aboutsummaryrefslogtreecommitdiff
path: root/src/net/http/request.go
AgeCommit message (Collapse)Author
2026-03-11net/http: document which headers Request.Write handles speciallykovan
Document that Header values for Host, Content-Length, Transfer-Encoding, and Trailer are not used by Write, as these are derived from other Request fields. Also document that User-Agent defaults to "Go-http-client/1.1" if not set in Header. Fixes #68635 Change-Id: Ie182777ae094657cf3971fed989af1bd5e875d9f Reviewed-on: https://go-review.googlesource.com/c/go/+/741442 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2026-02-06net/http: remove hasPort and simplify logicJorropo
Fixes #76651 Change-Id: I306e127375095bc0caedb01ac458107cfec5f085 Reviewed-on: https://go-review.googlesource.com/c/go/+/725740 Auto-Submit: Sean Liao <sean@liao.dev> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Michael Knyszek <mknyszek@google.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Sean Liao <sean@liao.dev>
2025-04-07net/http: add link to typesabemotion
Some types are not linked. This change adds a link to each type. Change-Id: Id46fb64a74efb851ed76e4136f15e8fd9e445bb7 Reviewed-on: https://go-review.googlesource.com/c/go/+/663075 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Auto-Submit: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Sean Liao <sean@liao.dev> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-03-04net/http: speed up cookie and method validationJulien Cretel
Fixes #67031 Change-Id: I1d764afdc7e50d61007f5f71a674eb6872ce507a GitHub-Last-Rev: 869535e843d2133fa5279297b002dd96725384e0 GitHub-Pull-Request: golang/go#71798 Reviewed-on: https://go-review.googlesource.com/c/go/+/650195 Auto-Submit: Sean Liao <sean@liao.dev> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Sean Liao <sean@liao.dev> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Michael Knyszek <mknyszek@google.com>
2025-02-18all: use a more straightforward return valuecuishuang
Change-Id: I27e86c221da7f541c4823f501801e02942c9a829 Reviewed-on: https://go-review.googlesource.com/c/go/+/649935 Auto-Submit: Ian Lance Taylor <iant@google.com> Reviewed-by: Michael Knyszek <mknyszek@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Ian Lance Taylor <iant@google.com>
2025-01-06net/http: update NewRequestWithContext wrong link to NewRequestyincong
Fixes #70874 Change-Id: Icbcfc95e6b45521880287dcc3bc8609461a3b401 GitHub-Last-Rev: 05276c56b019d8774e8eee881101509cf83c0f3d GitHub-Pull-Request: golang/go#70877 Reviewed-on: https://go-review.googlesource.com/c/go/+/637035 Reviewed-by: qiu laidongfeng2 <2645477756@qq.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: David Chase <drchase@google.com> Auto-Submit: Ian Lance Taylor <iant@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Ian Lance Taylor <iant@google.com>
2024-08-27net/http: simplify http.Request.CloneJes Cok
By using maps.Clone and omitting nil checks when calling http.Header.Clone. I'm not using slices.Clone because the result of slices.Clone may have additional unused capacity. Change-Id: I4aed0fea218404c7270e35324e6bd62d855296c7 GitHub-Last-Rev: 9fd5dd59078c69c9a8057f6fc4a90f7c6aac893b GitHub-Pull-Request: golang/go#69070 Reviewed-on: https://go-review.googlesource.com/c/go/+/608295 Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Michael Pratt <mpratt@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2024-06-24net/http: document that Request.Clone does not deep copy BodyDamien Neil
Fixes #36095 Change-Id: I94ae014b0ee45b4aeb38cb247e42cfc13f663ded Reviewed-on: https://go-review.googlesource.com/c/go/+/593175 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Jonathan Amsterdam <jba@google.com>
2024-05-29all: document legacy //go:linkname for final round of modulesRuss Cox
Add linknames for most modules with ≥50 dependents. Add linknames for a few other modules that we know are important but are below 50. Remove linknames from badlinkname.go that do not merit inclusion (very small number of dependents). We can add them back later if the need arises. Fixes #67401. (For now.) Change-Id: I1e49fec0292265256044d64b1841d366c4106002 Reviewed-on: https://go-review.googlesource.com/c/go/+/587756 Auto-Submit: Russ Cox <rsc@golang.org> TryBot-Bypass: Russ Cox <rsc@golang.org> Reviewed-by: Cherry Mui <cherryyz@google.com>
2024-05-23all: document legacy //go:linkname for modules with ≥500 dependentsRuss Cox
For #67401. Change-Id: I7dd28c3b01a1a647f84929d15412aa43ab0089ee Reviewed-on: https://go-review.googlesource.com/c/go/+/587575 Reviewed-by: Cherry Mui <cherryyz@google.com> Auto-Submit: Russ Cox <rsc@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2024-05-16net/http: add Pattern field in Request to return matched pattern infoChen.Zhidong
Fixes #66405 Change-Id: Icd80944b6ca081aa7addd4fb85d2b3c29b6c9542 GitHub-Last-Rev: c6e32742c4b733230c82627571b423de45997c24 GitHub-Pull-Request: golang/go#66618 Reviewed-on: https://go-review.googlesource.com/c/go/+/574997 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Jonathan Amsterdam <jba@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2024-04-19net/http: add field Cookie.Quoted boolNuno Gonçalves
The current implementation of the http package strips double quotes from the cookie-value during parsing, resulting in the serialized cookie not including them. This patch addresses this limitation by introducing a new field to track whether the original value was enclosed in quotes. Additionally, the internal representation of a cookie in the cookiejar package has been adjusted to align with the new representation. The syntax of cookies is outlined in RFC 6265 Section 4.1.1: https://datatracker.ietf.org/doc/html/rfc6265\#section-4.1.1 Fixes #46443 Change-Id: Iac12a56397d77a6060a75757ab0daeacc60457f3 GitHub-Last-Rev: a76440e741440cddaa05944b6828a14a32b5a44a GitHub-Pull-Request: golang/go#66752 Reviewed-on: https://go-review.googlesource.com/c/go/+/577755 Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Cherry Mui <cherryyz@google.com>
2024-03-20net/http: add Request.CookiesNamedTimo Furrer
Implements a new method http.Request.CookiesName, that allows retrieving all cookies that match the given name. Fixes #61472 Change-Id: I405d8771b4195af9ff6b4dfde3cfcd316c23b70c GitHub-Last-Rev: 6ad0094995b45648ebbcd18626f07bb879a3f7cf GitHub-Pull-Request: golang/go#61473 Reviewed-on: https://go-review.googlesource.com/c/go/+/511516 Reviewed-by: Emmanuel Odeke <emmanuel@orijtech.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Carlos Amedee <carlos@golang.org> Reviewed-by: Damien Neil <dneil@google.com>
2024-01-10net: add available godoc linkcui fliter
Change-Id: Ib7c4baf0247c421954aedabfbb6a6af8a08a8936 Reviewed-on: https://go-review.googlesource.com/c/go/+/540021 Reviewed-by: Damien Neil <dneil@google.com> Run-TryBot: shuang cui <imcusg@gmail.com> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2024-01-09net/http: clarify the precedence order for Request.FormValueJes Cok
Fixes #64575 Change-Id: I0eaec642a9dc8ae3b273a6d41131cc7cb8332947 GitHub-Last-Rev: 17aa5170cbfe42cb86d56f1804266850d33c3eb5 GitHub-Pull-Request: golang/go#64578 Reviewed-on: https://go-review.googlesource.com/c/go/+/547855 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2024-01-03net/http: make Request.Clone create fresh copies for matches and otherValuesJes Cok
This change fixes Request.Clone to correctly work with SetPathValue by creating fresh copies for matches and otherValues so that SetPathValue for cloned requests doesn't pollute the original request. While here, also added a doc for Request.SetPathValue. Fixes #64911 Change-Id: I2831b38e135935dfaea2b939bb9db554c75b65ef GitHub-Last-Rev: 1981db16475a49fe8d4b874a6bceec64d28a1332 GitHub-Pull-Request: golang/go#64913 Reviewed-on: https://go-review.googlesource.com/c/go/+/553375 Reviewed-by: Emmanuel Odeke <emmanuel@orijtech.com> Run-TryBot: Jes Cok <xigua67damn@gmail.com> Auto-Submit: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Jonathan Amsterdam <jba@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2023-10-23net/http: remove outdated comment about a support of CONNECT methodKeiichi Hirobe
The net/http.Transport already supports CONNECT after https://go-review.googlesource.com/c/go/+/123156 was merged, which deleted comments in transport.go. Change-Id: I784fdb9b044bc8a4a29bf252328c80a11aaf6901 Reviewed-on: https://go-review.googlesource.com/c/go/+/536057 Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: David Chase <drchase@google.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Damien Neil <dneil@google.com>
2023-09-14net/http: implement path value methods on RequestJonathan Amsterdam
Add Request.PathValue and Request.SetPathValue, and the fields on Request required to support them. Populate those fields in ServeMux.ServeHTTP. Updates #61410. Change-Id: Ic88cb865b0d865a30d3b35ece8e0382c58ef67d1 Reviewed-on: https://go-review.googlesource.com/c/go/+/528355 Run-TryBot: Jonathan Amsterdam <jba@google.com> Reviewed-by: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-08-25net/http: document when request bodies are closed in more placesDamien Neil
It isn't obvious that request bodies can be closed asynchronously, and it's easy to overlook the documentation of this fact in RoundTripper, which is a fairly low-level interface. Change-Id: I3b825c505418af7e1d3f6ed58f3704e55cf16901 Reviewed-on: https://go-review.googlesource.com/c/go/+/523036 TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Damien Neil <dneil@google.com> Reviewed-by: Bryan Mills <bcmills@google.com> Auto-Submit: Damien Neil <dneil@google.com>
2023-08-08net/http: sanitize User-Agent header in request writerDamien Neil
Apply the same transformations to the User-Agent header value that we do to other headers. Avoids header and request smuggling in Request.Write and Request.WriteProxy. RoundTrip already validates values in Request.Header, and didn't allow bad User-Agent values to make it as far as the request writer. Fixes #61824 Change-Id: I360a915c7e08d014e0532bd5af196a5b59c89395 Reviewed-on: https://go-review.googlesource.com/c/go/+/516836 Reviewed-by: Jonathan Amsterdam <jba@google.com> Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-08-07net/http: permit requests with invalid Host headersDamien Neil
Historically, the Transport has silently truncated invalid Host headers at the first '/' or ' ' character. CL 506996 changed this behavior to reject invalid Host headers entirely. Unfortunately, Docker appears to rely on the previous behavior. When sending a HTTP/1 request with an invalid Host, send an empty Host header. This is safer than truncation: If you care about the Host, then you should get the one you set; if you don't care, then an empty Host should be fine. Continue to fully validate Host headers sent to a proxy, since proxies generally can't productively forward requests without a Host. For #60374 Fixes #61431 Change-Id: If170c7dd860aa20eb58fe32990fc93af832742b6 Reviewed-on: https://go-review.googlesource.com/c/go/+/511155 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> Run-TryBot: Damien Neil <dneil@google.com>
2023-07-31net/http: fix doc comment on FormValue functionEduard Bondarenko
This function checks Request.Form, which now includes values parsed from a PATCH request. Fixes #60585 Change-Id: Icb095d9ac2f8b0c5dbf313e507ed838cb941517f GitHub-Last-Rev: 3a477ea97e27f5b31d28085df75163fc13541c13 GitHub-Pull-Request: golang/go#61591 Reviewed-on: https://go-review.googlesource.com/c/go/+/513435 Reviewed-by: David Chase <drchase@google.com> Reviewed-by: Damien Neil <dneil@google.com> Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Damien Neil <dneil@google.com>
2023-06-29net/http: validate Host header before sendingDamien Neil
Verify that the Host header we send is valid. Avoids surprising behavior such as a Host of "go.dev\r\nX-Evil:oops" adding an X-Evil header to HTTP/1 requests. Add a test, skip the test for HTTP/2. HTTP/2 is not vulnerable to header injection in the way HTTP/1 is, but x/net/http2 doesn't validate the header and will go into a retry loop when the server rejects it. CL 506995 adds the necessary validation to x/net/http2. For #60374 Change-Id: I05cb6866a9bead043101954dfded199258c6dd04 Reviewed-on: https://go-review.googlesource.com/c/go/+/506996 Reviewed-by: Tatiana Bradley <tatianabradley@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Damien Neil <dneil@google.com>
2023-05-10net/http: let ErrNotSupported match errors.ErrUnsupportedIan Lance Taylor
For #41198 Change-Id: Ibb030e94618a1f594cfd98ddea214ad7a88d2e73 Reviewed-on: https://go-review.googlesource.com/c/go/+/494122 Auto-Submit: Ian Lance Taylor <iant@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Run-TryBot: Ian Lance Taylor <iant@golang.org> Reviewed-by: Bryan Mills <bcmills@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-11-10net/http: add ResponseController and per-handler timeoutsDamien Neil
The ResponseController type provides a discoverable interface to optional methods implemented by ResponseWriters. c := http.NewResponseController(w) c.Flush() vs. if f, ok := w.(http.Flusher); ok { f.Flush() } Add the ability to control per-request read and write deadlines via the ResponseController SetReadDeadline and SetWriteDeadline methods. For #54136 Change-Id: I3f97de60d4c9ff150cda559ef86c6620eee665d2 Reviewed-on: https://go-review.googlesource.com/c/go/+/436890 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Bryan Mills <bcmills@google.com> Run-TryBot: Damien Neil <dneil@google.com>
2022-09-27net/http: fix the potential leak of textproto.Reader from poolAndy Pan
Fixes #55835 Change-Id: I6109bab2941b859e8cfef22f65a6a3a5f977a8d7 Reviewed-on: https://go-review.googlesource.com/c/go/+/433835 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com> Run-TryBot: Andy Pan <panjf2000@gmail.com> Run-TryBot: Ian Lance Taylor <iant@google.com>
2022-08-26net/http: don't panic on very large MaxBytesReaderLimitcuiweixie
Fixes #54408 Change-Id: I454199ae5bcd087b8fc4169b7622412105e71113 GitHub-Last-Rev: a33fe7e206d0c394440962acd360df3aa9b117c3 GitHub-Pull-Request: golang/go#54415 Reviewed-on: https://go-review.googlesource.com/c/go/+/423314 Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> Run-TryBot: xie cui <523516579@qq.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: David Chase <drchase@google.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: hopehook <hopehook@qq.com>
2022-08-17net/http: return ErrNoCookie from Request.Cookie when name is ""muyizixiu
Request.Cookie(name string) will return the first cookie when cookie name is "". Since readCookies in file net/http/cookie.go at line 247 return all cookies when second parameter is a empty string. To fix it, Return ErrNoCookie from Request.Cookie(""), instead of the first cookie in the request. Fixes #53181 Change-Id: Ie623ca4c53da64ef7623a7863292a2d771f76832 GitHub-Last-Rev: 01098cd5dbcc8d65e9c0893e0586601584e5f8b9 GitHub-Pull-Request: golang/go#53183 Reviewed-on: https://go-review.googlesource.com/c/go/+/409754 Reviewed-by: Ian Lance Taylor <iant@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2022-08-15net/http: make Request.WithContext documentation less prescriptiveDamien Neil
WithContext makes a shallow copy of a Request, and Clone makes a deep copy. Both set the context of the new request. The distinction between the two is clear, and it doesn't seem useful or necessary to say that "it's rare to need WithContext". Also update a couple locations that mention WithContext to mention Clone as well. Fixes #53413. Change-Id: I89e6ddebd7d5ca6573e522fe48cd7f50cc645cdd Reviewed-on: https://go-review.googlesource.com/c/go/+/412778 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Robert Findley <rfindley@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Damien Neil <dneil@google.com>
2022-07-12net/http: clarify that MaxBytesReader returns *MaxBytesErrorDamien Neil
A MaxBytesReader returns a *MaxBytesError when reading beyond its limit, not a MaxBytesError. Fixes #53764. Change-Id: Icac3aeac96fd8b172f951241f8f111cda633752c Reviewed-on: https://go-review.googlesource.com/c/go/+/416914 Reviewed-by: Ian Lance Taylor <iant@google.com> Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-04-25net/http: add MaxBytesErrorCarl Johnson
Fixes #30715 Change-Id: Ia3712d248b6dc86abef71ccea6e705a571933d53 GitHub-Last-Rev: 6ae68402a5a7c57f7f18e945d48c69ba2b134078 GitHub-Pull-Request: golang/go#49359 Reviewed-on: https://go-review.googlesource.com/c/go/+/361397 Reviewed-by: Ian Lance Taylor <iant@google.com> Run-TryBot: Ian Lance Taylor <iant@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com> Reviewed-by: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-04-15net/http: remove cloneURL call in WithContextBobby Powers
Fixes #52239 Change-Id: I08b75e613e3c976855e39d01a6757d94e4207bf8 Reviewed-on: https://go-review.googlesource.com/c/go/+/399155 Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Run-TryBot: Damien Neil <dneil@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com>
2022-04-11all: gofmt main repoRuss Cox
[This CL is part of a sequence implementing the proposal #51082. The design doc is at https://go.dev/s/godocfmt-design.] Run the updated gofmt, which reformats doc comments, on the main repository. Vendored files are excluded. For #51082. Change-Id: I7332f099b60f716295fb34719c98c04eb1a85407 Reviewed-on: https://go-review.googlesource.com/c/go/+/384268 Reviewed-by: Jonathan Amsterdam <jba@google.com> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2022-03-22net/http: fix nil body causing ParseMultipartForm to panichopehook
ParseMultipartForm relies on a valid multipartReader, if the request body is nil, the multipartReader should return an error. This way ParseMultipartForm can return an error instead of causing mr.ReadForm(maxMemory) to panic Fixes #48206 Change-Id: Ief906f2340c7ab29cacbd5f56892117202a0b911 Reviewed-on: https://go-review.googlesource.com/c/go/+/384454 Trust: Damien Neil <dneil@google.com> Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Trust: Brad Fitzpatrick <bradfitz@golang.org>
2022-03-20net/http: flesh out Request.SetBasicAuth docs a bitBrad Fitzpatrick
Clarify that username can't contain a colon. See https://go.dev/play/p/aM25UHC6n98 Change-Id: I342575107104cbcd28b1d3442c474adf93b7f03c Reviewed-on: https://go-review.googlesource.com/c/go/+/394115 Trust: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2021-10-06all: use bytes.Cut, strings.CutRuss Cox
Many uses of Index/IndexByte/IndexRune/Split/SplitN can be written more clearly using the new Cut functions. Do that. Also rewrite to other functions if that's clearer. For #46336. Change-Id: I68d024716ace41a57a8bf74455c62279bde0f448 Reviewed-on: https://go-review.googlesource.com/c/go/+/351711 Trust: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2021-10-06net/http: parse HTTP version strings according to RFC 7230Damien Neil
RFC 2616 permits multiple digits in the major and minor numbers of an HTTP version: https://datatracker.ietf.org/doc/html/rfc2616#section-3.1 RFC 7230 obsoletes 2616 and tightens the specification to permit only a single digit in the major and minor number: https://datatracker.ietf.org/doc/html/rfc7230#section-2.6 Use the stricter definition. Also fix a bug which caused version numbers with a leading "+" to be accepted (e.g., "HTTP/1.+1".) Fixes #46587. Change-Id: Ic5923bb858e5ac402cfde486fba2c075e221553d Reviewed-on: https://go-review.googlesource.com/c/go/+/325874 Trust: Damien Neil <dneil@google.com> Trust: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2021-06-09net/url: reject query values with semicolonsKatie Hockman
Semicolons are no longer valid separators, so net/url.ParseQuery will now return an error if any part of the query contains a semicolon. net/http.(*Request).ParseMultipartForm has been changed to fall through and continue parsing even if the call to (*Request).ParseForm fails. This change also includes a few minor refactors to existing tests. Fixes #25192 Change-Id: Iba3f108950fb99b9288e402c41fe71ca3a2ababd Reviewed-on: https://go-review.googlesource.com/c/go/+/325697 Trust: Katie Hockman <katie@golang.org> Run-TryBot: Katie Hockman <katie@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Filippo Valsorda <filippo@golang.org>
2021-05-10net/http: switch HTTP1 to ASCII equivalents of string functionsRoberto Clapis
The current implementation uses UTF-aware functions like strings.EqualFold and strings.ToLower. This could, in some cases, cause http smuggling. Change-Id: I0e76a993470a1e1b1b472f4b2859ea0a2b22ada0 Reviewed-on: https://go-review.googlesource.com/c/go/+/308009 Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Trust: Roberto Clapis <roberto@golang.org> Reviewed-by: Filippo Valsorda <filippo@golang.org>
2021-04-16net/http: make ReadRequest return an error when requests have multiple Host ↵ian woolf
headers Fixes #45513 Change-Id: I59e717a4bbd3e71320deff519e4f9587ee5c8756 Reviewed-on: https://go-review.googlesource.com/c/go/+/308952 Trust: Damien Neil <dneil@google.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2021-03-23net/http: treat MaxBytesReader's negative limits as equivalent to zero limitArtur M. Wolff
Current MaxBytesReader behaviour differs from its documentation. It's not similar enough to io.LimitReader. It panics when limit (n) < -1 and returns [-1, <nil>] when limit (n) = -1. To fix that, we treat all negative limits as equivalent to 0. It would be possible to make MaxBytesReader analogically identical in behaviour to io.LimitReader, but that would require to stop maxBytesReader's Read from reading past the limit. Read always reads one more byte (if possible) for non-negative limits and returns a non-EOF error. This behaviour will now apply to all limits. Fixes #45101 Change-Id: I25d1877dbff1eb4b195c8741fe5e4a025d01ebc0 Reviewed-on: https://go-review.googlesource.com/c/go/+/303171 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org> Trust: Damien Neil <dneil@google.com> Trust: Dmitri Shuralyov <dmitshur@golang.org> Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Go Bot <gobot@golang.org>
2021-03-13net/http: note that "HTTP/2" is invalid for ParseHTTPVersionJosh Deprez
Change-Id: Ieba05dea892ec9855a63b80e456bcf9188eef855 GitHub-Last-Rev: 5f7663ac4aaecb01a27a04309277240fd15759c9 GitHub-Pull-Request: golang/go#41806 Reviewed-on: https://go-review.googlesource.com/c/go/+/259758 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Emmanuel Odeke <emmanuel@orijtech.com> Trust: Damien Neil <dneil@google.com>
2021-03-11docs: clarify when APIs use context.Background.Matt T. Proud
The Go standard library retrofitted context support onto existing APIs using context.Background and later offered variants that directly supported user-defined context value specification. This commit makes that behavior clear in documentation and suggests context-aware alternatives if the user is looking for one. An example motivation is supporting code for use in systems that expect APIs to be cancelable for lifecycle correctness or load shedding/management reasons, as alluded to in https://blog.golang.org/context-and-structs. Updates #44143 Change-Id: I2d7f954ddf9b48264d5ebc8d0007058ff9bddf14 Reviewed-on: https://go-review.googlesource.com/c/go/+/296152 Reviewed-by: Ian Lance Taylor <iant@golang.org> Reviewed-by: Jean de Klerk <deklerk@google.com> Trust: Jean de Klerk <deklerk@google.com> Run-TryBot: Jean de Klerk <deklerk@google.com> TryBot-Result: Go Bot <gobot@golang.org>
2020-10-20all: update references to symbols moved from io/ioutil to ioRuss Cox
The old ioutil references are still valid, but update our code to reflect best practices and get used to the new locations. Code compiled with the bootstrap toolchain (cmd/asm, cmd/dist, cmd/compile, debug/elf) must remain Go 1.4-compatible and is excluded. Also excluded vendored code. For #41190. Change-Id: I6d86f2bf7bc37a9d904b6cee3fe0c7af6d94d5b1 Reviewed-on: https://go-review.googlesource.com/c/go/+/263142 Trust: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com>
2020-10-16net/http: ensure Request.Body.Close is called once and only onceRoss Light
