new_contents: import sys
  import ssl
  
  PY2 = sys.version_info[0] == 2
  PY3 = sys.version_info[0] == 3
  
  if PY2:
      from httplib import HTTPConnection, HTTPSConnection
  if PY3:
      from http.client import HTTPConnection, HTTPSConnection
  
  
  # NOTE: the URL may be relative to host, or may be full URL.
  conn = HTTPConnection("example.com") # $ MISSING: clientRequestUrl="example.com"
  conn.request("GET", "/") # $ MISSING: clientRequestUrl="/"
  conn.request("GET", "http://example.com/") # $ MISSING: clientRequestUrl="http://example.com/"
  
  # kwargs
  conn = HTTPConnection(host="example.com") # $ MISSING: clientRequestUrl="example.com"
  conn.request(method="GET", url="/") # $ MISSING: clientRequestUrl="/"
  
  # using internal method... you shouldn't but you can
  conn._send_request("GET", "url", body=None, headers={}, encode_chunked=False) # $ MISSING: clientRequestUrl="url"
  
  # low level sending of request
  conn.putrequest("GET", "url") # $ MISSING: clientRequestUrl="url"
  conn.putheader("X-Foo", "value")
  conn.endheaders(message_body=None)
  
  # HTTPS
  conn = HTTPSConnection("host") # $ MISSING: clientRequestUrl="host"
  conn.request("GET", "url") # $ MISSING: clientRequestUrl="url"
  
  # six aliases
  import six
  
  conn = six.moves.http_client.HTTPConnection("host") # $ MISSING: clientRequestUrl="host"
  conn.request("GET", "url") # $ MISSING: clientRequestUrl="url"
  
  conn = six.moves.http_client.HTTPSConnection("host") # $ MISSING: clientRequestUrl="host"
  conn.request("GET", "url") # $ MISSING: clientRequestUrl="url"
  
  # ==============================================================================
  # Certificate validation disabled
  # ==============================================================================
  
  # default SSL context is the one given by `_create_default_https_context`
  context = ssl._create_default_https_context()
  assert context.check_hostname == True
  assert context.verify_mode == ssl.CERT_REQUIRED
  
  conn = HTTPSConnection("host", context=context) # $ MISSING: clientRequestUrl="host"
  conn.request("GET", "url") # $ MISSING: clientRequestUrl="url"
  
  # `_create_default_https_context` is currently just an alias for `create_default_context`
  # which creates a context for SERVER_AUTH purpose.
  context = ssl.create_default_context()
  assert context.check_hostname == True
  assert context.verify_mode == ssl.CERT_REQUIRED
  
  conn = HTTPSConnection("host", context=context) # $ MISSING: clientRequestUrl="host"
  conn.request("GET", "url") # $ MISSING: clientRequestUrl="url"
  
  # however, if you supply your own SSLContext, you need to set it manually
  context = ssl.SSLContext()
  assert context.check_hostname == False
  assert context.verify_mode == ssl.CERT_NONE
  
  conn = HTTPSConnection("host", context=context) # $ MISSING: clientRequestUrl="host"
  conn.request("GET", "url") # $ MISSING: clientRequestUrl="url" clientRequestCertValidationDisabled
  
  # and if you misunderstood whether to use server/client in the purpose, you will also
  # get a context without hostname verification.
  context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
  assert context.check_hostname == False
  assert context.verify_mode == ssl.CERT_NONE
  
  conn = HTTPSConnection("host", context=context) # $ MISSING: clientRequestUrl="host"
  conn.request("GET", "url") # $ MISSING: clientRequestUrl="url" clientRequestCertValidationDisabled
  
  # NOTICE that current documentation says
  #
  # > Enabling hostname checking automatically sets verify_mode from CERT_NONE to
  # > CERT_REQUIRED. It cannot be set back to CERT_NONE as long as hostname checking is
  # > enabled.
  # - https://docs.python.org/3.10/library/ssl.html#ssl.SSLContext.check_hostname
  
  context = ssl.SSLContext()
  context.check_hostname = True
  assert context.verify_mode == ssl.CERT_REQUIRED
  
  conn = HTTPSConnection("host", context=context) # $ MISSING: clientRequestUrl="host"
  conn.request("GET", "url") # $ MISSING: clientRequestUrl="url"
  
  # only setting verify_mode is not enough, since check_hostname is not enabled
  
  context = ssl.SSLContext()
  context.verify_mode = ssl.CERT_REQUIRED
  assert context.check_hostname == False
  
  conn = HTTPSConnection("host", context=context) # $ MISSING: clientRequestUrl="host"
  conn.request("GET", "url") # $ MISSING: clientRequestUrl="url" clientRequestCertValidationDisabled
  
  # ==============================================================================
  # taint test
  # ==============================================================================
  
  from flask import request
  
  def taint_test():
      host = request.args['host']
      url = request.args['url']
  
      conn = HTTPConnection(host) # $ MISSING: clientRequestUrl=host
      conn.request("GET", url) # $ MISSING: clientRequestUrl=url
  
      resp = conn.getresponse()
  
      ensure_tainted(
          # see
          # https://docs.python.org/3.10/library/http.client.html#httpresponse-objects
          # https://docs.python.org/3/library/http.client.html#http.client.HTTPResponse
  
          # a HTTPResponse itself is file-like
          resp, # $ MISSING: tainted
          resp.read(), # $ MISSING: tainted
  
          resp.getheader("name"), # $ MISSING: tainted
          resp.getheaders(), # $ MISSING: tainted
  
          # http.client.HTTPMessage
          resp.headers, # $ MISSING: tainted
          resp.headers.get_all(), # $ MISSING: tainted
  
          # Alias for .headers
          # http.client.HTTPMessage
          resp.msg, # $ MISSING: tainted
          resp.msg.get_all(), # $ MISSING: tainted
  
          # Alias for .headers
          resp.info(), # $ MISSING: tainted
          resp.info().get_all(), # $ MISSING: tainted
  
          # although this would usually be the textual version of the status
          # ("OK" for 200), it is possible to put your own evil data in here.
          resp.reason, # $ MISSING: tainted
  
          # the URL of the recourse that was visited, if redirects were followed.
          # I don't see any reason this could not contain evil data.
          resp.url, # $ MISSING: tainted
          resp.geturl(), # $ MISSING: tainted
      )
  
      ensure_not_tainted(
          resp.status,
          resp.code,
          resp.getcode(),
      )
  
subject: Add tests of `http.client.HTTPResponse`