aboutsummaryrefslogtreecommitdiff
path: root/src/net/http/fs.go
AgeCommit message (Collapse)Author
21 hoursall: prealloc slice with possible minimum capabilitiesShulhan
2026-03-12net/http: move DetectContentType into net/http/internalDamien Neil
The http2 package needs access to DetectContentType, so move it into a common location. For #67810 Change-Id: Ibff3d57a4931106c2f69c5717c06bd5f6a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/751701 Reviewed-by: Nicholas Husin <nsh@golang.org> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <husin@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-03-05net/http: make http.FileServer return 404 when a path is invalid/unsafeGrégoire Lodi
This PR adds error handling in net/http toHTTPError to return a 404 instead of a 500 when net/http fs.Dir.Open throws the error http: invalid or unsafe file path. Fixes #72091 Change-Id: I7941c8fca5160a4a82732dc1d05b9b95eac84fbf GitHub-Last-Rev: 04b5019dfb629820621f3776d6f22fd754171565 GitHub-Pull-Request: golang/go#72108 Reviewed-on: https://go-review.googlesource.com/c/go/+/654975 Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2025-02-04net: use strings.SplitSeq and bytes.SplitSeqapocelipes
Replace `for _, s := range {strings, bytes}.Split(v, sep)` with `for s := range {strings, bytes}.SplitSeq(v, sep)`, to simplify the code and reduce some memory allocations. Change-Id: Idead4de1e3928fc75cc5ba8caeff85542f1243d5 GitHub-Last-Rev: 5fb196a073e7583b23b1ebb446d6c067580ed63a GitHub-Pull-Request: golang/go#71554 Reviewed-on: https://go-review.googlesource.com/c/go/+/646216 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Auto-Submit: Ian Lance Taylor <iant@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-02-03net/http: use strings.FieldsFuncSeq to reduce memory allocationscuishuang
After using strings.FieldsFuncSeq, the number of memory allocations has been reduced from 2 to 0. The following is the complete benchamark code and results: package main import ( "strings" "testing" ) func isSlashRune(r rune) bool { return r == '/' || r == '\\' } func containsDotDotLoop(v string) bool { if !strings.Contains(v, "..") { return false } for _, ent := range strings.FieldsFunc(v, isSlashRune) { if ent == ".." { return true } } return false } func containsDotDotSeq(v string) bool { if !strings.Contains(v, "..") { return false } for ent := range strings.FieldsFuncSeq(v, isSlashRune) { if ent == ".." { return true } } return false } func BenchmarkDotDot(b *testing.B) { testCases := []string{ "/path/to/somewhere", "/path/../to/somewhere", "/really/long/path/with/many/segments", "../../../deep/path", } b.Run("Loop", func(b *testing.B) { for i := 0; i < b.N; i++ { for _, tc := range testCases { containsDotDotLoop(tc) } } }) b.Run("Seq", func(b *testing.B) { for i := 0; i < b.N; i++ { for _, tc := range testCases { containsDotDotSeq(tc) } } }) } go test -bench=. -benchmem goos: darwin goarch: arm64 pkg: bc cpu: Apple M1 BenchmarkDotDot/Loop-8 6133270 193.7 ns/op 144 B/op 2 allocs/op BenchmarkDotDot/Seq-8 23172360 51.19 ns/op 0 B/op 0 allocs/op PASS ok bc 2.633s Change-Id: I529c296e701b22710e21b53877aa798799980a3b Reviewed-on: https://go-review.googlesource.com/c/go/+/639536 Reviewed-by: Ian Lance Taylor <iant@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Ian Lance Taylor <iant@google.com> Reviewed-by: Cherry Mui <cherryyz@google.com>
2024-07-15net/http: document io.Seeker requirement for fs.FS argumentsSean Liao
Using the same wording as http.FS, even though it's not strictly required if a content type can be determined by file extension. Fixes #66877 Updates #44553 Change-Id: I7b70c10909bdd289a57d1998a565262b8aaf2dd2 Reviewed-on: https://go-review.googlesource.com/c/go/+/597977 Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com> Commit-Queue: Ian Lance Taylor <iant@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2024-06-18net/http: keep Content-Encoding in Error, add GODEBUG for ServeContentDamien Neil
