aboutsummaryrefslogtreecommitdiff
path: root/src/mime
AgeCommit message (Collapse)Author
39 hoursmime/quotedprintable: fix encoding where a period alone on a lineShulhan
Given the following example of message body, A line that precisely have length 75 with . + LF will cause DATA truncation.\n \n Footer.\n The quotedprintable Writer will encode the message into, A line ... truncation=\r\n .\r\n \r\n Footer.\r\n If we pass the Writer output into SMTP DATA command, the server read the "\r\n.\r\n" as the end of DATA which cause the message truncated on the receiver. This changes fix this issue by encode the period at the end with "=2E" based on recommendation in RFC 2049 Section 3, point (8) [1]. [1] https://www.rfc-editor.org/rfc/rfc2049.html#section-3 Fixes #61235 Change-Id: I350387b183ac6b25886f4084a060dcfcb48232a9
39 hoursall: prealloc slice with possible minimum capabilitiesShulhan
2026-02-20mime: make TypeByExtension follow Chrome+Firefox's precedence for ↵Jakub Czyż
webm->video and weba->audio This CL updates TypeByExtension to correctly follow the precedence rules that Chrome and Firefox use, whereby "webm" maps to "video/webm" and "weba" maps to "audio/webm" per: https://chromium.googlesource.com/chromium/src.git/+/refs/heads/main/net/base/mime_util.cc#169 https://github.com/mozilla-firefox/firefox/blob/main/uriloader/exthandler/nsExternalHelperAppService.cpp#L485 Thanks to Sean Liao for the above references. Fixes #77701 Change-Id: I0e706c398aafc314034d7e1eccba9b37b8da00b2 Reviewed-on: https://go-review.googlesource.com/c/go/+/747340 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Emmanuel Odeke <emmanuel@orijtech.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Mark Freeman <markfreeman@google.com>
2025-11-20mime: add missing path for mime types in godocTaichi Maeda
ExtensionsByType was missing godoc for a mime.types file path that was added in CL 236677. Change-Id: Ia04fa90f01490fc1f063c4905aea65d240935cab Reviewed-on: https://go-review.googlesource.com/c/go/+/721580 Reviewed-by: Mark Freeman <markfreeman@google.com> Reviewed-by: Junyang Shao <shaojunyang@google.com> Reviewed-by: Sean Liao <sean@liao.dev> Auto-Submit: Sean Liao <sean@liao.dev> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-11-12mime: parse media types that contain bracesJulien Cretel
This CL fixes a bug introduced by CL 666655: isTokenChar would no longer (but should) report true for '{' and '}'. Fixes #76236 Change-Id: Ifc0953c30d7cae7bfba9bc4b6bb6951a83c52576 GitHub-Last-Rev: c91a75c2c8778a9a8343c6bb4fa89eb1f978059f GitHub-Pull-Request: golang/go#76243 Reviewed-on: https://go-review.googlesource.com/c/go/+/719380 Reviewed-by: Sean Liao <sean@liao.dev> Reviewed-by: Jorropo <jorropo.pgm@gmail.com> Reviewed-by: Michael Knyszek <mknyszek@google.com> Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-09-30mime: reduce allocs incurred by ParseMediaTypeJulien Cretel
This change is mostly gardening. It simplifies ParseMediaType and its helper functions and reduces the amount of allocations they incur. Here are some benchmark results: goos: darwin goarch: amd64 pkg: mime cpu: Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz │ old │ new │ │ sec/op │ sec/op vs base │ ParseMediaType-8 55.26µ ± 1% 54.54µ ± 1% -1.30% (p=0.000 n=20) ParseMediaTypeBogus-8 3.551µ ± 0% 3.427µ ± 0% -3.48% (p=0.000 n=20) geomean 14.01µ 13.67µ -2.39% │ old │ new │ │ B/op │ B/op vs base │ ParseMediaType-8 38.48Ki ± 0% 37.38Ki ± 0% -2.85% (p=0.000 n=20) ParseMediaTypeBogus-8 2.531Ki ± 0% 2.469Ki ± 0% -2.47% (p=0.000 n=20) geomean 9.869Ki 9.606Ki -2.66% │ old │ new │ │ allocs/op │ allocs/op vs base │ ParseMediaType-8 457.0 ± 0% 425.0 ± 0% -7.00% (p=0.000 n=20) ParseMediaTypeBogus-8 25.00 ± 0% 21.00 ± 0% -16.00% (p=0.000 n=20) geomean 106.9 94.47 -11.62% Change-Id: I51198b40396afa51531794a57c50aa88975eae1d GitHub-Last-Rev: c44e2a2577386d1d776498d29e31821326e20b92 GitHub-Pull-Request: golang/go#75565 Reviewed-on: https://go-review.googlesource.com/c/go/+/705715 Reviewed-by: Emmanuel Odeke <emmanuel@orijtech.com> Reviewed-by: Carlos Amedee <carlos@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Sean Liao <sean@liao.dev> Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Emmanuel Odeke <emmanuel@orijtech.com>
2025-09-30mime: extend "builtinTypes" to include a more complete list of common typesAidan Welch
Implement all agreed upon types, using IANA's listed media types to decide when there is a disagreement in type. Except in the case of `.wav` where `audio/wav` is used. Fixes #69530 Change-Id: Iec99a6ceb534073be83c8390f48799bec3e4cfc7 GitHub-Last-Rev: e314c5ec6d9aba753dca5f6dbb9d1741bac43227 GitHub-Pull-Request: golang/go#69533 Reviewed-on: https://go-review.googlesource.com/c/go/+/614376 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Emmanuel Odeke <emmanuel@orijtech.com> Auto-Submit: Sean Liao <sean@liao.dev> Reviewed-by: Sean Liao <sean@liao.dev> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Carlos Amedee <carlos@golang.org>
2025-09-26mime/multipart: percent-encode CR and LF in header values to avoid CRLF ↵Damien Neil
injection When provided with a field or file name containing newlines, multipart.FileContentDisposition and other header-producing functions could create an invalid header value. In some scenarios, this could permit a malicious input to perform a CRLF injection attack: field := "field" evilFile := "name\"\r\nEvil-Header: \"evil" fmt.Printf("Content-Disposition: %v\r\n", multipart.FileContentDisposition(field, evilFile)) // Prints: // Content-Disposition: form-data; name="field"; filename="name" // Evil-Header: "evil" Percent-endode \r and \n characters in headers, as recommended by https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart/form-data-encoding-algorithm The above algorithm also recommends using percent-encoding for quotes, but preserve the existing backslash-escape behavior for now. Empirically, browsers understand backslash-escape in attribute values. Fixes #75557 Change-Id: Ia203df6ef45a098070f3ebb17f9b6cf80c520ed4 Reviewed-on: https://go-review.googlesource.com/c/go/+/706677 Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <nsh@golang.org> Reviewed-by: Nicholas Husin <husin@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-04-26mime: speed up ParseMediaTypeJulien Cretel
Add benchmarks for ParseMediaType. Eschew UTF-8 decoding and strings.IndexFunc where possible, and rely on 128-bit bitmaps instead. Eliminate some bounds checks. Some benchmark results (no changes to allocations): goos: darwin goarch: amd64 pkg: mime cpu: Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz │ old │ new │ │ sec/op │ sec/op vs base │ ParseMediaType-8 71.75µ ± 0% 55.53µ ± 0% -22.60% (p=0.000 n=20) ParseMediaTypeBogus-8 5.330µ ± 0% 3.603µ ± 0% -32.41% (p=0.000 n=20) geomean 19.56µ 14.14µ -27.67% Change-Id: I324c9990fe43581484916ecff61ca6c708467a89 GitHub-Last-Rev: e2293d64b3852722bef920169eaa44e7ded3111c GitHub-Pull-Request: golang/go#73436 Reviewed-on: https://go-review.googlesource.com/c/go/+/666655 Reviewed-by: Jorropo <jorropo.pgm@gmail.com> Reviewed-by: Junyang Shao <shaojunyang@google.com> Reviewed-by: Sean Liao <sean@liao.dev> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Sean Liao <sean@liao.dev>
2025-03-12mime/multipart: add helper to build content-disposition header contentsLuca Maltagliati
This PR adds an helper FileContentDisposition that builds multipart Content-Disposition header contents with field name and file name, escaping quotes and escape characters. The function is then called in the related helper CreateFormFile. The new function allows users to add other custom MIMEHeaders, without having to rewrite the char escaping logic of field name and file name, which is provided by the new helper. Fixes #46771 Change-Id: Ifc82a79583feb6dd609ca1e6024e612fb58c05ce GitHub-Last-Rev: 969f846fa967d2b3eca7a21ee096b299b8a94546 GitHub-Pull-Request: golang/go#63324 Reviewed-on: https://go-review.googlesource.com/c/go/+/531995 Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com>
2025-03-04mime/quotedprintable: accept LWSP-char after =Simon Ser
SP and HTAB are allowed after a = before the following CRLF. RFC 2045 section 6.7 describes the ABNF for the quoted-printable encoding: qp-line := *(qp-segment transport-padding CRLF) qp-part transport-padding qp-segment := qp-section *(SPACE / TAB) "=" transport-padding := *LWSP-char ; Composers MUST NOT generate ; non-zero length transport ; padding, but receivers MUST ; be able to handle padding ; added by message transports. RFC 822 defines LWSP-char as: LWSP-char = SPACE / HTAB Dovecot's imaptest contains such a message in src/tests/fetch-binary-mime-qp.mbox. Fixes #70952 Change-Id: Ie05921088d7e4d6c92c4bf79b0f4a13586230753 GitHub-Last-Rev: e6e6eee8ebc2f629644a1d99129fb57cce58058f GitHub-Pull-Request: golang/go#70951 Reviewed-on: https://go-review.googlesource.com/c/go/+/638276 Reviewed-by: Sean Liao <sean@liao.dev> Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: David Chase <drchase@google.com> Auto-Submit: Sean Liao <sean@liao.dev>
2024-11-19mime: disable TestLookupMallocs with ASANMichael Anthony Knyszek
With the synchashtriemap GOEXPERIMENT, this allocates now, but just under ASAN. That's OK, just skip the test under ASAN. Fixes #70428. Change-Id: I1ab4f7c06505c84309946358643715085f0db506 Reviewed-on: https://go-review.googlesource.com/c/go/+/629456 Reviewed-by: Cherry Mui <cherryyz@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Michael Knyszek <mknyszek@google.com>
2024-10-02all: use slices.Sorted(maps.Keys(m))Tobias Klauser
Use slices.Sorted(maps.Keys(m)) to get a sorted slices of the keys in a map. Do not change packages built during bootstrap, as the bootstrap compiler (currently 1.22.6) does not have the required maps and slices functions. Change-Id: Ie35565d241fa14aca56b730a69af010127b659ab Reviewed-on: https://go-review.googlesource.com/c/go/+/617356 Reviewed-by: Ian Lance Taylor <iant@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Michael Knyszek <mknyszek@google.com> Auto-Submit: Tobias Klauser <tobias.klauser@gmail.com>
2024-08-03mime: add available godoc linkpgxiaolianzi
Change-Id: Ic5454758c87e9f84a829aed8a72b5ad977878585 GitHub-Last-Rev: 2eb8ced71286a3bc3b53b35c809164b07ef28a16 GitHub-Pull-Request: golang/go#68605 Reviewed-on: https://go-review.googlesource.com/c/go/+/601295 Auto-Submit: Ian Lance Taylor <iant@google.com> Reviewed-by: Michael Knyszek <mknyszek@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2024-07-25go,internal,io,mime: use slices and maps to clean testsapocelipes
Replace reflect.DeepEqual with slices.Equal/maps.Equal, which is much faster. Change-Id: Id9cb550884da817da96befdeccfecb3325fb4414 GitHub-Last-Rev: 7d64d78feb86e3ea1af6c24ea6782cb85731bb52 GitHub-Pull-Request: golang/go#67612 Reviewed-on: https://go-review.googlesource.com/c/go/+/587819 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com>
2024-05-29all: document legacy //go:linkname for final round of modulesRuss Cox
Add linknames for most modules with ≥50 dependents. Add linknames for a few other modules that we know are important but are below 50. Remove linknames from badlinkname.go that do not merit inclusion (very small number of dependents). We can add them back later if the need arises. Fixes #67401. (For now.) Change-Id: I1e49fec0292265256044d64b1841d366c4106002 Reviewed-on: https://go-review.googlesource.com/c/go/+/587756 Auto-Submit: Russ Cox <rsc@golang.org> TryBot-Bypass: Russ Cox <rsc@golang.org> Reviewed-by: Cherry Mui <cherryyz@google.com>
2024-05-23all: change from sort functions to slices functions where feasibleIan Lance Taylor
Doing this because the slices functions are slightly faster and slightly easier to use. It also removes one dependency layer. This CL does not change packages that are used during bootstrap, as the bootstrap compiler does not have the required slices functions. It does not change the go/scanner package because the ErrorList Len, Swap, and Less methods are part of the Go 1 API. Change-Id: If52899be791c829198e11d2408727720b91ebe8a Reviewed-on: https://go-review.googlesource.com/c/go/+/587655 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com> Commit-Queue: Ian Lance Taylor <iant@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2024-05-17all: add push linknames to allow legacy pull linknamesCherry Mui
CL 585358 adds restrictions to disallow pull-only linknames (currently off by default). Currently, there are quite some pull- only linknames in user code in the wild. In order not to break those, we add push linknames to allow them to be pulled. This CL includes linknames found in a large code corpus (thanks Matthew Dempsky and Michael Pratt for the analysis!), that are not currently linknamed. Updates #67401. Change-Id: I32f5fc0c7a6abbd7a11359a025cfa2bf458fe767 Reviewed-on: https://go-review.googlesource.com/c/go/+/586137 Reviewed-by: Russ Cox <rsc@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2024-04-26all: make use of sync.Map.ClearJes Cok
Since CL 515015 added sync.Map.Clear method, we can use it to make the code simpler and clearer. Change-Id: I29edc969431b4fd95cd5fd864953a71ca1538dd3 Reviewed-on: https://go-review.googlesource.com/c/go/+/582015 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Ian Lance Taylor <iant@golang.org> Reviewed-by: Joedian Reid <joedian@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2024-03-21mime: add available godoc linkcui fliter
Change-Id: I66ec9edc71f4c1207135e4248003a7457e456931 Reviewed-on: https://go-review.googlesource.com/c/go/+/539576 Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: David Chase <drchase@google.com> Run-TryBot: shuang cui <imcusg@gmail.com>
2024-03-09internal/godebugs: test for use of IncNonDefaultRuss Cox
A few recent godebugs are missing IncNonDefault uses. Test for that, so that people remember to do it. Filed bugs for the missing ones. For #66215. For #66216. For #66217. Change-Id: Ia3fd10fd108e1b003bb30a8bc2f83995c768fab6 Reviewed-on: https://go-review.googlesource.com/c/go/+/570275 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com>
2024-03-05net/textproto, mime/multipart: avoid unbounded read in MIME headerDamien Neil
mime/multipart.Reader.ReadForm allows specifying the maximum amount of memory that will be consumed by the form. While this limit is correctly applied to the parsed form data structure, it was not being applied to individual header lines in a form. For example, when presented with a form containing a header line that never ends, ReadForm will continue to read the line until it runs out of memory. Limit the amount of data consumed when reading a header. Fixes CVE-2023-45290 Fixes #65383 Change-Id: I7f9264d25752009e95f6b2c80e3d76aaf321d658 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2134435 Reviewed-by: Roland Shoemaker <bracewell@google.com> Reviewed-by: Tatiana Bradley <tatianabradley@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/569341 Reviewed-by: Carlos Amedee <carlos@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Michael Knyszek <mknyszek@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-06-14all: fix spelling errorsAlexander Yastrebov
Fix spelling errors discovered using https://github.com/codespell-project/codespell. Errors in data files and vendored packages are ignored. Change-Id: I83c7818222f2eea69afbd270c15b7897678131dc GitHub-Last-Rev: 3491615b1b82832cc0064f535786546e89aa6184 GitHub-Pull-Request: golang/go#60758 Reviewed-on: https://go-review.googlesource.com/c/go/+/502576 Auto-Submit: Michael Pratt <mpratt@google.com> Run-TryBot: Michael Pratt <mpratt@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Michael Pratt <mpratt@google.com>
2023-04-18cmd/go: add check for unknown godebug settingRuss Cox
A //go:debug line mentioning an unknown or retired setting should be diagnosed as making the program invalid. Do that. We agreed on this in the proposal but I forgot to implement it. Change-Id: Ie69072a1682d4eeb6866c02adbbb426f608567c4 Reviewed-on: https://go-review.googlesource.com/c/go/+/476280 Run-TryBot: Russ Cox <rsc@golang.org> Reviewed-by: Bryan Mills <bcmills@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-04-11all: add wasip1 supportJohan Brandhorst-Satzkorn
Fixes #58141 Co-authored-by: Richard Musiol <neelance@gmail.com> Co-authored-by: Achille Roussel <achille.roussel@gmail.com> Co-authored-by: Julien Fabre <ju.pryz@gmail.com> Co-authored-by: Evan Phoenix <evan@phx.io> Change-Id: I49b66946acc90fdf09ed9223096bfec9a1e5b923 Reviewed-on: https://go-review.googlesource.com/c/go/+/479627 Run-TryBot: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com> Reviewed-by: Cherry Mui <cherryyz@google.com> Auto-Submit: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com> Auto-Submit: Ian Lance Taylor <iant@golang.org> Reviewed-by: Ian Lance Taylor <iant@google.com> TryBot-Bypass: Ian Lance Taylor <iant@golang.org>
2023-04-05html/template,mime/multipart: document new GODEBUG settingsMichael Anthony Knyszek
This change documents the new GODEBUG settings introduced for html/template and mime/multipart, released with Go 1.19.8 and Go 1.20.3 as part of a security fix. Updates #59153. Updates #59234. Change-Id: I25f4d8245da3301dccccfb44da8ff1a5985392a4 Reviewed-on: https://go-review.googlesource.com/c/go/+/482238 Auto-Submit: Michael Knyszek <mknyszek@google.com> Reviewed-by: Ian Lance Taylor <iant@golang.org> Run-TryBot: Michael Knyszek <mknyszek@google.com> Reviewed-by: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-04-04mime/multipart: limit parsed mime message sizesDamien Neil
The parsed forms of MIME headers and multipart forms can consume substantially more memory than the size of the input data. A malicious input containing a very large number of headers or form parts can cause excessively large memory allocations. Set limits on the size of MIME data: Reader.NextPart and Reader.NextRawPart limit the the number of headers in a part to 10000. Reader.ReadForm limits the total number of headers in all FileHeaders to 10000. Both of these limits may be set with with GODEBUG=multipartmaxheaders=<values>. Reader.ReadForm limits the number of parts in a form to 1000. This limit may be set with GODEBUG=multipartmaxparts=<value>. Thanks for Jakob Ackermann (@das7pad) for reporting this issue. For CVE-2023-24536 For #59153 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1802455 Run-TryBot: Damien Neil <dneil@google.com> Reviewed-by: Roland Shoemaker <bracewell@google.com> Reviewed-by: Julie Qiu <julieqiu@google.com> Change-Id: I08dd297bd75724aade4b0bd6a7d19aeca5bbf99f Reviewed-on: https://go-review.googlesource.com/c/go/+/482077 Run-TryBot: Michael Knyszek <mknyszek@google.com> Auto-Submit: Michael Knyszek <mknyszek@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Matthew Dempsky <mdempsky@google.com>
2023-04-04net/textproto, mime/multipart: improve accounting of non-file dataDamien Neil
For requests containing large numbers of small parts, memory consumption of a parsed form could be about 250% over the estimated size. When considering the size of parsed forms, account for the size of FileHeader structs and increase the estimate of memory consumed by map entries. Thanks to Jakob Ackermann (@das7pad) for reporting this issue. For CVE-2023-24536 For #59153 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1802454 Run-TryBot: Damien Neil <dneil@google.com> Reviewed-by: Roland Shoemaker <bracewell@google.com> Reviewed-by: Julie Qiu <julieqiu@google.com> Change-Id: I9620758495ed77c09ca6dc5db4b723c29f3baad8 Reviewed-on: https://go-review.googlesource.com/c/go/+/482076 TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Michael Knyszek <mknyszek@google.com> Run-TryBot: Michael Knyszek <mknyszek@google.com> Reviewed-by: Matthew Dempsky <mdempsky@google.com>
2023-04-04mime/multipart: avoid excessive copy buffer allocations in ReadFormDamien Neil
When copying form data to disk with io.Copy, allocate only one copy buffer and reuse it rather than creating two buffers per file (one from io.multiReader.WriteTo, and a second one from os.File.ReadFrom). Thanks to Jakob Ackermann (@das7pad) for reporting this issue. For CVE-2023-24536 For #59153 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1802453 Run-TryBot: Damien Neil <dneil@google.com> Reviewed-by: Julie Qiu <julieqiu@google.com> Reviewed-by: Roland Shoemaker <bracewell@google.com> Change-Id: I732bd2e1e7467918cac8ab9d65d089272ba4656f Reviewed-on: https://go-review.googlesource.com/c/go/+/482075 Auto-Submit: Michael Knyszek <mknyszek@google.com> Reviewed-by: Matthew Dempsky <mdempsky@google.com> TryBot-Bypass: Michael Knyszek <mknyszek@google.com> Run-TryBot: Michael Knyszek <mknyszek@google.com>
2023-02-28mime/multipart: fix Reader.ReadForm(math.MaxInt64) overflowhopehook
Because "CopyN" will read one more byte, which will cause us to overflow when calling "Reader.ReadForm(math.MaxInt64)". So we should check if the parameter exceeds "math.MaxInt64" to avoid returning no data. Fixes #58384. Change-Id: I30088ce6468176b21e4a9a0b8b6080f2986dda23 Reviewed-on: https://go-review.googlesource.com/c/go/+/467557 TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Ian Lance Taylor <iant@golang.org> Run-TryBot: hopehook <hopehook@golangcn.org> Run-TryBot: Ian Lance Taylor <iant@golang.org> Reviewed-by: Bryan Mills <bcmills@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com>
2023-02-14mime/multipart: limit memory/inode consumption of ReadFormDamien Neil
Reader.ReadForm is documented as storing "up to maxMemory bytes + 10MB" in memory. Parsed forms can consume substantially more memory than this limit, since ReadForm does not account for map entry overhead and MIME headers. In addition, while the amount of disk memory consumed by ReadForm can be constrained by limiting the size of the parsed input, ReadForm will create one temporary file per form part stored on disk, potentially consuming a large number of inodes. Update ReadForm's memory accounting to include part names, MIME headers, and map entry overhead. Update ReadForm to store all on-disk file parts in a single temporary file. Files returned by FileHeader.Open are documented as having a concrete type of *os.File when a file is stored on disk. The change to use a single temporary file for all parts means that this is no longer the case when a form contains more than a single file part stored on disk. The previous behavior of storing each file part in a separate disk file may be reenabled with GODEBUG=multipartfiles=distinct. Update Reader.NextPart and Reader.NextRawPart to set a 10MiB cap on the size of MIME headers. Thanks to Jakob Ackermann (@das7pad) for reporting this issue. Fixes #58006 Fixes CVE-2022-41725 Change-Id: Ibd780a6c4c83ac8bcfd3cbe344f042e9940f2eab Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1714276 Reviewed-by: Julie Qiu <julieqiu@google.com> TryBot-Result: Security TryBots <security-trybots@go-security-trybots.iam.gserviceaccount.com> Reviewed-by: Roland Shoemaker <bracewell@google.com> Run-TryBot: Damien Neil <dneil@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/468124 Auto-Submit: Michael Pratt <mpratt@google.com> Run-TryBot: Michael Pratt <mpratt@google.com> Reviewed-by: Than McIntosh <thanm@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-09-20mime/multipart: use %w when wrapping error in NextPartthinkofher
Use "%w" instead of "%v" as format verb for error value in the NextPart method. This way it will be possible to use common go error utilities from std library when parsing from custom io.Readers. This issue was discovered during attempts to use http.Request.ParseMultipartForm together with http.MaxBytesHandler. Change-Id: Idb82510fb536b66b51ed1d943737c4828f07c2f2 GitHub-Last-Rev: 8bc49c945c1b393bcfb4d8df545c93593c9bd7c4 GitHub-Pull-Request: golang/go#55133 Reviewed-on: https://go-review.googlesource.com/c/go/+/431675 Run-TryBot: Ian Lance Taylor <iant@google.com> Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Ian Lance Taylor <iant@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2022-09-06mime: use strings.Buildercuiweixie
Change-Id: I2756fab046154a2df49435ba1978a32176de830a Reviewed-on: https://go-review.googlesource.com/c/go/+/428265 Reviewed-by: Ian Lance Taylor <iant@google.com> Run-TryBot: xie cui <523516579@qq.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Robert Griesemer <gri@google.com>
2022-08-26mime: allow duplicate media type parameters with equivalent valuesPaschalis Tsilias
Fixes #48866 Change-Id: I2bd2c806e44eb4064b1fb9a6509d79cecbbef013 Reviewed-on: https://go-review.googlesource.com/c/go/+/363094 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Tim King <taking@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Damien Neil <dneil@google.com> Reviewed-by: David Chase <drchase@google.com>
2022-08-08mime: remove test ordering dependencyIan Lance Taylor
Arrange for tests that call setMimeInit to fully restore the old values, by clearing the sync.Once that controls initialization. Once we've done that, call initMime in initMimeUnixTest because otherwise the test types loaded there will be cleared by the call to initMime that previously was not being done. For golang/go#51648 Change-Id: I8bf92b305fc4499337db06113817c9decdc5aedb Reviewed-on: https://go-review.googlesource.com/c/go/+/421442 Reviewed-by: Than McIntosh <thanm@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Ian Lance Taylor <iant@golang.org> Reviewed-by: Ian Lance Taylor <iant@google.com> Run-TryBot: Ian Lance Taylor <iant@google.com>
2022-05-28mime: ignore .js => text/plain in Windows registryIan Lance Taylor
This seems to be a common registry misconfiguration on Windows. Fixes #32350 Change-Id: I68c617c42a6e72948e2acdf335ff8e7df569432d Reviewed-on: https://go-review.googlesource.com/c/go/+/406894 Reviewed-by: Michael Knyszek <mknyszek@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Ian Lance Taylor <iant@golang.org> Reviewed-by: Damien Neil <dneil@google.com>
2022-05-13mime: skip globs2 entries that are not simple file extensionsVille Skyttä
The entries in globs2 can be globs beyond simple *.ext ones. We support only simple extension based matching, so skip entries that do not represent them. Change-Id: Id5d089cb4067e53beb2471a5e67a59c13880a017 GitHub-Last-Rev: f725a910547ec52d12605760563f158dfb72e4b0 GitHub-Pull-Request: golang/go#51156 Reviewed-on: https://go-review.googlesource.com/c/go/+/385256 Run-TryBot: Ian Lance Taylor <iant@golang.org> Reviewed-by: Ian Lance Taylor <iant@google.com> Run-TryBot: Ian Lance Taylor <iant@google.com> Reviewed-by: Heschi Kreinick <heschi@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Ian Lance Taylor <iant@google.com>
2022-04-15mime: ignore non-extension globs2 entriesVille Skyttä
Change-Id: Ic2315b593dca5648c02f793b7650b5936a997bff GitHub-Last-Rev: ee55edcf087416c6f0d50d5dd51cbddfd1d77620 GitHub-Pull-Request: golang/go#51226 Reviewed-on: https://go-review.googlesource.com/c/go/+/386334 Reviewed-by: Damien Neil <dneil@google.com> Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2022-04-11all: gofmt main repoRuss Cox
[This CL is part of a sequence implementing the proposal #51082. The design doc is at https://go.dev/s/godocfmt-design.] Run the updated gofmt, which reformats doc comments, on the main repository. Vendored files are excluded. For #51082. Change-Id: I7332f099b60f716295fb34719c98c04eb1a85407 Reviewed-on: https://go-review.googlesource.com/c/go/+/384268 Reviewed-by: Jonathan Amsterdam <jba@google.com> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2022-04-01mime/multipart: allow nested boundary with outer boundary+dash prefixOlivier Szika
Fixes #46042 Change-Id: Icd243eb12c6e260aeead04710f12340048a0e859 Reviewed-on: https://go-review.googlesource.com/c/go/+/338549 Trust: Damien Neil <dneil@google.com> Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Trust: Cherry Mui <cherryyz@google.com> Reviewed-by: Robert Griesemer <gri@golang.org>
2022-03-31mime/multipart: unified Part and Reader receiver nameWayne Zuo
Change-Id: Ic36dd232f3ea049403715fadec00a74efbf7dc9e Reviewed-on: https://go-review.googlesource.com/c/go/+/394075 Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Trust: Damien Neil <dneil@google.com>
2022-03-29all: use new "unix" build tag where appropriateIan Lance Taylor
