From 78d52fb055d2749558df9551d3bf56e89e865091 Mon Sep 17 00:00:00 2001
From: Oren Jacobian Pana <orenjp@gmail.com>
Date: Sun, 18 Oct 2026 22:18:24 +0300
Subject: [PATCH] fix: treat the `<empty>` proxy as a direct connection on
 Windows and macOS

sentry-native passes `<empty>` when the proxy is explicitly set to an empty
string. The libcurl transport already maps it to no proxy (#119). The WinHTTP
transport fell back to WINHTTP_ACCESS_TYPE_AUTOMATIC_PROXY, and the macOS
transport passed `<empty>/` to CrackURL and std::stoi.

Open the WinHTTP session with WINHTTP_ACCESS_TYPE_NO_PROXY, and give the
macOS session an empty connectionProxyDictionary, which disables the proxy.
---
 util/net/http_transport_mac.mm | 54 ++++++++++++++++++----------------
 util/net/http_transport_win.cc |  7 +++++
 2 files changed, 36 insertions(+), 25 deletions(-)

diff --git a/util/net/http_transport_mac.mm b/util/net/http_transport_mac.mm
index 9406ab367..24d0dab7d 100644
--- a/util/net/http_transport_mac.mm
+++ b/util/net/http_transport_mac.mm
@@ -272,31 +272,35 @@ static bool ExecuteProxyRequest(NSMutableURLRequest* request,
     NSURLSessionConfiguration* sessionConfig =
         [NSURLSessionConfiguration ephemeralSessionConfiguration];
 
-    std::string scheme, host, port, rest_ignored;
-    CrackURL(proxy, &scheme, &host, &port, &rest_ignored);
-    NSString* schemeNS = base::SysUTF8ToNSString(scheme);
-    NSString* hostNS = base::SysUTF8ToNSString(host);
-    NSNumber* proxy_port = @(std::stoi(port));
-
-    NSDictionary* proxyDict;
-
-    if ([schemeNS isEqualToString:@"http"] || [schemeNS isEqualToString:@"https"]) {
-        // The keys in this dictionary refer to the target URL,
-        // whereas `schemeNS` refers to the proxy URL.
-        proxyDict = @{
-          @"HTTPEnable" : @YES,
-          @"HTTPPort" : proxy_port,
-          @"HTTPProxy" : hostNS,
-          @"HTTPSEnable" : @YES,
-          @"HTTPSPort" : proxy_port,
-          @"HTTPSProxy" : hostNS
-        };
-    } else if ([schemeNS isEqualToString:@"socks5"]) {
-        proxyDict = @{
-          @"SOCKSEnable" : @YES,
-          @"SOCKSPort" : proxy_port,
-          @"SOCKSProxy" : hostNS
-        };
+    // `<empty>` means no proxy, as in the libcurl transport. An empty
+    // dictionary disables the proxy, whereas nil uses the system settings.
+    NSDictionary* proxyDict = @{};
+
+    if (proxy != "<empty>/") {
+      std::string scheme, host, port, rest_ignored;
+      CrackURL(proxy, &scheme, &host, &port, &rest_ignored);
+      NSString* schemeNS = base::SysUTF8ToNSString(scheme);
+      NSString* hostNS = base::SysUTF8ToNSString(host);
+      NSNumber* proxy_port = @(std::stoi(port));
+
+      if ([schemeNS isEqualToString:@"http"] || [schemeNS isEqualToString:@"https"]) {
+          // The keys in this dictionary refer to the target URL,
+          // whereas `schemeNS` refers to the proxy URL.
+          proxyDict = @{
+            @"HTTPEnable" : @YES,
+            @"HTTPPort" : proxy_port,
+            @"HTTPProxy" : hostNS,
+            @"HTTPSEnable" : @YES,
+            @"HTTPSPort" : proxy_port,
+            @"HTTPSProxy" : hostNS
+          };
+      } else if ([schemeNS isEqualToString:@"socks5"]) {
+          proxyDict = @{
+            @"SOCKSEnable" : @YES,
+            @"SOCKSPort" : proxy_port,
+            @"SOCKSProxy" : hostNS
+          };
+      }
     }
     sessionConfig.connectionProxyDictionary = proxyDict;
     NSURLSession* session =
diff --git a/util/net/http_transport_win.cc b/util/net/http_transport_win.cc
index e0eb8c2dc..f449c7f41 100644
--- a/util/net/http_transport_win.cc
+++ b/util/net/http_transport_win.cc
@@ -161,6 +161,13 @@ bool HTTPTransportWin::ExecuteSynchronously(std::string* response_body) {
                                           base::UTF8ToWide(proxy).c_str(),
                                           WINHTTP_NO_PROXY_BYPASS,
                                           0));
+  } else if (http_proxy() == "<empty>") {
+    // `<empty>` means no proxy, as in the libcurl transport
+    session = ScopedHINTERNET(WinHttpOpen(base::UTF8ToWide(UserAgent()).c_str(),
+                                          WINHTTP_ACCESS_TYPE_NO_PROXY,
+                                          WINHTTP_NO_PROXY_NAME,
+                                          WINHTTP_NO_PROXY_BYPASS,
+                                          0));
   } else {
 #if _WIN32_WINNT >= 0x0603
     session = ScopedHINTERNET(WinHttpOpen(base::UTF8ToWide(UserAgent()).c_str(),