net/http: don't sniff Request.Body on 100-continue requests in Transport

Also, update bundled http2 to x/net git rev 0d8126f to include
https://golang.org/cl/30150, the HTTP/2 version of this fix.

Fixes #16002

Change-Id: I8da1ca98250357aec012e3e85c8b13acfa2f3fec
Reviewed-on: https://go-review.googlesource.com/30151
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Ian Lance Taylor <iant@golang.org>

1 files changed, 13 insertions, 5 deletions

diff --git a/src/net/http/request.go b/src/net/http/request.go
index 21e25b08ef..c29af7fbe5 100644
--- a/src/net/http/request.go
+++ b/src/net/http/request.go
@@ -1227,11 +1227,19 @@ func (r *Request) bodyAndLength() (body io.Reader, contentLen int64) {
 	if r.ContentLength != 0 {
 		return body, r.ContentLength
 	}
-	// Don't try to sniff the bytes if they're using a custom
-	// transfer encoding (or specified chunked themselves), and
-	// don't sniff if they're not using HTTP/1.1 and can't chunk
-	// anyway.
-	if len(r.TransferEncoding) != 0 || !r.ProtoAtLeast(1, 1) {
+
+	// Don't try to sniff the request body if,
+	// * they're using a custom transfer encoding (or specified
+	//   chunked themselves)
+	// * they're not using HTTP/1.1 and can't chunk anyway (even
+	//   though this is basically irrelevant, since this package
+	//   only sends minimum 1.1 requests)
+	// * they're sending an "Expect: 100-continue" request, because
+	//   they might get denied or redirected and try to use the same
+	//   body elsewhere, so we shoudn't consume it.
+	if len(r.TransferEncoding) != 0 ||
+		!r.ProtoAtLeast(1, 1) ||
+		r.Header.Get("Expect") == "100-continue" {
 		return body, -1
 	}