aboutsummaryrefslogtreecommitdiff
path: root/src/net/http/request.go
AgeCommit message (Collapse)Author
2024-01-10net: add available godoc linkcui fliter
Change-Id: Ib7c4baf0247c421954aedabfbb6a6af8a08a8936 Reviewed-on: https://go-review.googlesource.com/c/go/+/540021 Reviewed-by: Damien Neil <dneil@google.com> Run-TryBot: shuang cui <imcusg@gmail.com> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2024-01-09net/http: clarify the precedence order for Request.FormValueJes Cok
Fixes #64575 Change-Id: I0eaec642a9dc8ae3b273a6d41131cc7cb8332947 GitHub-Last-Rev: 17aa5170cbfe42cb86d56f1804266850d33c3eb5 GitHub-Pull-Request: golang/go#64578 Reviewed-on: https://go-review.googlesource.com/c/go/+/547855 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2024-01-03net/http: make Request.Clone create fresh copies for matches and otherValuesJes Cok
This change fixes Request.Clone to correctly work with SetPathValue by creating fresh copies for matches and otherValues so that SetPathValue for cloned requests doesn't pollute the original request. While here, also added a doc for Request.SetPathValue. Fixes #64911 Change-Id: I2831b38e135935dfaea2b939bb9db554c75b65ef GitHub-Last-Rev: 1981db16475a49fe8d4b874a6bceec64d28a1332 GitHub-Pull-Request: golang/go#64913 Reviewed-on: https://go-review.googlesource.com/c/go/+/553375 Reviewed-by: Emmanuel Odeke <emmanuel@orijtech.com> Run-TryBot: Jes Cok <xigua67damn@gmail.com> Auto-Submit: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Jonathan Amsterdam <jba@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2023-10-23net/http: remove outdated comment about a support of CONNECT methodKeiichi Hirobe
The net/http.Transport already supports CONNECT after https://go-review.googlesource.com/c/go/+/123156 was merged, which deleted comments in transport.go. Change-Id: I784fdb9b044bc8a4a29bf252328c80a11aaf6901 Reviewed-on: https://go-review.googlesource.com/c/go/+/536057 Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: David Chase <drchase@google.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Damien Neil <dneil@google.com>
2023-09-14net/http: implement path value methods on RequestJonathan Amsterdam
Add Request.PathValue and Request.SetPathValue, and the fields on Request required to support them. Populate those fields in ServeMux.ServeHTTP. Updates #61410. Change-Id: Ic88cb865b0d865a30d3b35ece8e0382c58ef67d1 Reviewed-on: https://go-review.googlesource.com/c/go/+/528355 Run-TryBot: Jonathan Amsterdam <jba@google.com> Reviewed-by: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-08-25net/http: document when request bodies are closed in more placesDamien Neil
It isn't obvious that request bodies can be closed asynchronously, and it's easy to overlook the documentation of this fact in RoundTripper, which is a fairly low-level interface. Change-Id: I3b825c505418af7e1d3f6ed58f3704e55cf16901 Reviewed-on: https://go-review.googlesource.com/c/go/+/523036 TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Damien Neil <dneil@google.com> Reviewed-by: Bryan Mills <bcmills@google.com> Auto-Submit: Damien Neil <dneil@google.com>
2023-08-08net/http: sanitize User-Agent header in request writerDamien Neil
Apply the same transformations to the User-Agent header value that we do to other headers. Avoids header and request smuggling in Request.Write and Request.WriteProxy. RoundTrip already validates values in Request.Header, and didn't allow bad User-Agent values to make it as far as the request writer. Fixes #61824 Change-Id: I360a915c7e08d014e0532bd5af196a5b59c89395 Reviewed-on: https://go-review.googlesource.com/c/go/+/516836 Reviewed-by: Jonathan Amsterdam <jba@google.com> Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-08-07net/http: permit requests with invalid Host headersDamien Neil
Historically, the Transport has silently truncated invalid Host headers at the first '/' or ' ' character. CL 506996 changed this behavior to reject invalid Host headers entirely. Unfortunately, Docker appears to rely on the previous behavior. When sending a HTTP/1 request with an invalid Host, send an empty Host header. This is safer than truncation: If you care about the Host, then you should get the one you set; if you don't care, then an empty Host should be fine. Continue to fully validate Host headers sent to a proxy, since proxies generally can't productively forward requests without a Host. For #60374 Fixes #61431 Change-Id: If170c7dd860aa20eb58fe32990fc93af832742b6 Reviewed-on: https://go-review.googlesource.com/c/go/+/511155 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> Run-TryBot: Damien Neil <dneil@google.com>
2023-07-31net/http: fix doc comment on FormValue functionEduard Bondarenko
This function checks Request.Form, which now includes values parsed from a PATCH request. Fixes #60585 Change-Id: Icb095d9ac2f8b0c5dbf313e507ed838cb941517f GitHub-Last-Rev: 3a477ea97e27f5b31d28085df75163fc13541c13 GitHub-Pull-Request: golang/go#61591 Reviewed-on: https://go-review.googlesource.com/c/go/+/513435 Reviewed-by: David Chase <drchase@google.com> Reviewed-by: Damien Neil <dneil@google.com> Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Damien Neil <dneil@google.com>
2023-06-29net/http: validate Host header before sendingDamien Neil
Verify that the Host header we send is valid. Avoids surprising behavior such as a Host of "go.dev\r\nX-Evil:oops" adding an X-Evil header to HTTP/1 requests. Add a test, skip the test for HTTP/2. HTTP/2 is not vulnerable to header injection in the way HTTP/1 is, but x/net/http2 doesn't validate the header and will go into a retry loop when the server rejects it. CL 506995 adds the necessary validation to x/net/http2. For #60374 Change-Id: I05cb6866a9bead043101954dfded199258c6dd04 Reviewed-on: https://go-review.googlesource.com/c/go/+/506996 Reviewed-by: Tatiana Bradley <tatianabradley@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Damien Neil <dneil@google.com>
2023-05-10net/http: let ErrNotSupported match errors.ErrUnsupportedIan Lance Taylor
For #41198 Change-Id: Ibb030e94618a1f594cfd98ddea214ad7a88d2e73 Reviewed-on: https://go-review.googlesource.com/c/go/+/494122 Auto-Submit: Ian Lance Taylor <iant@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Run-TryBot: Ian Lance Taylor <iant@golang.org> Reviewed-by: Bryan Mills <bcmills@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-11-10net/http: add ResponseController and per-handler timeoutsDamien Neil
The ResponseController type provides a discoverable interface to optional methods implemented by ResponseWriters. c := http.NewResponseController(w) c.Flush() vs. if f, ok := w.(http.Flusher); ok { f.Flush() } Add the ability to control per-request read and write deadlines via the ResponseController SetReadDeadline and SetWriteDeadline methods. For #54136 Change-Id: I3f97de60d4c9ff150cda559ef86c6620eee665d2 Reviewed-on: https://go-review.googlesource.com/c/go/+/436890 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Bryan Mills <bcmills@google.com> Run-TryBot: Damien Neil <dneil@google.com>
2022-09-27net/http: fix the potential leak of textproto.Reader from poolAndy Pan
Fixes #55835 Change-Id: I6109bab2941b859e8cfef22f65a6a3a5f977a8d7 Reviewed-on: https://go-review.googlesource.com/c/go/+/433835 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com> Run-TryBot: Andy Pan <panjf2000@gmail.com> Run-TryBot: Ian Lance Taylor <iant@google.com>
2022-08-26net/http: don't panic on very large MaxBytesReaderLimitcuiweixie
Fixes #54408 Change-Id: I454199ae5bcd087b8fc4169b7622412105e71113 GitHub-Last-Rev: a33fe7e206d0c394440962acd360df3aa9b117c3 GitHub-Pull-Request: golang/go#54415 Reviewed-on: https://go-review.googlesource.com/c/go/+/423314 Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> Run-TryBot: xie cui <523516579@qq.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: David Chase <drchase@google.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: hopehook <hopehook@qq.com>
