fix: Remove filter expression lowercasing in block_list addon (#7456)

* fix: Remove filter expression lowercasing in block_list addon

* chore: CHANGELOG update

* test: Add new test cases to verify URL case-sensitivity

* test: Add new test cases to cover case-sensitive filter expressions

* chore: Update test func name

* fix nits

---------

Co-authored-by: Maximilian Hils <github@maximilianhils.com>

CHANGELOG.md

@@ -17,6 +17,8 @@
   ([#7385](https://github.com/mitmproxy/mitmproxy/pull/7385), @lups2000)
 - Add missing status codes
   ([#7455])(https://github.com/mitmproxy/mitmproxy/pull/7455, @jwadolowski)
+- Remove filter expression lowercasing in block_list addon
+  ([#7456](https://github.com/mitmproxy/mitmproxy/pull/7456), @jwadolowski)
 
 ## 05 December 2024: mitmproxy 11.0.2
 

mitmproxy/addons/blocklist.py

@@ -24,7 +24,7 @@ def parse_spec(option: str) -> BlockSpec:
     """
     sep, rem = option[0], option[1:]
 
-    parts = rem.lower().split(sep, 2)
+    parts = rem.split(sep, 2)
     if len(parts) != 2:
         raise ValueError("Invalid number of parameters (2 are expected)")
     flow_patt, status = parts

test/mitmproxy/addons/test_blocklist.py

@@ -29,6 +29,9 @@ class TestBlockList:
             (":~u test:404", b"https://example.org/images/TEST.jpg", 404),
             ("/!jpg/418", b"https://example.org/images/test.jpg", None),
             ("/!png/418", b"https://example.org/images/test.jpg", 418),
+            ("|~u /DATA|500", b"https://example.org/DATA", 500),
+            ("|~u /ASSETS|501", b"https://example.org/assets", 501),
+            ("|~u /ping|201", b"https://example.org/PING", 201),
         ],
     )
     def test_block(self, filter, request_url, status_code):
@@ -44,6 +47,28 @@ class TestBlockList:
             else:
                 assert not f.response
 
+    def test_uppercase_header_values(self):
+        bl = blocklist.BlockList()
+        with taddons.context(bl) as tctx:
+            tctx.configure(bl, block_list=["|~hq Cookie:\\sfoo=BAR|403"])
+            f = tflow.tflow()
+            f.request.url = "https://example.org/robots.txt"
+            f.request.headers["Cookie"] = "foo=BAR; key1=value1"
+            bl.request(f)
+            assert f.response.status_code == 403
+            assert f.metadata["blocklisted"]
+
+    def test_mixedcase_header_names(self):
+        # this test is meant to document existing behavior, not advocate for it.
+        bl = blocklist.BlockList()
+        with taddons.context(bl) as tctx:
+            tctx.configure(bl, block_list=["|~hq User-Agent:\\scurl|401"])
+            f = tflow.tflow()
+            f.request.url = "https://example.org/products/123"
+            f.request.headers["user-agent"] = "curl/8.11.1"
+            bl.request(f)
+            assert not f.response
+
     def test_special_kill_status_closes_connection(self):
         bl = blocklist.BlockList()
         with taddons.context(bl) as tctx: