aboutsummaryrefslogtreecommitdiff
path: root/src/net/http/request_test.go
AgeCommit message (Collapse)Author
2023-02-14mime/multipart: limit memory/inode consumption of ReadFormDamien Neil
Reader.ReadForm is documented as storing "up to maxMemory bytes + 10MB" in memory. Parsed forms can consume substantially more memory than this limit, since ReadForm does not account for map entry overhead and MIME headers. In addition, while the amount of disk memory consumed by ReadForm can be constrained by limiting the size of the parsed input, ReadForm will create one temporary file per form part stored on disk, potentially consuming a large number of inodes. Update ReadForm's memory accounting to include part names, MIME headers, and map entry overhead. Update ReadForm to store all on-disk file parts in a single temporary file. Files returned by FileHeader.Open are documented as having a concrete type of *os.File when a file is stored on disk. The change to use a single temporary file for all parts means that this is no longer the case when a form contains more than a single file part stored on disk. The previous behavior of storing each file part in a separate disk file may be reenabled with GODEBUG=multipartfiles=distinct. Update Reader.NextPart and Reader.NextRawPart to set a 10MiB cap on the size of MIME headers. Thanks to Jakob Ackermann (@das7pad) for reporting this issue. Fixes #58006 Fixes CVE-2022-41725 Change-Id: Ibd780a6c4c83ac8bcfd3cbe344f042e9940f2eab Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1714276 Reviewed-by: Julie Qiu <julieqiu@google.com> TryBot-Result: Security TryBots <security-trybots@go-security-trybots.iam.gserviceaccount.com> Reviewed-by: Roland Shoemaker <bracewell@google.com> Run-TryBot: Damien Neil <dneil@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/468124 Auto-Submit: Michael Pratt <mpratt@google.com> Run-TryBot: Michael Pratt <mpratt@google.com> Reviewed-by: Than McIntosh <thanm@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-10-07net/http: refactor tests to run most in HTTP/1 and HTTP/2 modesDamien Neil
Replace the ad-hoc approach to running tests in HTTP/1 and HTTP/2 modes with a 'run' function that executes a test in various modes. By default, these modes are HTTP/1 and HTTP/2, but tests can opt-in to HTTPS/1 as well. The 'run' function also takes care of post-test cleanup (running the afterTest function). The 'run' function runs tests in parallel by default. Tests which can't run in parallel (generally because they use global test hooks) pass a testNotParallel option to disable parallelism. Update clientServerTest to use t.Cleanup to clean up after itself, rather than leaving this up to tests to handle. Drop an unnecessary mutex in SetReadLoopBeforeNextReadHook. Test hooks can't be set in parallel, and we want the race detector to notify us if two simultaneous tests try to set a hook. Fixes #56032 Change-Id: I16be64913c426fc93d84abc6ad85dbd3bc191224 Reviewed-on: https://go-review.googlesource.com/c/go/+/438137 TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Damien Neil <dneil@google.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: David Chase <drchase@google.com>
2022-09-28all: fix some typoscui fliter
Change-Id: I8b28aebbb9494b2c877139a4584a5a42253e3bea GitHub-Last-Rev: e3703fd3a50b811785df75751472aa3ab098b3d1 GitHub-Pull-Request: golang/go#55902 Reviewed-on: https://go-review.googlesource.com/c/go/+/435617 Reviewed-by: Robert Griesemer <gri@google.com> Reviewed-by: Cherry Mui <cherryyz@google.com>
2022-09-21net/http: accept HEAD requests with a bodyDamien Neil
RFC 7231 permits HEAD requests to contain a body, although it does state there are no defined semantics for payloads of HEAD requests and that some servers may reject HEAD requests with a payload. Accept HEAD requests with a body. Fix a bug where a HEAD request with a chunked body would interpret the body as the headers for the next request on the connection. For #53960. Change-Id: I83f7112fdedabd6d6291cd956151d718ee6942cd Reviewed-on: https://go-review.googlesource.com/c/go/+/418614 Run-TryBot: Damien Neil <dneil@google.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Cherry Mui <cherryyz@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-09-07net/http: use strings.Buildercuiweixie