2022-08-17net/http: return ErrNoCookie from Request.Cookie when name is ""muyizixiu
Request.Cookie(name string) will return the first cookie when cookie name is "". Since readCookies in file net/http/cookie.go at line 247 return all cookies when second parameter is a empty string. To fix it, Return ErrNoCookie from Request.Cookie(""), instead of the first cookie in the request. Fixes #53181 Change-Id: Ie623ca4c53da64ef7623a7863292a2d771f76832 GitHub-Last-Rev: 01098cd5dbcc8d65e9c0893e0586601584e5f8b9 GitHub-Pull-Request: golang/go#53183 Reviewed-on: https://go-review.googlesource.com/c/go/+/409754 Reviewed-by: Ian Lance Taylor <iant@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2022-08-15net/http: make Request.WithContext documentation less prescriptiveDamien Neil
WithContext makes a shallow copy of a Request, and Clone makes a deep copy. Both set the context of the new request. The distinction between the two is clear, and it doesn't seem useful or necessary to say that "it's rare to need WithContext". Also update a couple locations that mention WithContext to mention Clone as well. Fixes #53413. Change-Id: I89e6ddebd7d5ca6573e522fe48cd7f50cc645cdd Reviewed-on: https://go-review.googlesource.com/c/go/+/412778 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Robert Findley <rfindley@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Damien Neil <dneil@google.com>
2022-07-12net/http: clarify that MaxBytesReader returns *MaxBytesErrorDamien Neil
A MaxBytesReader returns a *MaxBytesError when reading beyond its limit, not a MaxBytesError. Fixes #53764. Change-Id: Icac3aeac96fd8b172f951241f8f111cda633752c Reviewed-on: https://go-review.googlesource.com/c/go/+/416914 Reviewed-by: Ian Lance Taylor <iant@google.com> Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-04-25net/http: add MaxBytesErrorCarl Johnson
Fixes #30715 Change-Id: Ia3712d248b6dc86abef71ccea6e705a571933d53 GitHub-Last-Rev: 6ae68402a5a7c57f7f18e945d48c69ba2b134078 GitHub-Pull-Request: golang/go#49359 Reviewed-on: https://go-review.googlesource.com/c/go/+/361397 Reviewed-by: Ian Lance Taylor <iant@google.com> Run-TryBot: Ian Lance Taylor <iant@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com> Reviewed-by: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-04-15net/http: remove cloneURL call in WithContextBobby Powers
Fixes #52239 Change-Id: I08b75e613e3c976855e39d01a6757d94e4207bf8 Reviewed-on: https://go-review.googlesource.com/c/go/+/399155 Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Run-TryBot: Damien Neil <dneil@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com>
2022-04-11all: gofmt main repoRuss Cox
[This CL is part of a sequence implementing the proposal #51082. The design doc is at https://go.dev/s/godocfmt-design.] Run the updated gofmt, which reformats doc comments, on the main repository. Vendored files are excluded. For #51082. Change-Id: I7332f099b60f716295fb34719c98c04eb1a85407 Reviewed-on: https://go-review.googlesource.com/c/go/+/384268 Reviewed-by: Jonathan Amsterdam <jba@google.com> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2022-03-22net/http: fix nil body causing ParseMultipartForm to panichopehook
ParseMultipartForm relies on a valid multipartReader, if the request body is nil, the multipartReader should return an error. This way ParseMultipartForm can return an error instead of causing mr.ReadForm(maxMemory) to panic Fixes #48206 Change-Id: Ief906f2340c7ab29cacbd5f56892117202a0b911 Reviewed-on: https://go-review.googlesource.com/c/go/+/384454 Trust: Damien Neil <dneil@google.com> Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Trust: Brad Fitzpatrick <bradfitz@golang.org>
2022-03-20net/http: flesh out Request.SetBasicAuth docs a bitBrad Fitzpatrick
Clarify that username can't contain a colon. See https://go.dev/play/p/aM25UHC6n98 Change-Id: I342575107104cbcd28b1d3442c474adf93b7f03c Reviewed-on: https://go-review.googlesource.com/c/go/+/394115 Trust: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2021-10-06all: use bytes.Cut, strings.CutRuss Cox
Many uses of Index/IndexByte/IndexRune/Split/SplitN can be written more clearly using the new Cut functions. Do that. Also rewrite to other functions if that's clearer. For #46336. Change-Id: I68d024716ace41a57a8bf74455c62279bde0f448 Reviewed-on: https://go-review.googlesource.com/c/go/+/351711 Trust: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2021-10-06net/http: parse HTTP version strings according to RFC 7230Damien Neil
RFC 2616 permits multiple digits in the major and minor numbers of an HTTP version: https://datatracker.ietf.org/doc/html/rfc2616#section-3.1 RFC 7230 obsoletes 2616 and tightens the specification to permit only a single digit in the major and minor number: https://datatracker.ietf.org/doc/html/rfc7230#section-2.6 Use the stricter definition. Also fix a bug which caused version numbers with a leading "+" to be accepted (e.g., "HTTP/1.+1".) Fixes #46587. Change-Id: Ic5923bb858e5ac402cfde486fba2c075e221553d Reviewed-on: https://go-review.googlesource.com/c/go/+/325874 Trust: Damien Neil <dneil@google.com> Trust: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2021-06-09net/url: reject query values with semicolonsKatie Hockman
Semicolons are no longer valid separators, so net/url.ParseQuery will now return an error if any part of the query contains a semicolon. net/http.(*Request).ParseMultipartForm has been changed to fall through and continue parsing even if the call to (*Request).ParseForm fails. This change also includes a few minor refactors to existing tests. Fixes #25192 Change-Id: Iba3f108950fb99b9288e402c41fe71ca3a2ababd Reviewed-on: https://go-review.googlesource.com/c/go/+/325697 Trust: Katie Hockman <katie@golang.org> Run-TryBot: Katie Hockman <katie@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Filippo Valsorda <filippo@golang.org>
2021-05-10net/http: switch HTTP1 to ASCII equivalents of string functionsRoberto Clapis
The current implementation uses UTF-aware functions like strings.EqualFold and strings.ToLower. This could, in some cases, cause http smuggling. Change-Id: I0e76a993470a1e1b1b472f4b2859ea0a2b22ada0 Reviewed-on: https://go-review.googlesource.com/c/go/+/308009 Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Trust: Roberto Clapis <roberto@golang.org> Reviewed-by: Filippo Valsorda <filippo@golang.org>
2021-04-16net/http: make ReadRequest return an error when requests have multiple Host ↵ian woolf
headers Fixes #45513 Change-Id: I59e717a4bbd3e71320deff519e4f9587ee5c8756 Reviewed-on: https://go-review.googlesource.com/c/go/+/308952 Trust: Damien Neil <dneil@google.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2021-03-23net/http: treat MaxBytesReader's negative limits as equivalent to zero limitArtur M. Wolff
Current MaxBytesReader behaviour differs from its documentation. It's not similar enough to io.LimitReader. It panics when limit (n) < -1 and returns [-1, <nil>] when limit (n) = -1. To fix that, we treat all negative limits as equivalent to 0. It would be possible to make MaxBytesReader analogically identical in behaviour to io.LimitReader, but that would require to stop maxBytesReader's Read from reading past the limit. Read always reads one more byte (if possible) for non-negative limits and returns a non-EOF error. This behaviour will now apply to all limits. Fixes #45101 Change-Id: I25d1877dbff1eb4b195c8741fe5e4a025d01ebc0 Reviewed-on: https://go-review.googlesource.com/c/go/+/303171 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org> Trust: Damien Neil <dneil@google.com> Trust: Dmitri Shuralyov <dmitshur@golang.org> Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Go Bot <gobot@golang.org>
2021-03-13net/http: note that "HTTP/2" is invalid for ParseHTTPVersionJosh Deprez