This reverts the changes to Error from CL 571995, and adds a GODEBUG controlling the changes to ServeContent/ServeFile/ServeFS. The change to remove the Content-Encoding header when serving an error breaks middleware which sets Content-Encoding: gzip and wraps a ResponseWriter in one which compresses the response body. This middleware already breaks when ServeContent handles a Range request. Correct uses of ServeContent which serve pre-compressed content with a Content-Encoding: gzip header break if we don't remove that header when serving errors. Therefore, we keep the change to ServeContent/ ServeFile/ServeFS, but we add the ability to disable the new behavior by setting GODEBUG=httpservecontentkeepheaders=1. We revert the change to Error, because users who don't want to include a Content-Encoding header in errors can simply remove the header themselves, or not add it in the first place. Fixes #66343 Change-Id: Ic19a24b73624a5ac1a258ed7a8fe7d9bf86c6a38 Reviewed-on: https://go-review.googlesource.com/c/go/+/593157 Reviewed-by: Russ Cox <rsc@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2024-05-09net/http: remove misleading response headers on errorRuss Cox
This is a reapply of CL 544019 and CL 569815, but with less aggressive semantics as discussed in proposal #66343. Error deletes Content-Encoding, since it is writing the response and any preset encoding may not be correct. On the error-serving path in ServeContent/ServeFile/ServeFS, these functions delete additional headers: Etag, Last-Modified, and Cache-Control. The caller may have set these intending them for the success response, and they may well not be correct for error responses. Fixes #50905. Fixes #66343. Change-Id: I873d33edde1805990ca16d85ea8d7735b7448626 Reviewed-on: https://go-review.googlesource.com/c/go/+/571995 Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2024-03-29net/http: correct doc for ServeFileFSJes Cok
The documentation of ServeFileFS was partly copied from ServeFile in CL 513956, however it's not exact. This CL fixes some typos, also removes obsolete comment for name param. For consistency, also adds godoc link for ServeFile and ServeContent. Fixes #66578 Change-Id: I87147d72c533d46284f06ef20b37fdafa8706710 Reviewed-on: https://go-review.googlesource.com/c/go/+/575016 Reviewed-by: Than McIntosh <thanm@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Mauri de Souza Meneguzzo <mauri870@gmail.com>
2024-02-27net/http: prevent redirect loop in serveFile if "/" is a normal fileMauri de Souza Meneguzzo
When FileServer(Dir("file")) is used where "file" is a normal file and not a directory, the server enters a redirect loop. The usage of a file inplace of a directory path is not documented in http.Dir and it could be considered undefined behavior. This CL updates serveFile to check if we are trying to traverse a normal file instead of a directory and return an error, preventing the redirect loop. Fixes #63769 Change-Id: I81e289444e7d0bd72189c2e7b763f5540333e2d0 GitHub-Last-Rev: 754c9a1167916b5a8c3c827391d7e4a2ff3bc44d GitHub-Pull-Request: golang/go#63860 Reviewed-on: https://go-review.googlesource.com/c/go/+/538719 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Emmanuel Odeke <emmanuel@orijtech.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Bryan Mills <bcmills@google.com> Auto-Submit: Bryan Mills <bcmills@google.com> Commit-Queue: Bryan Mills <bcmills@google.com>
2024-02-26path/filepath: add LocalizeDamien Neil
Add the Localize function, which takes an io/fs slash-separated path and returns an operating system path. Localize returns an error if the path cannot be represented on the current platform. Replace internal/safefile.FromFS with Localize, which serves the same purpose as this function. The internal/safefile package remains separate from path/filepath to avoid a dependency cycle with the os package. Fixes #57151 Change-Id: I75c88047ddea17808276761da07bf79172c4f6fc Reviewed-on: https://go-review.googlesource.com/c/go/+/531677 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Ian Lance Taylor <iant@google.com>
2024-02-24net/http: make FileServer look good on mobileMax 👨🏽‍💻 Coplan
Currently when viewing directories on a phone, the text is small and often hard to tap correctly. This commit adds the viewport property to the page to make it look correct on phones. This commit also makes the page behave in Standards Mode instead of Quirks Mode which does not effect the behavior of this page but makes me feel good inside ☺️ Change-Id: I4babcf79085e85fba57453b7a235e4750a269a42 Reviewed-on: https://go-review.googlesource.com/c/go/+/552595 Auto-Submit: Ian Lance Taylor <iant@golang.org> Commit-Queue: Ian Lance Taylor <iant@golang.org> Reviewed-by: Cherry Mui <cherryyz@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Max Coplan <mchcopl@gmail.com>
2024-01-10net: add available godoc linkcui fliter
Change-Id: Ib7c4baf0247c421954aedabfbb6a6af8a08a8936 Reviewed-on: https://go-review.googlesource.com/c/go/+/540021 Reviewed-by: Damien Neil <dneil@google.com> Run-TryBot: shuang cui <imcusg@gmail.com> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2023-11-15net/http: don't set length for non-range encoded content requestsDamien Neil
Historically, serveContent has not set Content-Length when the user provides Content-Encoding. This causes broken responses when the user sets both Content-Length and Content-Encoding, and the request is a range request, because the returned data doesn't match the declared length. CL 381956 fixed this case by changing serveContent to always set a Content-Length header. Unfortunately, I've discovered multiple cases in the wild of users setting Content-Encoding: gzip and passing serveContent a ResponseWriter wrapper that gzips the data written to it. This breaks serveContent in a number of ways. In particular, there's no way for it to respond to Range requests properly, because it doesn't know the recipient's view of the content. What the user should be doing in this case is just using io.Copy to send the gzipped data to the response. Or possibly setting Transfer-Encoding: gzip. But whatever they should be doing, what they are doing has mostly worked for non-Range requests, and setting Content-Length makes it stop working because the length of the file being served doesn't match the number of bytes being sent. So in the interests of not breaking users (even if they're misusing serveContent in ways that are already broken), partially revert CL 381956. For non-Range requests, don't set Content-Length when the user has set Content-Encoding. This matches our previous behavior and causes minimal harm in cases where we could have set Content-Length. (We will send using chunked encoding rather than identity, but that's fine.) For Range requests, set Content-Length unconditionally. Either the user isn't mangling the data in the ResponseWriter, in which case the length is correct, or they are, in which case the response isn't going to contain the right bytes anyway. (Note that a Range request for a Content-Length: gzip file is requesting a range of *gzipped* bytes, not a range from the uncompressed file.) Change-Id: I5e788e6756f34cee520aa7c456826f462a59f7eb Reviewed-on: https://go-review.googlesource.com/c/go/+/542595 Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Jonathan Amsterdam <jba@google.com>
2023-11-06net/http: set/override Content-Length for encoded range requestsMitar
Currently, http.ServeContent returns invalid Content-Length header if: * Request is a range request. * Content is encoded (e.g., gzip compressed). * Content-Length of the encoded content has been set before calling http.ServeContent, as suggested in https://github.com/golang/go/issues/19420. Example: w.Header().Set("Content-Type", "application/json") w.Header().Set("Content-Length", strconv.Itoa(len(compressedJsonBody))) w.Header().Set("Content-Encoding", "gzip") w.Header().Set("Etag", etag) http.ServeContent( w, req, "", time.Time{}, bytes.NewReader(compressedJsonBody), ) The issue is that http.ServeContent currently sees Content-Length as something optional when Content-Encoding is set, but that is a problem with range request which can send a payload of different size. So this reverts https://go.dev/cl/4538111 and makes Content-Length be set always to the number of bytes which will actually be send (both for range and non-range requests). Without this fix, this is an example response: HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Encoding: gzip Content-Length: 351 Content-Range: bytes 100-350/351 Content-Type: application/json; charset=UTF-8 Etag: "amCTP_vgT5PQt5OsAEI7NFJ6Hx1UfEpR5nIaYEInfOA" Date: Sat, 29 Jan 2022 14:42:15 GMT As you see, Content-Length is invalid and should be 251. Change-Id: I4d2ea3a8489a115f92ef1f7e98250d555b47a94e GitHub-Last-Rev: 3aff9126f5d62725c7d539df2d0eb2b860a84ca6 GitHub-Pull-Request: golang/go#50904 Reviewed-on: https://go-review.googlesource.com/c/go/+/381956 Reviewed-by: Damien Neil <dneil@google.com> Run-TryBot: t hepudds <thepudds1460@gmail.com> Reviewed-by: David Chase <drchase@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-08-07net/http: add ServeFileFS, FileServerFS, NewFileTransportFSMauri de Souza Meneguzzo
These new apis are analogous to ServeFile, FileServer and NewFileTransport respectively. The main difference is that these functions operate on an fs.FS. Fixes #51971 Change-Id: Ie56b245b795eeb7edf613657578592306945469b GitHub-Last-Rev: 26e75c0368f155a2299fbdcb72f47036b71a5e06 GitHub-Pull-Request: golang/go#61641 Reviewed-on: https://go-review.googlesource.com/c/go/+/513956 Run-TryBot: Damien Neil <dneil@google.com> Reviewed-by: David Chase <drchase@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Damien Neil <dneil@google.com>
2023-07-24Revert "net/http: use Copy in ServeContent if CopyN not needed"Damien Neil
This reverts CL 446276. Reason for revert: Causing surprising performance regression. Fixes #61530 Change-Id: Ic970f2e05d875b606ce274ea621f7e4c8c337481 Reviewed-on: https://go-review.googlesource.com/c/go/+/512615 Run-TryBot: Damien Neil <dneil@google.com> Reviewed-by: Bryan Mills <bcmills@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-04-06Revert "net/http: FileServer method check + minimal OPTIONS implementation"Damien Neil
This reverts https://go.dev/cl/413554 Reason for revert: Backwards-incompatible change in behavior. For #53501 For #59375 Change-Id: Ic3f63b378f9c819599b32e5e6e410f6163849317 Reviewed-on: https://go-review.googlesource.com/c/go/+/482635 Reviewed-by: Tatiana Bradley <tatianabradley@google.com> Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-03-09net/http: use Copy in ServeContent if CopyN not neededLeo Antunes
This small PR allows optimizations made in io.Copy (like the use of io.WriterTo) to be used in one possible path of http.ServeContent (in case of a non-Range request). This, in turn, allows us to skip the buffer allocation in io.Copy. Change-Id: Ifa2ece206ecd4556aaaed15d663b65e95e00bb0a GitHub-Last-Rev: 94fc0318145ba1bd48502564f6488aade871c301 GitHub-Pull-Request: golang/go#56480 Reviewed-on: https://go-review.googlesource.com/c/go/+/446276 Reviewed-by: Bryan Mills <bcmills@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Damien Neil <dneil@google.com> Run-TryBot: Damien Neil <dneil@google.com>
2022-12-06os, net/http: avoid escapes from os.DirFS and http.Dir on WindowsDamien Neil
Do not permit access to Windows reserved device names (NUL, COM1, etc.) via os.DirFS and http.Dir filesystems. Avoid escapes from os.DirFS(`\`) on Windows. DirFS would join the the root to the relative path with a path separator, making os.DirFS(`\`).Open(`/foo/bar`) open the path `\\foo\bar`, which is a UNC name. Not only does this not open the intended file, but permits reference to any file on the system rather than only files on the current drive. Make os.DirFS("") invalid, with all file access failing. Previously, a root of "" was interpreted as "/", which is surprising and probably unintentional. Fixes CVE-2022-41720 Fixes #56694 Change-Id: I275b5fa391e6ad7404309ea98ccc97405942e0f0 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1663834 Reviewed-by: Tatiana Bradley <tatianabradley@google.com> Reviewed-by: Julie Qiu <julieqiu@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/455362 Reviewed-by: Michael Pratt <mpratt@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Jenny Rakoczy <jenny@golang.org> Reviewed-on: https://go-review.googlesource.com/c/go/+/455716 Reviewed-by: Jenny Rakoczy <jenny@golang.org> Run-TryBot: Damien Neil <dneil@google.com>
2022-11-04net/http: ignore ranges if the content is empty in serveContentJorropo
Fixes #54794 Change-Id: I6f2b7b86b82ea27b9d53cf989daa21cb8ace13da Reviewed-on: https://go-review.googlesource.com/c/go/+/427195 Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Bryan Mills <bcmills@google.com>
2022-09-29net/http: remove deadstore statementcuiweixie
Change-Id: Icfa3fd519df48f8d7d7aa3795535fd7e6aaa159f Reviewed-on: https://go-review.googlesource.com/c/go/+/435936 Reviewed-by: Ian Lance Taylor <iant@google.com> Run-TryBot: Ian Lance Taylor <iant@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-09-29net/http: use time.Comparecuiweixie
Change-Id: I4730673130bdfbda9987dcb5869f421082f92150 Reviewed-on: https://go-review.googlesource.com/c/go/+/435615 Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com> Run-TryBot: Ian Lance Taylor <iant@google.com>
2022-08-29net/http: FileServer method check + minimal OPTIONS implementationPascal S. de Kloe
FileServer provides a read-only service. Methods other than GET or HEAD should be denied with an Allow header. Fixes #53501 Change-Id: I1d31b405eefd90565ecd474ac3f8d8d6e3b15072 Reviewed-on: https://go-review.googlesource.com/c/go/+/413554 TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Damien Neil <dneil@google.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Heschi Kreinick <heschi@google.com>
2022-08-26net/http: mention io.Seeker requirement in FS documentationAlex Studer
Both FileServer and NewFileTransport can try to seek a file, specifically when MIME type sniffing is performed. This can be somewhat surprising to an implementer of an fs.FS, as their filesystem will appear to work until a user tries to access a file with an unrecognized extension (which requires type sniffing and therefore seeking). With FileServer, this results in a "seeker can't seek" message, which is not very clear for the developer. The issue arises because fs.FS does not require Seek, while http.FileSystem does. Therefore, this change adds a line to the documentation of net/http's adapter function mentioning the requirement. Change-Id: Ieb955b7a7f34e2be39dd696cb712513c70100b3a GitHub-Last-Rev: fddccdae36e04fcb87d78b3b03fa4658dbb7d83d GitHub-Pull-Request: golang/go#48781 Reviewed-on: https://go-review.googlesource.com/c/go/+/353874 Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Damien Neil <dneil@google.com> Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: David Chase <drchase@google.com>
2022-07-11net/http: remove Content-Encoding in writeNotModifiedMitar
Additional header to remove if set before calling http.ServeContent. The API of ServeContent is that one should set Content-Encoding before calling it, if the content is encoded (e.g., compressed). But then, if content has not been modified, that header should be removed, according to RFC 7232 section 4.1. Change-Id: If51b35b7811a4dbb19de2ddb73f40c5e68fcec7e GitHub-Last-Rev: 53df6e73c44b63f351f7aeeb45cab82d706311eb GitHub-Pull-Request: golang/go#50903 Reviewed-on: https://go-review.googlesource.com/c/go/+/381955 Run-TryBot: hopehook <hopehook@qq.com> Reviewed-by: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Benny Siegert <bsiegert@gmail.com>
