aboutsummaryrefslogtreecommitdiff
path: root/src/net/http/cgi
AgeCommit message (Collapse)Author
2025-11-13net/http/cgi: accept INCLUDED as protocol for server side includesPeter Beard
The existing protocol check for fcgi/cgi requests did not properly account for Apache SSI (Server-Side Includes) SERVER_PROTOCOL value of INCLUDED. Added check for well-known INCLUDED value for proper implementation of the CGI Spec as specified in RFC 3875 - section 4.1.16. The SERVER_PROTOCOL section of the specification is outlined at https://www.rfc-editor.org/rfc/rfc3875.html#section-4.1.16 Fixes #70416 Change-Id: I129e606147e16d1daefb49ed6c13a561a88ddeb6 Reviewed-on: https://go-review.googlesource.com/c/go/+/715680 Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Junyang Shao <shaojunyang@google.com> Reviewed-by: Sean Liao <sean@liao.dev> Auto-Submit: Sean Liao <sean@liao.dev>
2024-10-02all: use slices.Sorted(maps.Keys(m))Tobias Klauser
Use slices.Sorted(maps.Keys(m)) to get a sorted slices of the keys in a map. Do not change packages built during bootstrap, as the bootstrap compiler (currently 1.22.6) does not have the required maps and slices functions. Change-Id: Ie35565d241fa14aca56b730a69af010127b659ab Reviewed-on: https://go-review.googlesource.com/c/go/+/617356 Reviewed-by: Ian Lance Taylor <iant@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Michael Knyszek <mknyszek@google.com> Auto-Submit: Tobias Klauser <tobias.klauser@gmail.com>
2024-07-25net: use slices and maps to clean up testsapocelipes
Replace reflect.DeepEqual with slices.Equal/maps.Equal, which is much faster. Change-Id: I54600fb63a56460c11d3d5af9072da585e31b1a2 GitHub-Last-Rev: 08c1445ad5be94d071e8ceb4b060b8f4ab0d77ba GitHub-Pull-Request: golang/go#67606 Reviewed-on: https://go-review.googlesource.com/c/go/+/587816 Reviewed-by: Ian Lance Taylor <iant@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Ian Lance Taylor <iant@google.com>
2024-05-23all: change from sort functions to slices functions where feasibleIan Lance Taylor
Doing this because the slices functions are slightly faster and slightly easier to use. It also removes one dependency layer. This CL does not change packages that are used during bootstrap, as the bootstrap compiler does not have the required slices functions. It does not change the go/scanner package because the ErrorList Len, Swap, and Less methods are part of the Go 1 API. Change-Id: If52899be791c829198e11d2408727720b91ebe8a Reviewed-on: https://go-review.googlesource.com/c/go/+/587655 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com> Commit-Queue: Ian Lance Taylor <iant@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2024-03-07all: remove redundant string conversions when formatting []byte with %scui fliter
Change-Id: I1285ee047fd465f48028186ae04d4de60cc9969e Reviewed-on: https://go-review.googlesource.com/c/go/+/569715 Reviewed-by: Ian Lance Taylor <iant@google.com> Run-TryBot: shuang cui <imcusg@gmail.com> Reviewed-by: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Ian Lance Taylor <iant@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2024-03-04net/http/cgi: close res.Bodyguoguangwu
Change-Id: I4682442f4f9f3d112b78582c3b9fc2d24c2d58a7 GitHub-Last-Rev: 0823701905b8facdde7204aa6d90df6facd6dc51 GitHub-Pull-Request: golang/go#66049 Reviewed-on: https://go-review.googlesource.com/c/go/+/568316 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Michael Knyszek <mknyszek@google.com> Auto-Submit: Damien Neil <dneil@google.com>
2024-01-10net: add available godoc linkcui fliter
Change-Id: Ib7c4baf0247c421954aedabfbb6a6af8a08a8936 Reviewed-on: https://go-review.googlesource.com/c/go/+/540021 Reviewed-by: Damien Neil <dneil@google.com> Run-TryBot: shuang cui <imcusg@gmail.com> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2024-01-04net/http/cgi: in TestCopyError, check for a Handler.ServeHTTP goroutine ↵Bryan C. Mills
