConfiguration configuration, String url) {
+    if (configuration.isEnableProxy()) {
       int index = url.indexOf("://");
 
-      if (index > 0)
-      {
+      if (index > 0) {
         url = url.substring(index + 3);
       }
 
       index = url.indexOf('/');
 
-      if (index > 0)
-      {
+      if (index > 0) {
         url = url.substring(0, index);
       }
 
       index = url.indexOf(':');
 
-      if (index > 0)
-      {
+      if (index > 0) {
         url = url.substring(0, index);
       }
 
-      for (String exclude : configuration.getProxyExcludes())
-      {
-        if (GlobUtil.matches(exclude, url))
-        {
-          logger.debug(
-            "disable proxy settings for url {}, because exclude {} matches",
-            url, exclude);
-          result = false;
-
-          break;
-        }
-      }
-    }
-    else
-    {
+      Set<String> proxyExcludes = configuration.getProxyExcludes();
+      return isEnabledForHost(proxyExcludes, url);
+    } else {
       logger.trace("proxy settings are disabled");
     }
 
-    return result;
+    return false;
+  }
+
+  public static boolean isEnabledForHost(Collection<String> proxyExcludes, String host) {
+    for (String exclude : proxyExcludes) {
+      if (GlobUtil.matches(exclude, host)) {
+        logger.debug(
+          "disable proxy settings for host {}, because exclude {} matches", host, exclude);
+        return false;
+      }
+    }
+    return true;
   }
 
   /**
diff --git a/scm-core/src/test/java/sonia/scm/net/HttpURLConnectionFactoryTest.java b/scm-core/src/test/java/sonia/scm/net/HttpURLConnectionFactoryTest.java
index 1c5db5b809..413faa1a4b 100644
--- a/scm-core/src/test/java/sonia/scm/net/HttpURLConnectionFactoryTest.java
+++ b/scm-core/src/test/java/sonia/scm/net/HttpURLConnectionFactoryTest.java
@@ -210,6 +210,18 @@ class HttpURLConnectionFactoryTest {
       assertThat(usedProxy).isNull();
     }
 
+    @Test
+    void shouldNotCreateProxyConnectionIfHostIsOnTheExcludeListWithGlobPattern() throws IOException {
+      configuration.setEnableProxy(true);
+      configuration.setProxyServer("proxy.hitchhiker.com");
+      configuration.setProxyPort(3128);
+      configuration.setProxyExcludes(ImmutableSet.of("localhost", "*.hitchhiker.org", "127.0.0.1"));
+
+      connectionFactory.create(new URL("https://scm.hitchhiker.org"));
+
+      assertThat(usedProxy).isNull();
+    }
+
     @Test
     void shouldNotCreateProxyConnectionWithIgnoreOption() throws IOException {
       configuration.setEnableProxy(true);