For #20322 For #51572 Change-Id: Id0b4799d097d01128e98ba4cc0092298357bca45 Reviewed-on: https://go-review.googlesource.com/c/go/+/389935 Trust: Ian Lance Taylor <iant@golang.org> Reviewed-by: Tobias Klauser <tobias.klauser@gmail.com>
2021-12-13all: gofmt -w -r 'interface{} -> any' srcRuss Cox
And then revert the bootstrap cmd directories and certain testdata. And adjust tests as needed. Not reverting the changes in std that are bootstrapped, because some of those changes would appear in API docs, and we want to use any consistently. Instead, rewrite 'any' to 'interface{}' in cmd/dist for those directories when preparing the bootstrap copy. A few files changed as a result of running gofmt -w not because of interface{} -> any but because they hadn't been updated for the new //go:build lines. Fixes #49884. Change-Id: Ie8045cba995f65bd79c694ec77a1b3d1fe01bb09 Reviewed-on: https://go-review.googlesource.com/c/go/+/368254 Trust: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> Reviewed-by: Robert Griesemer <gri@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2021-11-09mime: keep parsing after trailing semicolonIllirgway
Fixes #46323 Change-Id: Ibd624b1aaa15f907b7eb965b4eaec61018a45486 GitHub-Last-Rev: 7ad670b088144a2a09860dd990c53dea75c0d40f GitHub-Pull-Request: golang/go#47029 Reviewed-on: https://go-review.googlesource.com/c/go/+/332509 Trust: Ian Lance Taylor <iant@golang.org> Trust: Damien Neil <dneil@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2021-10-28all: go fix -fix=buildtag std cmd (except for bootstrap deps, vendor)Russ Cox
When these packages are released as part of Go 1.18, Go 1.16 will no longer be supported, so we can remove the +build tags in these files. Ran go fix -fix=buildtag std cmd and then reverted the bootstrapDirs as defined in src/cmd/dist/buildtool.go, which need to continue to build with Go 1.4 for now. Also reverted src/vendor and src/cmd/vendor, which will need to be updated in their own repos first. Manual changes in runtime/pprof/mprof_test.go to adjust line numbers. For #41184. Change-Id: Ic0f93f7091295b6abc76ed5cd6e6746e1280861e Reviewed-on: https://go-review.googlesource.com/c/go/+/344955 Trust: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Bryan C. Mills <bcmills@google.com>
2021-10-06all: use bytes.Cut, strings.CutRuss Cox
Many uses of Index/IndexByte/IndexRune/Split/SplitN can be written more clearly using the new Cut functions. Do that. Also rewrite to other functions if that's clearer. For #46336. Change-Id: I68d024716ace41a57a8bf74455c62279bde0f448 Reviewed-on: https://go-review.googlesource.com/c/go/+/351711 Trust: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2021-05-26mime: document use of the Shared MIME-Info DatabaseDamien Neil
For #44513. Fixes #46013. Change-Id: I382603208aa94b66d5220cf0f418b8528a4e4148 Reviewed-on: https://go-review.googlesource.com/c/go/+/322892 Trust: Damien Neil <dneil@google.com> Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2021-05-05net/http: ignore directory path when parsing multipart formsKatie Hockman
Fixes #45789 Change-Id: Id588f5dbbecf5fbfb54e957c53903aaa900171f2 Reviewed-on: https://go-review.googlesource.com/c/go/+/313809 Trust: Katie Hockman <katie@golang.org> Run-TryBot: Katie Hockman <katie@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org>
2021-04-15mime: keep builtinTypesLower sorted alphabeticallyTobias Klauser
Updates #44602 Change-Id: I2c32e388143e56928850821587f57d9729434220 Reviewed-on: https://go-review.googlesource.com/c/go/+/310034 Trust: Tobias Klauser <tobias.klauser@gmail.com> Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com> Reviewed-by: Emmanuel Odeke <emmanuel@orijtech.com> TryBot-Result: Go Bot <gobot@golang.org>
2021-04-14mime: add mime type for avif image file formatAmit Kumar
Fixes #44602 Change-Id: I28b6df5e2523fc2ece6fd8251fcabc83c7c38d89 Reviewed-on: https://go-review.googlesource.com/c/go/+/256478 Trust: Ian Lance Taylor <iant@golang.org> Trust: Michael Knyszek <mknyszek@google.com> Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
generated by cgit v1.3 (git 2.53.0) at 2026-04-16 05:41:50 +0000