diff options
| author | David Url <david@urld.io> | 2018-04-02 12:57:59 +0200 |
|---|---|---|
| committer | Brad Fitzpatrick <bradfitz@golang.org> | 2018-04-16 17:44:41 +0000 |
| commit | ea3f329613c28cf8d8e955135616ee061ce0a012 (patch) | |
| tree | 79acbb831170f8405e11861882b2fb5f58db7122 /src/net/http/httptest | |
| parent | 7b7affa56d3957c2f721595de732d03e04bf2a62 (diff) | |
| download | go-ea3f329613c28cf8d8e955135616ee061ce0a012.tar.xz | |
net/http: omit forbidden Trailer headers from response
Use the vendored ValidTrailerHeader function from x/net/http/httpguts to
check Trailer headers according to RFC 7230. The previous implementation
only omitted illegal Trailer headers defined in RFC 2616.
This CL adds x/net/http/httpguts from CL 104042 (git rev a35a21de97)
Fixes #23908
Change-Id: Ib2329a384040494093c18e209db9b62aaf86e921
Reviewed-on: https://go-review.googlesource.com/104075
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Diffstat (limited to 'src/net/http/httptest')
| -rw-r--r-- | src/net/http/httptest/recorder.go | 13 |
1 files changed, 5 insertions, 8 deletions
diff --git a/src/net/http/httptest/recorder.go b/src/net/http/httptest/recorder.go index 16f9736183..22170cf98b 100644 --- a/src/net/http/httptest/recorder.go +++ b/src/net/http/httptest/recorder.go @@ -11,6 +11,8 @@ import ( "net/http" "strconv" "strings" + + "golang_org/x/net/http/httpguts" ) // ResponseRecorder is an implementation of http.ResponseWriter that @@ -186,16 +188,11 @@ func (rw *ResponseRecorder) Result() *http.Response { if trailers, ok := rw.snapHeader["Trailer"]; ok { res.Trailer = make(http.Header, len(trailers)) for _, k := range trailers { - // TODO: use http2.ValidTrailerHeader, but we can't - // get at it easily because it's bundled into net/http - // unexported. This is good enough for now: - switch k { - case "Transfer-Encoding", "Content-Length", "Trailer": - // Ignore since forbidden by RFC 2616 14.40. - // TODO: inconsistent with RFC 7230, section 4.1.2. + k = http.CanonicalHeaderKey(k) + if !httpguts.ValidTrailerHeader(k) { + // Ignore since forbidden by RFC 7230, section 4.1.2. continue } - k = http.CanonicalHeaderKey(k) vv, ok := rw.HeaderMap[k] if !ok { continue |