2022-04-11all: gofmt main repoRuss Cox
[This CL is part of a sequence implementing the proposal #51082. The design doc is at https://go.dev/s/godocfmt-design.] Run the updated gofmt, which reformats doc comments, on the main repository. Vendored files are excluded. For #51082. Change-Id: I7332f099b60f716295fb34719c98c04eb1a85407 Reviewed-on: https://go-review.googlesource.com/c/go/+/384268 Reviewed-by: Jonathan Amsterdam <jba@google.com> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2022-04-01all: remove trailing blank doc comment linesRuss Cox
A future change to gofmt will rewrite // Doc comment. // func f() to // Doc comment. func f() Apply that change preemptively to all doc comments. For #51082. Change-Id: I4023e16cfb0729b64a8590f071cd92f17343081d Reviewed-on: https://go-review.googlesource.com/c/go/+/384259 Trust: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-01-10net/http: map FS Open errors just like DirJonathan Amsterdam
When an http.FileServer is given a path like file1/file2 where file1 exists but file2 does not, the proper HTTP status should be NotFound. Some OSes return a "not a directory" error instead, so this must be mapped to NotFound. That mapping was already being done for the Dir FileSystem implementation, as discussed in #18984. But it wasn't for the FS implementation. This CL does the same mapping for FS, by generalizing the function that did it for Dir. Fixes #49552 Change-Id: I61d6aa8ef101158e9674707d44e653f5dedbd040 Reviewed-on: https://go-review.googlesource.com/c/go/+/376874 Trust: Jonathan Amsterdam <jba@google.com> Run-TryBot: Jonathan Amsterdam <jba@google.com> Reviewed-by: Emmanuel Odeke <emmanuel@orijtech.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2021-10-06all: use bytes.Cut, strings.CutRuss Cox
Many uses of Index/IndexByte/IndexRune/Split/SplitN can be written more clearly using the new Cut functions. Do that. Also rewrite to other functions if that's clearer. For #46336. Change-Id: I68d024716ace41a57a8bf74455c62279bde0f448 Reviewed-on: https://go-review.googlesource.com/c/go/+/351711 Trust: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2021-04-16net/http: using errors.Is in fs error detectionPeng Gao
Compare error by errors.Is to detect wrapped fs errors. Fixes #44923 Change-Id: Idf32b96a661728278b7006c3b3bcc581b8588259 GitHub-Last-Rev: dba01ddae06947fb8c6047ddfba108acd650f446 GitHub-Pull-Request: golang/go#45314 Reviewed-on: https://go-review.googlesource.com/c/go/+/306051 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Trust: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Go Bot <gobot@golang.org>
2020-10-20net/http: add FS to convert fs.FS to FileSystemRuss Cox
Two different functions in the http API expect a FileSystem: http.FileSystem and http.NewFileTransport. Add a general converter http.FS to turn an fs.FS into an http.FileSystem for use with either of these functions. (The original plan was to add http.HandlerFS taking an fs.FS directly, but that doesn't help with NewFileTransport.) For #41190. Change-Id: I5f242eafe9b963f4387419a2615bdb487c358f16 Reviewed-on: https://go-review.googlesource.com/c/go/+/243939 Trust: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Rob Pike <r@golang.org>
2020-10-20all: update references to symbols moved from os to io/fsRuss Cox
The old os references are still valid, but update our code to reflect best practices and get used to the new locations. Code compiled with the bootstrap toolchain (cmd/asm, cmd/dist, cmd/compile, debug/elf) must remain Go 1.4-compatible and is excluded. For #41190. Change-Id: I8f9526977867c10a221e2f392f78d7dec073f1bd Reviewed-on: https://go-review.googlesource.com/c/go/+/243907 Trust: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Rob Pike <r@golang.org>
2020-09-02net/http: reject negative suffix-length Range:bytes=--N with 416 status codeEmmanuel T Odeke
