gh-158907: Shorten the handler comment and drop the tunnel test

A CONNECT 407 never reaches http_error_407, and the tunnel test passed without this change.

Author: rajorin

Lib/test/test_urllib2.py

@@ -1756,33 +1756,6 @@ def test_proxy_basic_auth_ignores_direct_407(self):
         self.assertFalse(
             http_handler.requests[0].has_header("Proxy-authorization"))
 
-    def test_proxy_basic_auth_https_tunnel_still_authenticates(self):
-        # 407 from the proxy during an HTTPS tunnel must still be answered.
-        class MockHTTPSHandlerRedirect(MockHTTPHandlerRedirect):
-            def https_open(self, req):
-                return self.http_open(req)
-
-        opener = OpenerDirector()
-        opener.add_handler(urllib.request.ProxyHandler(
-            dict(https="proxy.example.com:3128")))
-        password_manager = urllib.request.HTTPPasswordMgr()
-        auth_handler = urllib.request.ProxyBasicAuthHandler(password_manager)
-        realm = "ACME Networks"
-        http_handler = MockHTTPSHandlerRedirect(
-            407, 'Proxy-Authenticate: Basic realm="%s"\r\n\r\n' % realm)
-        opener.add_handler(auth_handler)
-        opener.add_handler(http_handler)
-
-        password_manager.add_password(
-            realm, "proxy.example.com:3128", "wile", "coyote")
-        opener.open("https://acme.example.com/protected")
-
-        self.assertEqual(len(http_handler.requests), 2)
-        self.assertFalse(
-            http_handler.requests[0].has_header("Proxy-authorization"))
-        self.assertTrue(
-            http_handler.requests[1].has_header("Proxy-authorization"))
-
     def test_basic_and_digest_auth_handlers(self):
         # HTTPDigestAuthHandler raised an exception if it couldn't handle a 40*
         # response (https://bugs.python.org/issue1479302), where it should instead

Lib/urllib/request.py

@@ -1048,10 +1048,7 @@ class ProxyBasicAuthHandler(AbstractBasicAuthHandler, BaseHandler):
     auth_header = 'Proxy-authorization'
 
     def http_error_407(self, req, fp, code, msg, headers):
-        # A direct origin is not a proxy. req.host has no scheme, so a
-        # password stored for https://HOST/ would match and be sent in
-        # cleartext on the retry (gh-158907). HTTPS tunnels set
-        # _tunnel_host instead of making has_proxy() true.
+        # gh-158907: a 407 from a direct origin is not a proxy challenge
         if not req.has_proxy() and not req._tunnel_host:
             return None
         # http_error_auth_reqed requires that there is no userinfo component in