Makes *Request.write always close the body, so that callers no longer have to close the body on returned errors, which was the trigger for double-close behavior. Fixes #40382 Change-Id: I128f7ec70415f240d82154cfca134b3f692191e3 Reviewed-on: https://go-review.googlesource.com/c/go/+/257819 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Trust: Damien Neil <dneil@google.com> Trust: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Go Bot <gobot@golang.org>
2020-10-16net/http: document concurrency expectations for Request.BodyRoss Light
This is primarily aimed at client requests where the user can supply their own io.ReadCloser, but also clarifies server request behavior. A server request body can be one of: - *body - *http2RequestBody - *expectContinueReader - *maxBytesReader Of those, *expectContinueReader did not meet these expectations, so this change also removes the data race. Change-Id: Id4f1ae573d938347b1123a7b612b271aabb045a4 Reviewed-on: https://go-review.googlesource.com/c/go/+/251087 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Russ Cox <rsc@golang.org> Trust: Damien Neil <dneil@google.com> Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Go Bot <gobot@golang.org>
2020-10-12net/http: deep copy Request.TransferEncodingdqu123
The existing implementation in Request.Clone() assigns the wrong pointer to r2.TransferEncoding. Fixes #41907 Change-Id: I7f220a41b1b46a55d1a1005e47c6dd69478cb025 Reviewed-on: https://go-review.googlesource.com/c/go/+/261258 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com> Trust: Emmanuel Odeke <emm.odeke@gmail.com>
2020-06-08all: avoid awkward wording from CL 236857Russ Cox
CL 236857 removed all uses of whitelist/blacklist, which is great. But it substituted awkward phrasing using allowlist/blocklist, especially as verbs or participles. This CL uses more standard English, like "allow the function" or "blocked functions" instead of "allowlist the function" or "blocklisted functions". Change-Id: I9106a2fdbd62751c4cbda3a77181358a8a6d0f13 Reviewed-on: https://go-review.googlesource.com/c/go/+/236917 Run-TryBot: Russ Cox <rsc@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2020-06-08all: replace usages of whitelist/blacklist and master/slaveFilippo Valsorda
There's been plenty of discussion on the usage of these terms in tech. I'm not trying to have yet another debate. It's clear that there are people who are hurt by them and who are made to feel unwelcome by their use due not to technical reasons but to their historical and social context. That's simply enough reason to replace them. Anyway, allowlist and blocklist are more self-explanatory than whitelist and blacklist, so this change has negative cost. Didn't change vendored, bundled, and minified files. Nearly all changes are tests or comments, with a couple renames in cmd/link and cmd/oldlink which are extremely safe. This should be fine to land during the freeze without even asking for an exception. Change-Id: I8fc54a3c8f9cc1973b710bbb9558a9e45810b896 Reviewed-on: https://go-review.googlesource.com/c/go/+/236857 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Khosrow Moossavi <khos2ow@gmail.com> Reviewed-by: Leigh McCulloch <leighmcc@gmail.com> Reviewed-by: Urban Ishimwe <urbainishimwe@gmail.com>
2020-05-29net/http: clarify that AddCookie only sanitizes the Cookie being addedVolker Dobler
AddCookie properly encodes a cookie and appends it to the Cookie header field but does not modify or sanitize what the Cookie header field contains already. If a user manualy sets the Cookie header field to something not conforming to RFC 6265 then a cookie added via AddCookie might not be retrievable. Fixes #38437 Change-Id: I232b64ac489b39bb962fe4f7dbdc2ae44fcc0514 Reviewed-on: https://go-review.googlesource.com/c/go/+/235141 Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com> Run-TryBot: Emmanuel Odeke <emm.odeke@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
generated by cgit v1.3 (git 2.53.0) at 2026-04-15 14:36:22 +0000