Fixes the file server to reject requests of the form: "Range": "bytes=--N" where "-N" is a negative suffix-length as designated by the grammar in RFC 7233 Section 2.1, "Byte-Ranges", which specifies that suffix-length MUST be of the form 1*DIGIT aka a non-negative digit. Thus requests such as: "Range": "bytes=--2" will be rejected with a "416 Range Not Satisfiable" response. Fixes #40940 Change-Id: I3e89f8326c14af30d8bdb126998a50e02ba002d9 Reviewed-on: https://go-review.googlesource.com/c/go/+/252497 Run-TryBot: Emmanuel Odeke <emm.odeke@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Bryan C. Mills <bcmills@google.com>
2020-06-29net/http: fix panic with If-None-Match value in http.ServeContentMarcus Weiner
Fixes #39817 Change-Id: I79f2ad7c836a8a46569f603aca583fdd526d22dc GitHub-Last-Rev: 5b88aada219aaa2af0c7e1969ed6fa646117d9da GitHub-Pull-Request: golang/go#39821 Reviewed-on: https://go-review.googlesource.com/c/go/+/239699 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2020-06-23net/http: document Dir behavior with symlinksKatie Hockman
Based on CL 229377. Change-Id: I016eec20672c909e8fabe799c277f4d2540fc555 Reviewed-on: https://go-review.googlesource.com/c/go/+/238698 Run-TryBot: Katie Hockman <katie@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Filippo Valsorda <filippo@golang.org>
2020-05-06net/http: use ASCII space trimming throughoutFilippo Valsorda
Security hardening against HTTP request smuggling. Thank you to ZeddYu for reporting this issue. Change-Id: I98bd9f8ffe58360fc3bca9dc5d9a106773e55373 Reviewed-on: https://go-review.googlesource.com/c/go/+/231419 Reviewed-by: Katie Hockman <katie@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2019-10-14net/http: clean up checkIfModifiedSince and checkIfUnmodifiedSinceAnmol Sethi
The comment in both functions referred to the wrong header and I made the checks easier to read. Change-Id: Ifb46729cee631a3305f557863818e3487b8eed71 Reviewed-on: https://go-review.googlesource.com/c/go/+/71753 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2019-10-01net/http: avoid sending unspecified time for directoriesNuno Cruces
Change applies to sendFile. This is already done for sendContent. Change-Id: If43d9ab99e6e66a1363b08e0bdcceb57df1f855c GitHub-Last-Rev: 1c47620a09a6f5e2b3d777fadaad6e0189de4af5 GitHub-Pull-Request: golang/go#34631 Reviewed-on: https://go-review.googlesource.com/c/go/+/198139 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2019-09-02net/http: merge IsDir checks in fs.go's serveFile functionspacewander
Fixes #33385 Change-Id: I497ccd868d408a9c5648c72aa5ce41221368daf4 GitHub-Last-Rev: 3bf483808e10a13c522df02c2fc55fe278044680 GitHub-Pull-Request: golang/go#33423 Reviewed-on: https://go-review.googlesource.com/c/go/+/188677 Reviewed-by: Daniel Martí <mvdan@mvdan.cc> Run-TryBot: Daniel Martí <mvdan@mvdan.cc> TryBot-Result: Gobot Gobot <gobot@golang.org>
2019-08-28net/http: don't panic serving dir in ServeFile with empty Request.URL.PathBrad Fitzpatrick
Updates #30165 Updates #31622 Change-Id: I7a4b91aa7c5c3af8c0b1273cbb42046feddf7d78 Reviewed-on: https://go-review.googlesource.com/c/go/+/180499 Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com> Run-TryBot: Emmanuel Odeke <emm.odeke@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2019-02-26net/http: add godoc for Dir.Open functionDmitry Mottl
This commit adds godoc for Dir.Open function. Change-Id: Ibc3b22f38660a082802e1f868c5cf9d880fc2801 GitHub-Last-Rev: 774cfd7d8cc61989179956e47d51451135b6c203 GitHub-Pull-Request: golang/go#30353 Reviewed-on: https://go-review.googlesource.com/c/163437 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2018-07-27net/http: try to document ServeFile security moreBrad Fitzpatrick
We've expanded this several times. Try more. Fixes #18837 Change-Id: I03b699391351a30ee60a15d7aa712c6c66444cf9 Reviewed-on: https://go-review.googlesource.com/125875 Reviewed-by: Ian Lance Taylor <iant@golang.org>
