diff options
| author | Brad Fitzpatrick <bradfitz@golang.org> | 2017-05-23 23:42:47 +0000 |
|---|---|---|
| committer | Brad Fitzpatrick <bradfitz@golang.org> | 2017-05-24 04:15:25 +0000 |
| commit | 88a235042df2d8344bb4f49a8bfc1642b2cbf37b (patch) | |
| tree | 661745e14ca7ee022ef84add53cf89d377f29321 /src/net | |
| parent | a5083bbf0784a4664e49207b6a3677986ca69b49 (diff) | |
| download | go-88a235042df2d8344bb4f49a8bfc1642b2cbf37b.tar.xz | |
net/http: permit incoming CONNECT requests without Host headers
Apparently they exist in the wild. See:
https://github.com/golang/go/issues/18215#issuecomment-301182496
(Facebook / iOS)
Fixes #18215
Change-Id: I9ddad3896b5d784cb3f5b3ee9c6819081a4a2702
Reviewed-on: https://go-review.googlesource.com/44004
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Matt Layher <mdlayher@gmail.com>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Diffstat (limited to 'src/net')
| -rw-r--r-- | src/net/http/serve_test.go | 3 | ||||
| -rw-r--r-- | src/net/http/server.go | 2 |
2 files changed, 4 insertions, 1 deletions
diff --git a/src/net/http/serve_test.go b/src/net/http/serve_test.go index 80fcc8c407..2897c15228 100644 --- a/src/net/http/serve_test.go +++ b/src/net/http/serve_test.go @@ -4358,6 +4358,9 @@ func TestServerValidatesHostHeader(t *testing.T) { // Make an exception for HTTP upgrade requests: {"PRI * HTTP/2.0", "", 200}, + // Also an exception for CONNECT requests: (Issue 18215) + {"CONNECT golang.org:443 HTTP/1.1", "", 200}, + // But not other HTTP/2 stuff: {"PRI / HTTP/2.0", "", 400}, {"GET / HTTP/2.0", "", 400}, diff --git a/src/net/http/server.go b/src/net/http/server.go index b60bd2481e..a8d32459e0 100644 --- a/src/net/http/server.go +++ b/src/net/http/server.go @@ -943,7 +943,7 @@ func (c *conn) readRequest(ctx context.Context) (w *response, err error) { hosts, haveHost := req.Header["Host"] isH2Upgrade := req.isH2Upgrade() - if req.ProtoAtLeast(1, 1) && (!haveHost || len(hosts) == 0) && !isH2Upgrade { + if req.ProtoAtLeast(1, 1) && (!haveHost || len(hosts) == 0) && !isH2Upgrade && req.Method != "CONNECT" { return nil, badRequestError("missing required Host header") } if len(hosts) > 1 { |