Change-Id: Ieba05dea892ec9855a63b80e456bcf9188eef855 GitHub-Last-Rev: 5f7663ac4aaecb01a27a04309277240fd15759c9 GitHub-Pull-Request: golang/go#41806 Reviewed-on: https://go-review.googlesource.com/c/go/+/259758 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Emmanuel Odeke <emmanuel@orijtech.com> Trust: Damien Neil <dneil@google.com>
2021-03-11docs: clarify when APIs use context.Background.Matt T. Proud
The Go standard library retrofitted context support onto existing APIs using context.Background and later offered variants that directly supported user-defined context value specification. This commit makes that behavior clear in documentation and suggests context-aware alternatives if the user is looking for one. An example motivation is supporting code for use in systems that expect APIs to be cancelable for lifecycle correctness or load shedding/management reasons, as alluded to in https://blog.golang.org/context-and-structs. Updates #44143 Change-Id: I2d7f954ddf9b48264d5ebc8d0007058ff9bddf14 Reviewed-on: https://go-review.googlesource.com/c/go/+/296152 Reviewed-by: Ian Lance Taylor <iant@golang.org> Reviewed-by: Jean de Klerk <deklerk@google.com> Trust: Jean de Klerk <deklerk@google.com> Run-TryBot: Jean de Klerk <deklerk@google.com> TryBot-Result: Go Bot <gobot@golang.org>
2020-10-20all: update references to symbols moved from io/ioutil to ioRuss Cox
The old ioutil references are still valid, but update our code to reflect best practices and get used to the new locations. Code compiled with the bootstrap toolchain (cmd/asm, cmd/dist, cmd/compile, debug/elf) must remain Go 1.4-compatible and is excluded. Also excluded vendored code. For #41190. Change-Id: I6d86f2bf7bc37a9d904b6cee3fe0c7af6d94d5b1 Reviewed-on: https://go-review.googlesource.com/c/go/+/263142 Trust: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com>
2020-10-16net/http: ensure Request.Body.Close is called once and only onceRoss Light
Makes *Request.write always close the body, so that callers no longer have to close the body on returned errors, which was the trigger for double-close behavior. Fixes #40382 Change-Id: I128f7ec70415f240d82154cfca134b3f692191e3 Reviewed-on: https://go-review.googlesource.com/c/go/+/257819 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Trust: Damien Neil <dneil@google.com> Trust: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Go Bot <gobot@golang.org>
2020-10-16net/http: document concurrency expectations for Request.BodyRoss Light
This is primarily aimed at client requests where the user can supply their own io.ReadCloser, but also clarifies server request behavior. A server request body can be one of: - *body - *http2RequestBody - *expectContinueReader - *maxBytesReader Of those, *expectContinueReader did not meet these expectations, so this change also removes the data race. Change-Id: Id4f1ae573d938347b1123a7b612b271aabb045a4 Reviewed-on: https://go-review.googlesource.com/c/go/+/251087 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Russ Cox <rsc@golang.org> Trust: Damien Neil <dneil@google.com> Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Go Bot <gobot@golang.org>
2020-10-12net/http: deep copy Request.TransferEncodingdqu123
The existing implementation in Request.Clone() assigns the wrong pointer to r2.TransferEncoding. Fixes #41907 Change-Id: I7f220a41b1b46a55d1a1005e47c6dd69478cb025 Reviewed-on: https://go-review.googlesource.com/c/go/+/261258 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com> Trust: Emmanuel Odeke <emm.odeke@gmail.com>
2020-06-08all: avoid awkward wording from CL 236857Russ Cox
CL 236857 removed all uses of whitelist/blacklist, which is great. But it substituted awkward phrasing using allowlist/blocklist, especially as verbs or participles. This CL uses more standard English, like "allow the function" or "blocked functions" instead of "allowlist the function" or "blocklisted functions". Change-Id: I9106a2fdbd62751c4cbda3a77181358a8a6d0f13 Reviewed-on: https://go-review.googlesource.com/c/go/+/236917 Run-TryBot: Russ Cox <rsc@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2020-06-08all: replace usages of whitelist/blacklist and master/slaveFilippo Valsorda
There's been plenty of discussion on the usage of these terms in tech. I'm not trying to have yet another debate. It's clear that there are people who are hurt by them and who are made to feel unwelcome by their use due not to technical reasons but to their historical and social context. That's simply enough reason to replace them. Anyway, allowlist and blocklist are more self-explanatory than whitelist and blacklist, so this change has negative cost. Didn't change vendored, bundled, and minified files. Nearly all changes are tests or comments, with a couple renames in cmd/link and cmd/oldlink which are extremely safe. This should be fine to land during the freeze without even asking for an exception. Change-Id: I8fc54a3c8f9cc1973b710bbb9558a9e45810b896 Reviewed-on: https://go-review.googlesource.com/c/go/+/236857 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Khosrow Moossavi <khos2ow@gmail.com> Reviewed-by: Leigh McCulloch <leighmcc@gmail.com> Reviewed-by: Urban Ishimwe <urbainishimwe@gmail.com>
2020-05-29net/http: clarify that AddCookie only sanitizes the Cookie being addedVolker Dobler
AddCookie properly encodes a cookie and appends it to the Cookie header field but does not modify or sanitize what the Cookie header field contains already. If a user manualy sets the Cookie header field to something not conforming to RFC 6265 then a cookie added via AddCookie might not be retrievable. Fixes #38437 Change-Id: I232b64ac489b39bb962fe4f7dbdc2ae44fcc0514 Reviewed-on: https://go-review.googlesource.com/c/go/+/235141 Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com> Run-TryBot: Emmanuel Odeke <emm.odeke@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2020-05-01net/http: remove badStringError, make some unexported structs non-comparableBrad Fitzpatrick
Reduces binary size by 4K, not counting the http2 changes (in CL 231119) that'll be bundled into this package in the future. Updates golang/go#38782 Change-Id: Id360348707e076b8310a8f409e412d68dd2394b2 Reviewed-on: https://go-review.googlesource.com/c/go/+/231118 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2020-01-08net/http: document that ParseForm consumes Request.BodyLuka Zitnik
Fixes #35620 Change-Id: I71bc56ec7a7507d14b4f013177b4b816bb1a2094 Reviewed-on: https://go-review.googlesource.com/c/go/+/212458 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2019-12-12net/http: fix some awkward wording in Request.WithContext docsBrad Fitzpatrick
Change-Id: Ib37db42c7f1fd6aa55f70fd2d65d56bb2ae6d26a Reviewed-on: https://go-review.googlesource.com/c/go/+/211098 Reviewed-by: Bryan C. Mills <bcmills@google.com>
2019-10-21net/http: remove parseURL variableDmitri Shuralyov
The parseURL variable was introduced in CL 49930 in order to work around the fact that the name "url" was shadowed by a parameter of exported functions, and couldn't be renamed without sacrificing documentation readability. Documentation readability takes higher priority than internal implementation details. Back then, I considered renaming the net/url import but saw that it would be too disruptive of a change to the large net/http package. Now I see a better way: it's possible to import net/url both as url and as urlpkg (the package is still imported just once, but it becomes available via two names). This way we eliminate the need for wasting (a little) memory on the parseURL variable, improve code readability slightly, and delete some lines of code and comments. Updates #21077 Change-Id: I42cd9833afdcf4a5f5874fb7ee9c8c11eae557dc Reviewed-on: https://go-review.googlesource.com/c/go/+/202482 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Robert Griesemer <gri@golang.org>
2019-10-02net/http: document that Request.Host includes HTTP/2 :authorityBrad Fitzpatrick
Fixes #34640 Change-Id: I4a6c9414fe369cd5e9915472331c4bd8a21d8b0e Reviewed-on: https://go-review.googlesource.com/c/go/+/198457 Reviewed-by: Filippo Valsorda <filippo@golang.org>