2018-02-20net/http: use RFC 723x as normative reference in docsDavid Url
Replace references to the obsoleted RFC 2616 with references to RFC 7230 through 7235, to avoid unnecessary confusion. Obvious inconsistencies are marked with todo comments. Updates #21974 Change-Id: I8fb4fcdd1333fc5193b93a2f09598f18c45e7a00 Reviewed-on: https://go-review.googlesource.com/94095 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2017-10-05all: revert "all: prefer strings.IndexByte over strings.Index"Marvin Stenger
This reverts https://golang.org/cl/65930. Fixes #22148 Change-Id: Ie0712621ed89c43bef94417fc32de9af77607760 Reviewed-on: https://go-review.googlesource.com/68430 Reviewed-by: Ian Lance Taylor <iant@golang.org>
2017-09-25all: prefer strings.IndexByte over strings.IndexMarvin Stenger
strings.IndexByte was introduced in go1.2 and it can be used effectively wherever the second argument to strings.Index is exactly one byte long. This avoids generating unnecessary string symbols and saves a few calls to strings.Index. Change-Id: I1ab5edb7c4ee9058084cfa57cbcc267c2597e793 Reviewed-on: https://go-review.googlesource.com/65930 Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2017-08-29all: join some chained ifs to unindent codeDaniel Martí
Found with mvdan.cc/unindent. It skipped the cases where parentheses would need to be added, where comments would have to be moved elsewhere, or where actions and simple logic would mix. One of them was of the form "err != nil && err == io.EOF", so the first part was removed. Change-Id: Ie504c2b03a2c87d10ecbca1b9270069be1171b91 Reviewed-on: https://go-review.googlesource.com/57690 Run-TryBot: Daniel Martí <mvdan@mvdan.cc> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2017-08-14net/http: various small cleanupsDaniel Martí
* Remove an unnecessary type conversion * Make golint happier about consistent receiver names * Make golint happier about a foo_bar var name Change-Id: I5223808109f6f8b69ed4be76de82faf2478c6a2e Reviewed-on: https://go-review.googlesource.com/54530 Run-TryBot: Daniel Martí <mvdan@mvdan.cc> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Tom Bergan <tombergan@google.com>
2017-08-09net/http: log Readdir error to Server.ErrorLogDmitri Shuralyov
Now that issue #12438 is resolved, this TODO can be completed. Create a logf helper, which is similar to Server.logf method, but takes a *Request to infer the *Server and its ErrorLog from. Update documentation of Server.ErrorLog to mention a new type of errors that may be logged to it. Also update a statement in documentation of Server.ErrorLog from: // If nil, logging goes to os.Stderr via the log package's // standard logger. To: // If nil, logging is done via the log package's standard logger. The motivation for doing so is to avoid making inaccurate claims. Logging may not go to os.Stderr if anyone overrides the log package's default output via https://godoc.org/log#SetOutput. Saying that the standard logger is used should be sufficient to explain the behavior, and users can infer that os.Stderr is used by default, unless it's changed. Updates #12438. Change-Id: I3a4b0db51d652fd25fb2065fbc2157a3dec4dd38 Reviewed-on: https://go-review.googlesource.com/53950 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2017-08-09net/http: check If-Range header when request method is HEADJoe Kyo
When If-Range does not match and the requested resource is available, server should return a "200 OK" response to client. Currently server returns "200 OK" when the request method is GET, but "206 Partial Content" when method is HEAD. This change fixed this inconsistency. Change-Id: I5ad979919f4f089baba54a4445b70ca38471a906 Reviewed-on: https://go-review.googlesource.com/54110 Run-TryBot: Tom Bergan <tombergan@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Tom Bergan <tombergan@google.com>
generated by cgit v1.3 (git 2.53.0) at 2026-04-15 12:03:56 +0000