To be fair, the advice from sigmavirus24 was about dealing with decoding the ':'...

To be fair, the advice from sigmavirus24 was about dealing with decoding the ':' character: https://github.com/psf/requests/pull/2936/files

The code already had `host = ri.netloc.split(':')[0]` before that.

The actual root issue is urlparse doesn't split the host, user, pass and port and trying to do it manually is very error prone:

    urllib.parse.urlparse('http://example.com:@evil.com:8080/')
    ParseResult(scheme='http', netloc='example.com:@evil.com:8080', path='/', params='', query='', fragment='')

Compare this with php:

    parse_url ('http://example.com:@evil.com:8080/')
    [
        "scheme" => "http",
        "host" => "evil.com",
        "port" => 8080,
        "user" => "example.com",
        "pass" => "",
        "path" => "/",
    ]