target extension leaks into the proxy CONNECT request

[graingert]

When a request uses the target extension through an HTTP proxy, the target is
applied to the CONNECT request too: CONNECT / HTTP/1.1 is sent instead of
CONNECT example.com:443 HTTP/1.1, and the proxy replies 400 Bad Request.

import anyio
import httpx2
import tiny_proxy


async def main():
    listener = await anyio.create_tcp_listener(local_host="127.0.0.1")
    port = listener.extra(anyio.abc.SocketAttribute.local_port)
    async with anyio.create_task_group() as tg:
        tg.start_soon(listener.serve, tiny_proxy.HttpProxyHandler().handle)
        async with httpx2.AsyncClient(proxy=f"http://127.0.0.1:{port}") as client:
            await client.get("https://example.com/", extensions={"target": b"/"})
        tg.cancel_scope.cancel()


anyio.run(main)

httpx2.ProxyError: 400 Bad Request

Without extensions=... the request succeeds.

AsyncTunnelHTTPConnection and AsyncForwardHTTPConnection pass all of the
endpoint request's extensions to the Request they send to the proxy. Some of
those extensions describe the endpoint, not the proxy hop: 2.13.1 fixed this
for sni_hostname by filtering it out, but target has the same problem (the
forward proxy sends GET / instead of absolute-form GET http://...).

Instead of growing an exclude list, only timeout and trace could be passed
on, since those are the extensions httpcore reads that apply to the proxy hop:

extensions={k: v for k, v in request.extensions.items() if k in ("timeout", "trace")}

The minimal alternative is to exclude target next to sni_hostname.

[Kludex]

• Solved in Exclude destination targets from proxy-generated requests #1262