go/src/net/http/request_test.go, branch ms-fix-multipart-readform

mime/multipart: fix ReadForm always return (nil,io.EOF)

2023-05-11T09:16:12Z

Previously, the condition err == io.EOF in readForm will never true and break; it always goes to the second condition, err != nil, which cause the returned ReadForm always nil with err is io.EOF. As the test, we use the example with body almost similar to ExampleNewReader with header contains "Content-Disposition:form-data". Change-Id: I7268f45bb26eafb7f1e6e471b86eec681dde99f7

net/http: let ErrNotSupported match errors.ErrUnsupported

2023-05-10T20:13:04Z

For #41198 Change-Id: Ibb030e94618a1f594cfd98ddea214ad7a88d2e73 Reviewed-on: https://go-review.googlesource.com/c/go/+/494122 Auto-Submit: Ian Lance Taylor Reviewed-by: Damien Neil Run-TryBot: Ian Lance Taylor Reviewed-by: Bryan Mills TryBot-Result: Gopher Robot

all: fix a lot of comments

2023-05-10T12:59:20Z

Fix comments, including duplicate is, wrong phrases and articles, misspellings, etc. Change-Id: I8bfea53b9b275e649757cc4bee6a8a026ed9c7a4 Reviewed-on: https://go-review.googlesource.com/c/go/+/493035 Reviewed-by: Benny Siegert Reviewed-by: Ian Lance Taylor Run-TryBot: shuang cui TryBot-Result: Gopher Robot Run-TryBot: Ian Lance Taylor Auto-Submit: Ian Lance Taylor

mime/multipart: limit memory/inode consumption of ReadForm

2023-02-14T16:51:18Z

Reader.ReadForm is documented as storing "up to maxMemory bytes + 10MB" in memory. Parsed forms can consume substantially more memory than this limit, since ReadForm does not account for map entry overhead and MIME headers. In addition, while the amount of disk memory consumed by ReadForm can be constrained by limiting the size of the parsed input, ReadForm will create one temporary file per form part stored on disk, potentially consuming a large number of inodes. Update ReadForm's memory accounting to include part names, MIME headers, and map entry overhead. Update ReadForm to store all on-disk file parts in a single temporary file. Files returned by FileHeader.Open are documented as having a concrete type of *os.File when a file is stored on disk. The change to use a single temporary file for all parts means that this is no longer the case when a form contains more than a single file part stored on disk. The previous behavior of storing each file part in a separate disk file may be reenabled with GODEBUG=multipartfiles=distinct. Update Reader.NextPart and Reader.NextRawPart to set a 10MiB cap on the size of MIME headers. Thanks to Jakob Ackermann (@das7pad) for reporting this issue. Fixes #58006 Fixes CVE-2022-41725 Change-Id: Ibd780a6c4c83ac8bcfd3cbe344f042e9940f2eab Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1714276 Reviewed-by: Julie Qiu TryBot-Result: Security TryBots Reviewed-by: Roland Shoemaker Run-TryBot: Damien Neil Reviewed-on: https://go-review.googlesource.com/c/go/+/468124 Auto-Submit: Michael Pratt Run-TryBot: Michael Pratt Reviewed-by: Than McIntosh TryBot-Result: Gopher Robot

net/http: refactor tests to run most in HTTP/1 and HTTP/2 modes

2022-10-07T16:53:14Z

Replace the ad-hoc approach to running tests in HTTP/1 and HTTP/2 modes with a 'run' function that executes a test in various modes. By default, these modes are HTTP/1 and HTTP/2, but tests can opt-in to HTTPS/1 as well. The 'run' function also takes care of post-test cleanup (running the afterTest function). The 'run' function runs tests in parallel by default. Tests which can't run in parallel (generally because they use global test hooks) pass a testNotParallel option to disable parallelism. Update clientServerTest to use t.Cleanup to clean up after itself, rather than leaving this up to tests to handle. Drop an unnecessary mutex in SetReadLoopBeforeNextReadHook. Test hooks can't be set in parallel, and we want the race detector to notify us if two simultaneous tests try to set a hook. Fixes #56032 Change-Id: I16be64913c426fc93d84abc6ad85dbd3bc191224 Reviewed-on: https://go-review.googlesource.com/c/go/+/438137 TryBot-Result: Gopher Robot Run-TryBot: Damien Neil Reviewed-by: Brad Fitzpatrick Reviewed-by: David Chase

all: fix some typos

2022-09-28T15:13:20Z

Change-Id: I8b28aebbb9494b2c877139a4584a5a42253e3bea GitHub-Last-Rev: e3703fd3a50b811785df75751472aa3ab098b3d1 GitHub-Pull-Request: golang/go#55902 Reviewed-on: https://go-review.googlesource.com/c/go/+/435617 Reviewed-by: Robert Griesemer Reviewed-by: Cherry Mui

net/http: accept HEAD requests with a body

2022-09-21T15:30:20Z

RFC 7231 permits HEAD requests to contain a body, although it does state there are no defined semantics for payloads of HEAD requests and that some servers may reject HEAD requests with a payload. Accept HEAD requests with a body. Fix a bug where a HEAD request with a chunked body would interpret the body as the headers for the next request on the connection. For #53960. Change-Id: I83f7112fdedabd6d6291cd956151d718ee6942cd Reviewed-on: https://go-review.googlesource.com/c/go/+/418614 Run-TryBot: Damien Neil Reviewed-by: Brad Fitzpatrick Reviewed-by: Cherry Mui TryBot-Result: Gopher Robot

net/http: use strings.Builder

2022-09-07T01:07:32Z

Change-Id: I754edcf21e003a3f4037fb2c5d8d06f2cd5f2fa3 Reviewed-on: https://go-review.googlesource.com/c/go/+/428267 Auto-Submit: Ian Lance Taylor TryBot-Result: Gopher Robot Run-TryBot: Ian Lance Taylor Run-TryBot: xie cui <523516579@qq.com> Reviewed-by: Ian Lance Taylor Reviewed-by: Damien Neil

net/http: don't panic on very large MaxBytesReaderLimit

2022-08-26T18:17:27Z

Fixes #54408 Change-Id: I454199ae5bcd087b8fc4169b7622412105e71113 GitHub-Last-Rev: a33fe7e206d0c394440962acd360df3aa9b117c3 GitHub-Pull-Request: golang/go#54415 Reviewed-on: https://go-review.googlesource.com/c/go/+/423314 Auto-Submit: Dmitri Shuralyov Run-TryBot: xie cui <523516579@qq.com> TryBot-Result: Gopher Robot Reviewed-by: David Chase Reviewed-by: Damien Neil Reviewed-by: hopehook

net/http: return ErrNoCookie from Request.Cookie when name is ""

2022-08-17T17:19:38Z

Request.Cookie(name string) will return the first cookie when cookie name is "". Since readCookies in file net/http/cookie.go at line 247 return all cookies when second parameter is a empty string. To fix it, Return ErrNoCookie from Request.Cookie(""), instead of the first cookie in the request. Fixes #53181 Change-Id: Ie623ca4c53da64ef7623a7863292a2d771f76832 GitHub-Last-Rev: 01098cd5dbcc8d65e9c0893e0586601584e5f8b9 GitHub-Pull-Request: golang/go#53183 Reviewed-on: https://go-review.googlesource.com/c/go/+/409754 Reviewed-by: Ian Lance Taylor Reviewed-by: Damien Neil