http proxy environment variables not used

[ncsc-ie-devs]

Description

The current implementation of csaf_downloader does not use proxy environment variables (HTTP_PROXY, HTTPS_PROXY, NO_PROXY) due to missing configuration in the HTTP client's Transport. This leads to issues when running the tool in environments that require proxy settings for network requests.

Steps to Reproduce

1. Set up a network environment that requires proxy usage:

   export HTTP_PROXY=http://proxy.example.com:8080
   export HTTPS_PROXY=http://proxy.example.com:8080

2. Run csaf_downloader to download from a URL that requires proxy access.
3. Observe that the requests bypass the proxy and fail to connect.

Expected Behavior

The tool should use the proxy settings defined in the environment variables and route all HTTP and HTTPS traffic through the configured proxy.

Actual Behavior

The tool bypasses the proxy, causing connection failures in proxied environments.

Root Cause

The http.Client instances in the codebase are created with a custom http.Transport but do not include the Proxy field set to http.ProxyFromEnvironment. As a result, the proxy configuration from environment variables is ignored.

For example:

hClient.Transport = &http.Transport{
    TLSClientConfig: &tlsConfig,
}

The Proxy field is missing here, so no proxy is used for outgoing requests.

Proposed Solution

Update all instances of &http.Transport{...} in the codebase to include Proxy: http.ProxyFromEnvironment. This ensures that the proxy settings from the environment are respected.

Example updated code:

hClient.Transport = &http.Transport{
    TLSClientConfig: &tlsConfig,
    Proxy: http.ProxyFromEnvironment,
}

Impact

This issue affects users in corporate or secured environments that require proxy configurations to access external resources. Fixing it improves compatibility and ensures expected behavior.

Steps to Verify

1. Apply the proposed fix.
2. Run the tool with proxy environment variables set.
3. Verify that traffic routes through the proxy.
4. Set the NO_PROXY variable for specific domains and confirm they bypass the proxy.

Additional Context

• Go Documentation on http.ProxyFromEnvironment
• This change ensures adherence to Go's standard behavior for handling proxies in net/http.