Change-Id: I754edcf21e003a3f4037fb2c5d8d06f2cd5f2fa3 Reviewed-on: https://go-review.googlesource.com/c/go/+/428267 Auto-Submit: Ian Lance Taylor <iant@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Ian Lance Taylor <iant@google.com> Run-TryBot: xie cui <523516579@qq.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2022-08-26net/http: don't panic on very large MaxBytesReaderLimitcuiweixie
Fixes #54408 Change-Id: I454199ae5bcd087b8fc4169b7622412105e71113 GitHub-Last-Rev: a33fe7e206d0c394440962acd360df3aa9b117c3 GitHub-Pull-Request: golang/go#54415 Reviewed-on: https://go-review.googlesource.com/c/go/+/423314 Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> Run-TryBot: xie cui <523516579@qq.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: David Chase <drchase@google.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: hopehook <hopehook@qq.com>
2022-08-17net/http: return ErrNoCookie from Request.Cookie when name is ""muyizixiu
Request.Cookie(name string) will return the first cookie when cookie name is "". Since readCookies in file net/http/cookie.go at line 247 return all cookies when second parameter is a empty string. To fix it, Return ErrNoCookie from Request.Cookie(""), instead of the first cookie in the request. Fixes #53181 Change-Id: Ie623ca4c53da64ef7623a7863292a2d771f76832 GitHub-Last-Rev: 01098cd5dbcc8d65e9c0893e0586601584e5f8b9 GitHub-Pull-Request: golang/go#53183 Reviewed-on: https://go-review.googlesource.com/c/go/+/409754 Reviewed-by: Ian Lance Taylor <iant@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2022-04-15net/http: remove cloneURL call in WithContextBobby Powers
Fixes #52239 Change-Id: I08b75e613e3c976855e39d01a6757d94e4207bf8 Reviewed-on: https://go-review.googlesource.com/c/go/+/399155 Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Run-TryBot: Damien Neil <dneil@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com>
2021-10-06net/http: parse HTTP version strings according to RFC 7230Damien Neil
RFC 2616 permits multiple digits in the major and minor numbers of an HTTP version: https://datatracker.ietf.org/doc/html/rfc2616#section-3.1 RFC 7230 obsoletes 2616 and tightens the specification to permit only a single digit in the major and minor number: https://datatracker.ietf.org/doc/html/rfc7230#section-2.6 Use the stricter definition. Also fix a bug which caused version numbers with a leading "+" to be accepted (e.g., "HTTP/1.+1".) Fixes #46587. Change-Id: Ic5923bb858e5ac402cfde486fba2c075e221553d Reviewed-on: https://go-review.googlesource.com/c/go/+/325874 Trust: Damien Neil <dneil@google.com> Trust: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2021-06-09net/url: reject query values with semicolonsKatie Hockman
Semicolons are no longer valid separators, so net/url.ParseQuery will now return an error if any part of the query contains a semicolon. net/http.(*Request).ParseMultipartForm has been changed to fall through and continue parsing even if the call to (*Request).ParseForm fails. This change also includes a few minor refactors to existing tests. Fixes #25192 Change-Id: Iba3f108950fb99b9288e402c41fe71ca3a2ababd Reviewed-on: https://go-review.googlesource.com/c/go/+/325697 Trust: Katie Hockman <katie@golang.org> Run-TryBot: Katie Hockman <katie@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Filippo Valsorda <filippo@golang.org>
2021-05-05net/http: ignore directory path when parsing multipart formsKatie Hockman
Fixes #45789 Change-Id: Id588f5dbbecf5fbfb54e957c53903aaa900171f2 Reviewed-on: https://go-review.googlesource.com/c/go/+/313809 Trust: Katie Hockman <katie@golang.org> Run-TryBot: Katie Hockman <katie@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org>
2021-04-16net/http: make ReadRequest return an error when requests have multiple Host ↵ian woolf
headers Fixes #45513 Change-Id: I59e717a4bbd3e71320deff519e4f9587ee5c8756 Reviewed-on: https://go-review.googlesource.com/c/go/+/308952 Trust: Damien Neil <dneil@google.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2021-03-23net/http: treat MaxBytesReader's negative limits as equivalent to zero limitArtur M. Wolff
Current MaxBytesReader behaviour differs from its documentation. It's not similar enough to io.LimitReader. It panics when limit (n) < -1 and returns [-1, <nil>] when limit (n) = -1. To fix that, we treat all negative limits as equivalent to 0. It would be possible to make MaxBytesReader analogically identical in behaviour to io.LimitReader, but that would require to stop maxBytesReader's Read from reading past the limit. Read always reads one more byte (if possible) for non-negative limits and returns a non-EOF error. This behaviour will now apply to all limits. Fixes #45101 Change-Id: I25d1877dbff1eb4b195c8741fe5e4a025d01ebc0 Reviewed-on: https://go-review.googlesource.com/c/go/+/303171 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org> Trust: Damien Neil <dneil@google.com> Trust: Dmitri Shuralyov <dmitshur@golang.org> Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Go Bot <gobot@golang.org>
