Database auto-update ignores --proxy and leaks the real IP

What happens

The database auto-update ignores --proxy and goes out over the direct connection.

resolve_db_path() is called from maigret/maigret.py:667, before any site check runs, and it fetches two URLs with plain requests.get() calls that never receive the proxy:

• maigret/db_updater.py:102 in _fetch_meta() (db_meta.json)
• maigret/db_updater.py:127 in _download_and_verify() (data.json)

Auto-update is on by default ("no_autoupdate": false in maigret/resources/settings.json) and runs once every 24 hours, so a user who passes --proxy gets one request per day to raw.githubusercontent.com from their real address, plus the database download itself when an update is available.

requests reads HTTP_PROXY / HTTPS_PROXY from the environment on its own, so people who set those are covered by accident. People who only pass --proxy are not.

Why it matters

Our own TROUBLESHOOTING.md recommends exactly this flag for anonymising a run:

Route the whole run through Tor / a proxy (e.g. on Tails OS, or to anonymise the scan). Use --proxy:

bash复制

maigret user --proxy socks5://127.0.0.1:9050 --timeout 60 --retries 2

Somebody following that line believes the whole run is tunnelled. It is not, and the leak happens before the first site is checked, so it is not visible in the results either.

Reproduce

maigret someuser --proxy socks5://127.0.0.1:9050

Watch the traffic with tcpdump/mitmproxy: the connection to raw.githubusercontent.com leaves outside the tunnel. Passing --no-autoupdate removes it, which confirms where it comes from.

Suggested fix

Thread the proxy into both calls: requests.get(url, timeout=..., proxies={"http": proxy, "https": proxy}). PySocks is already a dependency, so socks5:// and socks5h:// work as-is, and normalize_proxy_scheme() (added in #2966) already knows how to spell the scheme for this transport.

Worth deciding at the same time what to do when the proxy is down: fail the update quietly and keep the bundled database, rather than falling back to a direct request, otherwise the fix reintroduces the leak on the failure path.

Related paths, same class

Checked on main, none of them see --proxy either:

• maigret/activation.py (5 call sites) uses ClientSession(trust_env=True): environment variables only
• maigret/ai.py:149 uses aiohttp.ClientSession() with no trust_env: neither --proxy nor the environment
• maigret/sites.py:562 loads --db <url> with a bare requests.get()

The auto-update is the urgent one because it is on by default and fires before everything else. The rest can be handled separately.