2019-09-07net/http: make copyValues append instead of calling Addsmasher164
This results in a performance boost: name old time/op new time/op delta CopyValues-4 3.46µs ± 3% 1.53µs ± 3% -55.85% (p=0.000 n=18+19) name old alloc/op new alloc/op delta CopyValues-4 1.52kB ± 0% 0.74kB ± 0% -51.58% (p=0.000 n=20+20) name old allocs/op new allocs/op delta CopyValues-4 24.0 ± 0% 11.0 ± 0% -54.17% (p=0.000 n=20+20) Fixes #33744. Change-Id: Ibc653fb076a9a6aaa775fcc9ca720fb90e68cf96 Reviewed-on: https://go-review.googlesource.com/c/go/+/191057 Run-TryBot: Emmanuel Odeke <emm.odeke@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com>
2019-08-27net/http: fix a typo in commentsJavier Revillas
HTTP is an initialism, not an acronym, where you pronounce each letter as a word. It's "an H", not "a H". Running `find src/net/http -type f | xargs grep -n 'an HTTP' | wc -l` shows that the "an HTTP" form is used 67 times across the `net/http` package. Furthermore, `find src/net/http -type f | xargs grep -n 'a HTTP' | wc -l` yields only 4 results. Change-Id: I219c292a9e2c9bf7a009dbfe82ea8b15874685e9 GitHub-Last-Rev: 6ebd095023af47444b6b0fc5b6d7b26d85f4c7b7 GitHub-Pull-Request: golang/go#33810 Reviewed-on: https://go-review.googlesource.com/c/go/+/191700 Reviewed-by: Toshihiro Shiino <shiino.toshihiro@gmail.com> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2019-08-01net/http: fix a typo in spelling of MultiPartFormDarren McCleary
Change-Id: I33a5313ef10e8c88d9c12507573b385fa0843afe GitHub-Last-Rev: 844d4351583e3f2e94d6420dcd50d50845d1b4cb GitHub-Pull-Request: golang/go#33412 Reviewed-on: https://go-review.googlesource.com/c/go/+/188498 Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com>
2019-07-30net/http: improve Request.Form and Request.PostForm documentationDavid Ndungu
Request.PostForm gets populated with form data for PATCH, POST, or PUT http verbs. Change-Id: I33065aa78a8470c4e9490aac830aa6f5963c61cb Reviewed-on: https://go-review.googlesource.com/c/go/+/187821 Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com>
2019-05-03net/http: add func NewRequestWithContext, Request.CloneBrad Fitzpatrick
Fixes #23544 Change-Id: Iaa31d76c4cda8ce22412d73c9025fc57e4fb1967 Reviewed-on: https://go-review.googlesource.com/c/go/+/174324 Reviewed-by: Andrew Bonventre <andybons@golang.org>
2019-04-22net/http: document that Basic Auth may require URL encodingBenoit Sigoure
Explicitly warn callers that no URL encoding is performed and that they might need to do it. Fixes #31577 Change-Id: I52dc3fd2798ba8c3652d4a967b1c5c48eb69f43b Reviewed-on: https://go-review.googlesource.com/c/go/+/173319 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2019-04-16all: s/cancelation/cancellation/Josh Bleecher Snyder
Though there is variation in the spelling of canceled, cancellation is always spelled with a double l. Reference: https://www.grammarly.com/blog/canceled-vs-cancelled/ Change-Id: I240f1a297776c8e27e74f3eca566d2bc4c856f2f Reviewed-on: https://go-review.googlesource.com/c/go/+/170060 Run-TryBot: Josh Bleecher Snyder <josharian@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2019-03-11all: move internal/x to vendor/golang.org/x and revendor using 'go mod vendor'Bryan C. Mills
This also updates the vendored-in versions of several packages: 'go mod vendor' selects a consistent version of each module, but we had previously vendored an ad-hoc selection of packages. Notably, x/crypto/hkdf was previously vendored in at a much newer commit than the rest of x/crypto. Bringing the rest of x/crypto up to that commit introduced an import of golang.org/x/sys/cpu, which broke the js/wasm build, requiring an upgrade of x/sys to pick up CL 165749. Updates #30228 Updates #30241 Updates #25822 Change-Id: I5b3dbc232b7e6a048a158cbd8d36137af1efb711 Reviewed-on: https://go-review.googlesource.com/c/go/+/164623 Reviewed-by: Filippo Valsorda <filippo@golang.org>
generated by cgit v1.3 (git 2.53.0) at 2026-04-15 07:47:46 +0000