From 784ad4be20779237d4d112e2f7cc89a5a8a3e352 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jakub=20W=C4=85do=C5=82owski?=
 <6334715+jwadolowski@users.noreply.github.com>
Date: Tue, 7 Jan 2025 22:55:50 +0100
Subject: [PATCH] fix: Remove filter expression lowercasing in block_list addon
 (#7456)

* fix: Remove filter expression lowercasing in block_list addon

* chore: CHANGELOG update

* test: Add new test cases to verify URL case-sensitivity

* test: Add new test cases to cover case-sensitive filter expressions

* chore: Update test func name

* fix nits

---------

Co-authored-by: Maximilian Hils <github@maximilianhils.com>
---
 CHANGELOG.md                            |  2 ++
 mitmproxy/addons/blocklist.py           |  2 +-
 test/mitmproxy/addons/test_blocklist.py | 25 +++++++++++++++++++++++++
 3 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3d676d6b3..fb382e8e4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,8 @@
   ([#7385](https://github.com/mitmproxy/mitmproxy/pull/7385), @lups2000)
 - Add missing status codes
   ([#7455])(https://github.com/mitmproxy/mitmproxy/pull/7455, @jwadolowski)
+- Remove filter expression lowercasing in block_list addon
+  ([#7456](https://github.com/mitmproxy/mitmproxy/pull/7456), @jwadolowski)
 
 ## 05 December 2024: mitmproxy 11.0.2
 
diff --git a/mitmproxy/addons/blocklist.py b/mitmproxy/addons/blocklist.py
index 6c99bca06..63eecb12a 100644
--- a/mitmproxy/addons/blocklist.py
+++ b/mitmproxy/addons/blocklist.py
@@ -24,7 +24,7 @@ def parse_spec(option: str) -> BlockSpec:
     """
     sep, rem = option[0], option[1:]
 
-    parts = rem.lower().split(sep, 2)
+    parts = rem.split(sep, 2)
     if len(parts) != 2:
         raise ValueError("Invalid number of parameters (2 are expected)")
     flow_patt, status = parts
diff --git a/test/mitmproxy/addons/test_blocklist.py b/test/mitmproxy/addons/test_blocklist.py
index b7c7e536d..e4290f817 100644
--- a/test/mitmproxy/addons/test_blocklist.py
+++ b/test/mitmproxy/addons/test_blocklist.py
@@ -29,6 +29,9 @@ class TestBlockList:
             (":~u test:404", b"https://example.org/images/TEST.jpg", 404),
             ("/!jpg/418", b"https://example.org/images/test.jpg", None),
             ("/!png/418", b"https://example.org/images/test.jpg", 418),
+            ("|~u /DATA|500", b"https://example.org/DATA", 500),
+            ("|~u /ASSETS|501", b"https://example.org/assets", 501),
+            ("|~u /ping|201", b"https://example.org/PING", 201),
         ],
     )
     def test_block(self, filter, request_url, status_code):
@@ -44,6 +47,28 @@ class TestBlockList:
             else:
                 assert not f.response
 
+    def test_uppercase_header_values(self):
+        bl = blocklist.BlockList()
+        with taddons.context(bl) as tctx:
+            tctx.configure(bl, block_list=["|~hq Cookie:\\sfoo=BAR|403"])
+            f = tflow.tflow()
+            f.request.url = "https://example.org/robots.txt"
+            f.request.headers["Cookie"] = "foo=BAR; key1=value1"
+            bl.request(f)
+            assert f.response.status_code == 403
+            assert f.metadata["blocklisted"]
+
+    def test_mixedcase_header_names(self):
+        # this test is meant to document existing behavior, not advocate for it.
+        bl = blocklist.BlockList()
+        with taddons.context(bl) as tctx:
+            tctx.configure(bl, block_list=["|~hq User-Agent:\\scurl|401"])
+            f = tflow.tflow()
+            f.request.url = "https://example.org/products/123"
+            f.request.headers["user-agent"] = "curl/8.11.1"
+            bl.request(f)
+            assert not f.response
+
     def test_special_kill_status_closes_connection(self):
         bl = blocklist.BlockList()
         with taddons.context(bl) as tctx: