diff options
| author | Brad Fitzpatrick <bradfitz@golang.org> | 2019-01-23 19:09:07 +0000 |
|---|---|---|
| committer | Brad Fitzpatrick <bradfitz@golang.org> | 2019-01-23 19:31:46 +0000 |
| commit | 829c5df58694b3345cb5ea41206783c8ccf5c3ca (patch) | |
| tree | d00f25105998b1febceffce61fe9db56485b8963 /src/net/http/requestwrite_test.go | |
| parent | 4edea0f0a77b341ec565d848e453c4a854418e8c (diff) | |
| download | go-829c5df58694b3345cb5ea41206783c8ccf5c3ca.tar.xz | |
net/url, net/http: reject control characters in URLs
This is a more conservative version of the reverted CL 99135 (which
was reverted in CL 137716)
The net/url part rejects URLs with ASCII CTLs from being parsed and
the net/http part rejects writing them if a bogus url.URL is
constructed otherwise.
Updates #27302
Updates #22907
Change-Id: I09a2212eb74c63db575223277aec363c55421ed8
Reviewed-on: https://go-review.googlesource.com/c/159157
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Diffstat (limited to 'src/net/http/requestwrite_test.go')
| -rw-r--r-- | src/net/http/requestwrite_test.go | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/src/net/http/requestwrite_test.go b/src/net/http/requestwrite_test.go index 7dbf0d4e8a..b110b57b1a 100644 --- a/src/net/http/requestwrite_test.go +++ b/src/net/http/requestwrite_test.go @@ -576,6 +576,17 @@ var reqWriteTests = []reqWriteTest{ "User-Agent: Go-http-client/1.1\r\n" + "X-Foo: X-Bar\r\n\r\n", }, + + 25: { + Req: Request{ + Method: "GET", + URL: &url.URL{ + Host: "www.example.com", + RawQuery: "new\nline", // or any CTL + }, + }, + WantError: errors.New("net/http: can't write control character in Request.URL"), + }, } func TestRequestWrite(t *testing.T) { |