instead of a running PID Previously, the test could fail spuriously if the CGI process's PID happened to be reused in between checks. That sort of reuse is highly unlikely on platforms that cycle through the PID space sequentially (such as Linux), but plausible on platforms that use randomized PIDs (such as OpenBSD). Also unskip the test on Windows, since it no longer relies on being able to send signal 0 to an arbitrary PID. Also change the expected failure mode of the test to a timeout instead of a call to t.Fatalf, so that on failure we get a useful goroutine dump for debugging instead of a non-actionable failure message. Fixes #57369 (maybe). Change-Id: Ib7e3fff556450b48cb5e6ea120fdf4d53547479b Reviewed-on: https://go-review.googlesource.com/c/go/+/554075 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Bryan Mills <bcmills@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2023-11-07net/http/cgi: eliminate use of Perl in testsaimuz
Previously, a Perl script was used to test the net/http/cgi package. This sometimes led to hidden failures as these tests were not run on builders without Perl. Also, this approach posed maintenance difficulties for those unfamiliar with Perl. We have now replaced Perl-based tests with a Go handler to simplify maintenance and ensure consistent testing environments. It's part of our ongoing effort to reduce reliance on Perl throughout the Go codebase (see #20032,#25586,#25669,#27779), thus improving reliability and ease of maintenance. Fixes #63800 Fixes #63828 Change-Id: I8d554af93d4070036cf0cc3aaa9c9b256affbd17 GitHub-Last-Rev: a8034083d824da7d68e5995a7997a1199d78de15 GitHub-Pull-Request: golang/go#63869 Reviewed-on: https://go-review.googlesource.com/c/go/+/538861 Reviewed-by: Bryan Mills <bcmills@google.com> Run-TryBot: qiulaidongfeng <2645477756@qq.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Bryan Mills <bcmills@google.com> Commit-Queue: Bryan Mills <bcmills@google.com>
2023-11-06net/http/cgi: the PATH_INFO should be empty or start with a slashaimuz
fixed PATH_INFO not starting with a slash as described in RFC 3875 for PATH_INFO. Fixes #63925 Change-Id: I1ead98dff190c53eb7a50546569ef6ded3199a0a GitHub-Last-Rev: 1c532e330b0d74ee42afc412611a005bc565bb26 GitHub-Pull-Request: golang/go#63926 Reviewed-on: https://go-review.googlesource.com/c/go/+/539615 Reviewed-by: Bryan Mills <bcmills@google.com> Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-10-04net/http/cgi: set SERVER_PORT to 443 when req.TLS != niledef
A hostname without a port leaves the port implied by the protocol. For HTTPS, the implied port is 443, not 80. Change-Id: I873a076068f84c8041abf10a435d9499635730a0 Reviewed-on: https://go-review.googlesource.com/c/go/+/454975 Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-09-05all: use ^TestName$ regular pattern for invoking a single testDmitri Shuralyov
Use ^ and $ in the -run flag regular expression value when the intention is to invoke a single named test. This removes the reliance on there not being another similarly named test to achieve the intended result. In particular, package syscall has tests named TestUnshareMountNameSpace and TestUnshareMountNameSpaceChroot that both trigger themselves setting GO_WANT_HELPER_PROCESS=1 to run alternate code in a helper process. As a consequence of overlap in their test names, the former was inadvertently triggering one too many helpers. Spotted while reviewing CL 525196. Apply the same change in other places to make it easier for code readers to see that said tests aren't running extraneous tests. The unlikely cases of -run=TestSomething intentionally being used to run all tests that have the TestSomething substring in the name can be better written as -run=^.*TestSomething.*$ or with a comment so it is clear it wasn't an oversight. Change-Id: Iba208aba3998acdbf8c6708e5d23ab88938bfc1e Reviewed-on: https://go-review.googlesource.com/c/go/+/524948 Reviewed-by: Tobias Klauser <tobias.klauser@gmail.com> Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Reviewed-by: Kirill Kolyshkin <kolyshkin@gmail.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-08-26Revert "net/http/cgi: workaround for closure inlining issue"Cuong Manh Le
This reverts CL 522935. Issue #62277 is fixed, the workaround can be dropped. Updates #62277 Change-Id: I7c69e35248942b4d4fcdd81121051cca9b098980 Reviewed-on: https://go-review.googlesource.com/c/go/+/523175 Run-TryBot: Cuong Manh Le <cuong.manhle.vn@gmail.com> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Cuong Manh Le <cuong.manhle.vn@gmail.com> Reviewed-by: Matthew Dempsky <mdempsky@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2023-08-25net/http/cgi: workaround for closure inlining issueMatthew Dempsky
This is a temporary workaround for issue #62277, to get the longtest builders passing again. As mentioned on the issue, the underlying issue was present even before CL 522318; it just now affects inlined closures in initialization expressions too, not just explicit init functions. This CL can and should be reverted once that issue is fixed properly. Change-Id: I612a501e131d1b5eea648aafeb1a3a3fe8fe8c83 Reviewed-on: https://go-review.googlesource.com/c/go/+/522935 Reviewed-by: Cuong Manh Le <cuong.manhle.vn@gmail.com> Reviewed-by: Bryan Mills <bcmills@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Matthew Dempsky <mdempsky@google.com> Auto-Submit: Matthew Dempsky <mdempsky@google.com>
2023-08-22net/http: use testenv.Command instead of exec.Command in testsBryan C. Mills
On Unix platforms, testenv.Command sends SIGQUIT to stuck commands before the test times out. For subprocesses that are written in Go, that causes the runtime to dump running goroutines, and in other languages it triggers similar behavior (such as a core dump). If the subprocess is stuck due to a bug (such as #57999), that may help to diagnose it. For #57999. Change-Id: Ia2e9d14718a26001e030e162c69892497a8ebb21 Reviewed-on: https://go-review.googlesource.com/c/go/+/521816 Reviewed-by: Damien Neil <dneil@google.com> Run-TryBot: Bryan Mills <bcmills@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Bryan Mills <bcmills@google.com>
2023-04-26net/http/cgi: propagate LD_LIBRARY_PATH on AndroidBryan C. Mills
Android is functionally a variant on linux, and should be treated as such. Change-Id: I08056f00bf98c1935c8cc3c859a6c72fe1a48efa Reviewed-on: https://go-review.googlesource.com/c/go/+/489395 Run-TryBot: Bryan Mills <bcmills@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@google.com>
2022-09-29net/http: using strings.CutPrefix replace strings.HasPrefix and ↵cuiweixie
strings.TrimPrefix Change-Id: I0b7b6e4e9d2539e4fcb5c08430ba5a74733fad3c Reviewed-on: https://go-review.googlesource.com/c/go/+/435136 Reviewed-by: Ian Lance Taylor <iant@google.com> Run-TryBot: Ian Lance Taylor <iant@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com> Run-TryBot: xie cui <523516579@qq.com>
2022-09-06net/http/cgi: use strings.Buildercuiweixie
Change-Id: Ie5a8ae104970237e6e33e75cae807c436bcd08e9 Reviewed-on: https://go-review.googlesource.com/c/go/+/428268 Run-TryBot: Ian Lance Taylor <iant@google.com> Reviewed-by: Michael Knyszek <mknyszek@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-08-10net/http/cgi: remove port from the CGI environment of variable SERVER_NAMEhopehook
The SERVER_NAME variable in the CGI environment should not contain the port, according to the section 4.1.14 of the RFC 3875. Fixes #53368. Change-Id: Ifeea70206878cf83bc0bda35cb514d0226bbcd8c Reviewed-on: https://go-review.googlesource.com/c/go/+/412434 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Run-TryBot: Ian Lance Taylor <iant@golang.org> Reviewed-by: xie cui <523516579@qq.com> Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2022-04-11all: gofmt main repoRuss Cox
[This CL is part of a sequence implementing the proposal #51082. The design doc is at https://go.dev/s/godocfmt-design.] Run the updated gofmt, which reformats doc comments, on the main repository. Vendored files are excluded. For #51082. Change-Id: I7332f099b60f716295fb34719c98c04eb1a85407 Reviewed-on: https://go-review.googlesource.com/c/go/+/384268 Reviewed-by: Jonathan Amsterdam <jba@google.com> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2021-12-13all: gofmt -w -r 'interface{} -> any' srcRuss Cox
And then revert the bootstrap cmd directories and certain testdata. And adjust tests as needed. Not reverting the changes in std that are bootstrapped, because some of those changes would appear in API docs, and we want to use any consistently. Instead, rewrite 'any' to 'interface{}' in cmd/dist for those directories when preparing the bootstrap copy. A few files changed as a result of running gofmt -w not because of interface{} -> any but because they hadn't been updated for the new //go:build lines. Fixes #49884. Change-Id: Ie8045cba995f65bd79c694ec77a1b3d1fe01bb09 Reviewed-on: https://go-review.googlesource.com/c/go/+/368254 Trust: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> Reviewed-by: Robert Griesemer <gri@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2021-10-28all: go fix -fix=buildtag std cmd (except for bootstrap deps, vendor)Russ Cox
When these packages are released as part of Go 1.18, Go 1.16 will no longer be supported, so we can remove the +build tags in these files. Ran go fix -fix=buildtag std cmd and then reverted the bootstrapDirs as defined in src/cmd/dist/buildtool.go, which need to continue to build with Go 1.4 for now. Also reverted src/vendor and src/cmd/vendor, which will need to be updated in their own repos first. Manual changes in runtime/pprof/mprof_test.go to adjust line numbers. For #41184. Change-Id: Ic0f93f7091295b6abc76ed5cd6e6746e1280861e Reviewed-on: https://go-review.googlesource.com/c/go/+/344955 Trust: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Bryan C. Mills <bcmills@google.com>
2021-10-06all: use bytes.Cut, strings.CutRuss Cox
Many uses of Index/IndexByte/IndexRune/Split/SplitN can be written more clearly using the new Cut functions. Do that. Also rewrite to other functions if that's clearer. For #46336. Change-Id: I68d024716ace41a57a8bf74455c62279bde0f448 Reviewed-on: https://go-review.googlesource.com/c/go/+/351711 Trust: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2021-04-16net/http/cgi: Remove hard-coded ServeHTTP timeoutHowJMay
Close #43624 Change-Id: Ifaea3d8ec2aeabbd923abf5edd7497172dbf855a GitHub-Last-Rev: ea3ef953a1dbbb07c4554e4062571af716e9505b GitHub-Pull-Request: golang/go#43803 Reviewed-on: https://go-review.googlesource.com/c/go/+/284778 Reviewed-by: Bryan C. Mills <bcmills@google.com> Run-TryBot: Bryan C. Mills <bcmills@google.com> Trust: Robert Findley <rfindley@google.com> TryBot-Result: Go Bot <gobot@golang.org>
2021-02-20all: go fmt std cmd (but revert vendor)Russ Cox
Make all our package sources use Go 1.17 gofmt format (adding //go:build lines). Part of //go:build change (#41184). See https://golang.org/design/draft-gobuild Change-Id: Ia0534360e4957e58cd9a18429c39d0e32a6addb4 Reviewed-on: https://go-review.googlesource.com/c/go/+/294430 Trust: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Jason A. Donenfeld <Jason@zx2c4.com> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2020-10-20all: update references to symbols moved from io/ioutil to ioRuss Cox
The old ioutil references are still valid, but update our code to reflect best practices and get used to the new locations. Code compiled with the bootstrap toolchain (cmd/asm, cmd/dist, cmd/compile, debug/elf) must remain Go 1.4-compatible and is excluded. Also excluded vendored code. For #41190. Change-Id: I6d86f2bf7bc37a9d904b6cee3fe0c7af6d94d5b1 Reviewed-on: https://go-review.googlesource.com/c/go/+/263142 Trust: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com>
2020-10-20net/http/cgi: preserve env vars on illumosTobias Klauser
Preserve the same environment variables as on solaris. Spotted while reviewing CL 263577. Change-Id: Id479dcf83d6231e9ef1fd2404b400d10082e1d0b Reviewed-on: https://go-review.googlesource.com/c/go/+/263802 Trust: Tobias Klauser <tobias.klauser@gmail.com> Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com>
2020-10-20net/http/cgi: preserve LD_LIBRARY_PATH on NetBSD, tooNikhil Benesch
This makes the behavior of the cgi package on NetBSD consistent with its behavior on the other BSDs. It is also necessary for the test suite to pass on NetBSD with gccgo (see CL 261137). Change-Id: I531a6e0954f895a921204dcc61e3f3e90860a23d Reviewed-on: https://go-review.googlesource.com/c/go/+/263577 Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Benny Siegert <bsiegert@gmail.com> Reviewed-by: Tobias Klauser <tobias.klauser@gmail.com> Trust: Benny Siegert <bsiegert@gmail.com>
2020-09-23all: add GOOS=iosCherry Zhang
Introduce GOOS=ios for iOS systems. GOOS=ios matches "darwin" build tag, like GOOS=android matches "linux" and GOOS=illumos matches "solaris". Only ios/arm64 is supported (ios/amd64 is not). GOOS=ios and GOOS=darwin remain essentially the same at this point. They will diverge at later time, to differentiate macOS and iOS. Uses of GOOS=="darwin" are changed to (GOOS=="darwin" || GOOS=="ios"), except if it clearly means macOS (e.g. GOOS=="darwin" && GOARCH=="amd64"), it remains GOOS=="darwin". Updates #38485. Change-Id: I4faacdc1008f42434599efb3c3ad90763a83b67c Reviewed-on: https://go-review.googlesource.com/c/go/+/254740 Trust: Cherry Zhang <cherryyz@google.com> Run-TryBot: Cherry Zhang <cherryyz@google.com> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Austin Clements <austin@google.com>
2020-09-14net/http/cgi,net/http/fcgi: add Content-Type detectionRoberto Clapis
This CL ensures that responses served via CGI and FastCGI have a Content-Type header based on the content of the response if not explicitly set by handlers. If the implementers of the handler did not explicitly specify a Content-Type both CGI implementations would default to "text/html", potentially causing cross-site scripting. Thanks to RedTeam Pentesting GmbH for reporting this. Fixes #40928 Fixes CVE-2020-24553 Change-Id: I82cfc396309b5ab2e8d6e9a87eda8ea7e3799473 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/823217 Reviewed-by: Russ Cox <rsc@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/252179 Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Katie Hockman <katie@golang.org>
2020-09-01net/http/cgi: don't pass nil Body to the child handlerMarco
For server requests, the http.Request Body should not be nil. Fixes #39190 Change-Id: I32de7b6c0f6ca55008fea9fd86089cda0a2dea62 Reviewed-on: https://go-review.googlesource.com/c/go/+/235137 Reviewed-by: Bryan C. Mills <bcmills@google.com> Run-TryBot: Bryan C. Mills <bcmills@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2020-05-06net/http/cgi: reject invalid header namesFilippo Valsorda
Being lenient on those has caused enough security issues. Spun out of CL 231419. Fixes #38889 Change-Id: Idd3bc6adc22e08a30b3dabb146ce78d4105684cd Reviewed-on: https://go-review.googlesource.com/c/go/+/232277 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2020-05-06net/http: use ASCII space trimming throughoutFilippo Valsorda
Security hardening against HTTP request smuggling. Thank you to ZeddYu for reporting this issue. Change-Id: I98bd9f8ffe58360fc3bca9dc5d9a106773e55373 Reviewed-on: https://go-review.googlesource.com/c/go/+/231419 Reviewed-by: Katie Hockman <katie@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2020-04-30net/http/cgi: replace constant map with switch statementMatthew Dempsky
The switch statement can be statically optimized by the compiler, whereas similarly optimizing the map index expression would require additional compiler analysis to detect the map is never mutated. Updates #10848. Change-Id: I2fc70d4a34dc545677b99f218b51023c7891bbbd Reviewed-on: https://go-review.googlesource.com/c/go/+/231041 Run-TryBot: Matthew Dempsky <mdempsky@google.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2020-03-06net/http/cgi: remove outdated TODOTim Cooper
Cookies already work as http.Request parses the Cookie header on-demand when the Cookie methods are called. Change-Id: Ib7a6f68be02940ff0b56d2465c94545d6fd43847 Reviewed-on: https://go-review.googlesource.com/c/go/+/221417 Reviewed-by: Daniel Martí <mvdan@mvdan.cc> Run-TryBot: Daniel Martí <mvdan@mvdan.cc> TryBot-Result: Gobot Gobot <gobot@golang.org>
2020-01-31net/http/cgi: rename a test file to be less cuteBrad Fitzpatrick
My fault (from CL 4245070), sorry. Change-Id: Ib95d3170dc326e74aa74c22421c4e44a8b00f577 Reviewed-on: https://go-review.googlesource.com/c/go/+/214920 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com>
2019-10-02net/http/cgi: skip tests if not functional perlKyohei Kadota
TestEnvOverride sets PATH to /wibble before executing a CGI. So customized Perl that is starting with '#!/usr/bin/env bash' will fail because /usr/bin/env can't lookup bash. Fixes #27790 Change-Id: I25e433061a7ff9da8c86429e934418fc15f12f90 Reviewed-on: https://go-review.googlesource.com/c/go/+/196845 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2019-03-02net/http: update net/http package to replace a broken link with an archive linkSamuel Kelemen
replaces broken link with a web.archive.org link. Change-Id: I438536a6ac51d837c30be5df7d3d0caadf65bb95 GitHub-Last-Rev: 0601e4d6b2440f7fb97a6700b74651dc16645c50 GitHub-Pull-Request: golang/go#30523 Reviewed-on: https://go-review.googlesource.com/c/164761 Reviewed-by: Bryan C. Mills <bcmills@google.com>
2018-09-26all: use strings.ReplaceAll and bytes.ReplaceAll where applicableBrad Fitzpatrick
I omitted vendor directories and anything necessary for bootstrapping. (Tested by bootstrapping with Go 1.4) Updates #27864 Change-Id: I7d9b68d0372d3a34dee22966cca323513ece7e8a Reviewed-on: https://go-review.googlesource.com/137856 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2018-06-04net: add js/wasm architectureRichard Musiol
This commit adds the js/wasm architecture to the net package. The net package is not supported by js/wasm, but a simple fake networking is available so tests of other packages that require basic TCP sockets can pass. The tests of the net package itself are mostly disabled. Updates #18892 Change-Id: Id287200c39f0a3e23d20ef17260ca15ccdcca032 Reviewed-on: https://go-review.googlesource.com/109995 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2018-06-01all: update comment URLs from HTTP to HTTPS, where possibleTim Cooper
Each URL was manually verified to ensure it did not serve up incorrect content. Change-Id: I4dc846227af95a73ee9a3074d0c379ff0fa955df Reviewed-on: https://go-review.googlesource.com/115798 Reviewed-by: Ian Lance Taylor <iant@golang.org> Run-TryBot: Ian Lance Taylor <iant@golang.org>
2018-04-04go/printer, gofmt: tuned table alignment for better resultsRobert Griesemer
The go/printer (and thus gofmt) uses a heuristic to determine whether to break alignment between elements of an expression list which is spread across multiple lines. The heuristic only kicked in if the entry sizes (character length) was above a certain threshold (20) and the ratio between the previous and current entry size was above a certain value (4). This heuristic worked reasonably most of the time, but also led to unfortunate breaks in many cases where a single entry was suddenly much smaller (or larger) then the previous one. The behavior of gofmt was sufficiently mysterious in some of these situations that many issues were filed against it. The simplest solution to address this problem is to remove the heuristic altogether and have a programmer introduce empty lines to force different alignments if it improves readability. The problem with that approach is that the places where it really matters, very long tables with many (hundreds, or more) entries, may be machine-generated and not "post-processed" by a human (e.g., unicode/utf8/tables.go). If a single one of those entries is overlong, the result would be that the alignment would force all comments or values in key:value pairs to be adjusted to that overlong value, making the table hard to read (e.g., that entry may not even be visible on screen and all other entries seem spaced out too wide). Instead, we opted for a slightly improved heuristic that behaves much better for "normal", human-written code. 1) The threshold is increased from 20 to 40. This disables the heuristic for many common cases yet even if the alignment is not "ideal", 40 is not that many characters per line with todays screens, making it very likely that the entire line remains "visible" in an editor. 2) Changed the heuristic to not simply look at the size ratio between current and previous line, but instead considering the geometric mean of the sizes of the previous (aligned) lines. This emphasizes the "overall picture" of the previous lines, rather than a single one (which might be an outlier). 3) Changed the ratio from 4 to 2.5. Now that we ignore sizes below 40, a ratio of 4 would mean that a new entry would have to be 4 times bigger (160) or smaller (10) before alignment would be broken. A ratio of 2.5 seems more sensible. Applied updated gofmt to all of src and misc. Also tested against several former issues that complained about this and verified that the output for the given examples is satisfactory (added respective test cases). Some of the files changed because they were not gofmt-ed in the first place. For #644. For #7335. For #10392. (and probably more related issues) Fixes #22852. Change-Id: I5e48b3d3b157a5cf2d649833b7297b33f43a6f6e
