The implementation of no_proxy environment just checks that the hostname ends with some host present in the no_proxy variable. Although there is no clear specification for no_proxy, this behavior is very unexpected and even dangerous.

• It prevents you from bypassing only one domain and not its subdomains.
• If no_proxy is set for requests.com, attacker-requests.com is also whitelisted. Not sure it's really really bad, but huh, it's definitely not good.

Expected Result

• no_proxy=gle.com should bypass ONLY the domain gle.com (optionally its subdomains, but I don't think it's desirable)
• no_proxy=www.gle.com should bypass ONLY the domain www.gle.com (optionally its subdomains, but I don't think it's desirable)
• no_proxy=.google.com should bypass ONLY subdomains of google.com (and optionally google.com, but I don't think it's desirable)

Actual Result

no_proxy=gle.com bypasses any domain that ends with gle.com, including:

• google.com
• www.google.com
• foo.gle.com
• foo.bar.gle.com

Reproduction Steps

$ http_proxy=http://no-proxy-here/ no_proxy=gle.com python -c "import requests; print(requests.get('http://www.google.com'))"     
<Response [200]>

System Information

$ python -m requests.help

{
  "chardet": {
    "version": "3.0.4"
  },
  "cryptography": {
    "version": ""
  },
  "idna": {
    "version": "2.7"
  },
  "implementation": {
    "name": "CPython",
    "version": "3.7.0"
  },
  "platform": {
    "release": "4.18.7-arch1-1-ARCH",
    "system": "Linux"
  },
  "pyOpenSSL": {
    "openssl_version": "",
    "version": null
  },
  "requests": {
    "version": "2.19.1"
  },
  "system_ssl": {
    "version": "1010100f"
  },
  "urllib3": {
    "version": "1.23"
  },
  "using_pyopenssl": false
}

I can prepare a PR if needed.