2020-12-09all: update to use os.ReadFile, os.WriteFile, os.CreateTemp, os.MkdirTempRuss Cox
As part of #42026, these helpers from io/ioutil were moved to os. (ioutil.TempFile and TempDir became os.CreateTemp and MkdirTemp.) Update the Go tree to use the preferred names. As usual, code compiled with the Go 1.4 bootstrap toolchain and code vendored from other sources is excluded. ReadDir changes are in a separate CL, because they are not a simple search and replace. For #42026. Change-Id: If318df0216d57e95ea0c4093b89f65e5b0ababb3 Reviewed-on: https://go-review.googlesource.com/c/go/+/266365 Trust: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2020-12-03mime/multipart: handle ReadForm(math.MaxInt64) betterRuss Cox
Returning an error about integer overflow is needlessly pedantic. The meaning of ReadForm(MaxInt64) is easily understood (accept a lot of data) and can be implemented. Fixes #40430. Change-Id: I8a522033dd9a2f9ad31dd2ad82cf08d553736ab9 Reviewed-on: https://go-review.googlesource.com/c/go/+/275112 Trust: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2020-10-21net/http: test that ParseMultipartForm catches overflowsEmmanuel T Odeke
Tests that if the combination of: * HTTP multipart file payload size * ParseMultipartForm's maxMemory parameter * the internal leeway buffer size of 10MiB overflows, then we'll report an overflow instead of silently passing. Reapplies and fixes CL 254977, which was reverted in CL 263658. The prior test lacked a res.Body.Close(), so fixed that and added a leaked Transport check to verify correctness. Updates 40430. Change-Id: I3c0f7ef43d621f6eb00f07755f04f9f36c51f98f Reviewed-on: https://go-review.googlesource.com/c/go/+/263817 Run-TryBot: Emmanuel Odeke <emm.odeke@gmail.com> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Bryan C. Mills <bcmills@google.com> Trust: Damien Neil <dneil@google.com>
2020-10-20all: update references to symbols moved from io/ioutil to ioRuss Cox
The old ioutil references are still valid, but update our code to reflect best practices and get used to the new locations. Code compiled with the bootstrap toolchain (cmd/asm, cmd/dist, cmd/compile, debug/elf) must remain Go 1.4-compatible and is excluded. Also excluded vendored code. For #41190. Change-Id: I6d86f2bf7bc37a9d904b6cee3fe0c7af6d94d5b1 Reviewed-on: https://go-review.googlesource.com/c/go/+/263142 Trust: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com>
2020-10-19Revert "net/http: test that ParseMultipartForm returns an error for int ↵Bryan C. Mills
overflow" This reverts CL 254977. Reason for revert: introduced test failures on longtest builders. Change-Id: I75e868245f980189ad85dd4103d9178989e06ecf Reviewed-on: https://go-review.googlesource.com/c/go/+/263658 Trust: Bryan C. Mills <bcmills@google.com> Run-TryBot: Bryan C. Mills <bcmills@google.com> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Carlos Amedee <carlos@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
2020-10-19net/http: test that ParseMultipartForm returns an error for int overflowavivklas
ParseMultipartForm has been changed to return an error if maxMemory parameter + 10MB causes int overflows. This adds a test for the new behaviour. For #40430 Change-Id: I4f66ce8a9382940182011d22a84ee52b1d1364cf Reviewed-on: https://go-review.googlesource.com/c/go/+/254977 Reviewed-by: Damien Neil <dneil@google.com> Trust: Damien Neil <dneil@google.com> Trust: Brad Fitzpatrick <bradfitz@golang.org>
2020-10-12net/http: deep copy Request.TransferEncodingdqu123
The existing implementation in Request.Clone() assigns the wrong pointer to r2.TransferEncoding. Fixes #41907 Change-Id: I7f220a41b1b46a55d1a1005e47c6dd69478cb025 Reviewed-on: https://go-review.googlesource.com/c/go/+/261258 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com> Trust: Emmanuel Odeke <emm.odeke@gmail.com>
2019-11-08net/http: refactor test TestParseFormUnknownContentTypeDavid Ndungu