2017-10-05all: revert "all: prefer strings.IndexByte over strings.Index"Marvin Stenger
This reverts https://golang.org/cl/65930. Fixes #22148 Change-Id: Ie0712621ed89c43bef94417fc32de9af77607760 Reviewed-on: https://go-review.googlesource.com/68430 Reviewed-by: Ian Lance Taylor <iant@golang.org>
2017-09-25all: prefer strings.IndexByte over strings.IndexMarvin Stenger
strings.IndexByte was introduced in go1.2 and it can be used effectively wherever the second argument to strings.Index is exactly one byte long. This avoids generating unnecessary string symbols and saves a few calls to strings.Index. Change-Id: I1ab5edb7c4ee9058084cfa57cbcc267c2597e793 Reviewed-on: https://go-review.googlesource.com/65930 Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2017-04-25net/http/cgi: fix plan9 buildBrad Fitzpatrick
Cleanup CL https://golang.org/cl/41691 broke the plan9 build by removing a use of a package but not removing the package import. Trybots don't check that. I filed #20119 for that. Change-Id: Ia030e6924665dfb871ca964455b899d51b0200c2 Reviewed-on: https://go-review.googlesource.com/41752 Reviewed-by: David du Colombier <0intro@gmail.com>
2017-04-25all: remove some unused parameters in test codeDaniel Martí
Mostly unnecessary *testing.T arguments. Found with github.com/mvdan/unparam. Change-Id: Ifb955cb88f2ce8784ee4172f4f94d860fa36ae9a Reviewed-on: https://go-review.googlesource.com/41691 Run-TryBot: Daniel Martí <mvdan@mvdan.cc> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2016-07-18[release-branch.go1.7] net/http, net/http/cgi: fix for CGI + HTTP_PROXY ↵Brad Fitzpatrick
security issue Because, * The CGI spec defines that incoming request header "Foo: Bar" maps to environment variable HTTP_FOO == "Bar". (see RFC 3875 4.1.18) * The HTTP_PROXY environment variable is conventionally used to configure the HTTP proxy for HTTP clients (and is respected by default for Go's net/http.Client and Transport) That means Go programs running in a CGI environment (as a child process under a CGI host) are vulnerable to an incoming request containing "Proxy: attacker.com:1234", setting HTTP_PROXY, and changing where Go by default proxies all outbound HTTP requests. This is CVE-2016-5386, aka https://httpoxy.org/ Fixes #16405 Change-Id: I6f68ade85421b4807785799f6d98a8b077e871f0 Reviewed-on: https://go-review.googlesource.com/25010 Run-TryBot: Chris Broadfoot <cbro@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Chris Broadfoot <cbro@golang.org> Reviewed-on: https://go-review.googlesource.com/25013
2016-03-29net/http/cgi: allow CGI host to configure where child's stderr goesBrad Fitzpatrick
Patch originally from Steven Hartland. Tweaked a bit & added a test. Fixes #7197 Change-Id: I09012b4674e7c641dba31a24e9758cedb898d3ee Reviewed-on: https://go-review.googlesource.com/21196 Reviewed-by: Andrew Gerrand <adg@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
2016-03-02all: single space after period.Brad Fitzpatrick
The tree's pretty inconsistent about single space vs double space after a period in documentation. Make it consistently a single space, per earlier decisions. This means contributors won't be confused by misleading precedence. This CL doesn't use go/doc to parse. It only addresses // comments. It was generated with: $ perl -i -npe 's,^(\s*// .+[a-z]\.) +([A-Z]),$1 $2,' $(git grep -l -E '^\s*//(.+\.) +([A-Z])') $ go test go/doc -update Change-Id: Iccdb99c37c797ef1f804a94b22ba5ee4b500c4f7 Reviewed-on: https://go-review.googlesource.com/20022 Reviewed-by: Rob Pike <r@golang.org> Reviewed-by: Dave Day <djd@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2015-10-15net/http/cgi: optimize internal function removeLeadingDuplicates a bitBrad Fitzpatrick
Change-Id: I0255f24f5c5925ea4daa28a28d23606df35d4373 Reviewed-on: https://go-review.googlesource.com/15824 Reviewed-by: Andrew Gerrand <adg@golang.org>
generated by cgit v1.3 (git 2.53.0) at 2026-04-15 18:13:17 +0000