http: parse request URLs with urlsplit

[KernelClint]

HTTP_Client.request() takes a full URL and works out where to connect. It does that with a regular
expression at
scapy/layers/http.py:878-900:

m = re.match(r"(https?)://([^/:]+)(?:\:(\d+))?(/.*)?", url)

That expression is not anchored at the end and does not implement URL authority parsing. A URL may
carry user information before the host, separated by @, and a standard parser knows the real
destination is what follows the @. This expression takes the first host:port-looking run it
finds, which for http://example.com:80@evil.test/ is the user-information part.

So a program that validates an attacker-supplied URL with urllib.parse — deciding the host is
allowed — and then hands the same string to Scapy can end up connecting somewhere its check
excluded.

The change uses the standard parser:

-        m = re.match(r"(https?)://([^/:]+)(?:\:(\d+))?(/.*)?", url)
-        if not m:
+        try:
+            parsed = urlsplit(url)
+            transport = parsed.scheme
+            host = parsed.hostname
+            port = parsed.port
+        except ValueError:
+            raise ValueError("Bad URL !") from None
+        if transport not in ["http", "https"] or not host:

urlsplit also gives the path and query separately, so the request target is built from those and
a fragment is excluded, which is what an HTTP client should send. URLs carrying user information
stay valid; they now connect to their authority. Malformed ports and unsupported schemes are
rejected rather than silently mis-parsed.

The added regression asserts that a URL whose user information looks like a host and port connects
to the authority, and that a fragment does not reach the request line. Without the source change it
fails.

Performance was measured on one computer, before and after the fix: a request took 37.4 µs before
and 37.2 µs after. Repeat runs moved by about 2%, so that difference is smaller than the test can
distinguish.

[codecov]

Codecov Report

❌ Patch coverage is 81.25000% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 80.64%. Comparing base (b3bbcc8) to head (ad58e16).

Files with missing lines	Patch %	Lines
scapy/layers/http.py	81.25%	3 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #5140   +/-   ##
=======================================
  Coverage   80.63%   80.64%           
=======================================
  Files         390      390           
  Lines       96936    96945    +9     
=======================================
+ Hits        78168    78177    +9     
  Misses      18768    18768           

Files with missing lines	Coverage Δ
scapy/layers/http.py	83.30% <81.25%> (-0.08%)	⬇️

... and 3 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.