Use names to better communicate when a test case fails. Change-Id: Id882783cb5e444b705443fbcdf612713f8a3b032 Reviewed-on: https://go-review.googlesource.com/c/go/+/187823 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2019-10-14net/http: fix Transport panic with nil Request.HeaderEmmanuel T Odeke
For Go 1.13 we introduced Header.Clone and it returns nil if a nil Header is cloned. Unfortunately, though, this exported Header.Clone nil behavior differed from the old Go 1.12 and earlier internal header clone behavior which always returned non-nil Headers. This CL fixes the places where that distinction mattered. Fixes #34878 Change-Id: Id19dea2272948c8dd10883b18ea7f7b8b33ea8eb Reviewed-on: https://go-review.googlesource.com/c/go/+/200977 Run-TryBot: Emmanuel Odeke <emm.odeke@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2019-03-11net/http: add missing error checks in testsLeon Klingele
Change-Id: I73441ba2eb349f0e0f25068e6b24c74dd33f1456 GitHub-Last-Rev: b9e6705962b94af3b1b720cc9ad6d33d7d3f1425 GitHub-Pull-Request: golang/go#30017 Reviewed-on: https://go-review.googlesource.com/c/go/+/160441 Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com> Run-TryBot: Emmanuel Odeke <emm.odeke@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2019-03-06net/http: add request file upload benchmarksChris Marchesi
This adds benchmarks to test file uploads using PUT requests. It's designed to complement changes https://golang.org/cl/163599 and https://golang.org/cl/163737, allowing an easy comparison of performance before and after these changes are applied. Updates #30377. Co-authored-by: Emmanuel Odeke <emm.odeke@gmail.com> Change-Id: Ib8e692c61e1f7957d88c7101669d4f7fb8110c65 GitHub-Last-Rev: 242622b4fca9f289defa2f268efc31208743e5dd GitHub-Pull-Request: golang/go#30424 Reviewed-on: https://go-review.googlesource.com/c/go/+/163862 Run-TryBot: Emmanuel Odeke <emm.odeke@gmail.com> Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com>
2018-09-26all: use strings.ReplaceAll and bytes.ReplaceAll where applicableBrad Fitzpatrick
I omitted vendor directories and anything necessary for bootstrapping. (Tested by bootstrapping with Go 1.4) Updates #27864 Change-Id: I7d9b68d0372d3a34dee22966cca323513ece7e8a Reviewed-on: https://go-review.googlesource.com/137856 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2018-05-04net/http: ignore case of basic auth scheme in Request.BasicAuthBrad Fitzpatrick
RFC 2617, Section 1.2: "It uses an extensible, case-insensitive token to identify the authentication scheme" RFC 7617, Section 2: "Note that both scheme and parameter names are matched case-insensitively." Fixes #22736 Change-Id: I825d6dbd4fef0f1c6add89f0cbdb56a03eae9443 Reviewed-on: https://go-review.googlesource.com/111516 Reviewed-by: Dmitri Shuralyov <dmitri@shuralyov.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2018-02-21net/http: support multipart/mixed in Request.MultipartReaderOneOfOne
Fixes #23959 GitHub-Last-Rev: 08ce026f52f9fd65b49d99745dffed46a3951585 GitHub-Pull-Request: golang/go#24012 Change-Id: I7e71c41330346dbc4dad6ba813cabfa8a54e2f66 Reviewed-on: https://go-review.googlesource.com/95975 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2018-02-20net/http: use RFC 723x as normative reference in docsDavid Url
Replace references to the obsoleted RFC 2616 with references to RFC 7230 through 7235, to avoid unnecessary confusion. Obvious inconsistencies are marked with todo comments. Updates #21974 Change-Id: I8fb4fcdd1333fc5193b93a2f09598f18c45e7a00 Reviewed-on: https://go-review.googlesource.com/94095 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2017-06-07net/http: don't crash in Request.WithContext if Request.URL is nilBrad Fitzpatrick
Fixes #20601 Change-Id: I296d50dc5210a735a2a65d64bfef05d14c93057b Reviewed-on: https://go-review.googlesource.com/45073 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Rhys Hiltner <rhys@justin.tv> Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-05-24net/http: deep copy Request.URL also in Request.WithContext's copyEmmanuel Odeke
Despite the previously known behavior of Request.WithContext shallow copying a request, usage of the request inside server.ServeHTTP mutates the request's URL. This CL implements deep copying of the URL. Fixes #20068 Change-Id: I86857d7259e23ac624d196401bf12dde401c42af Reviewed-on: https://go-review.googlesource.com/41308 Run-TryBot: Emmanuel Odeke <emm.odeke@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-12-01net/http: revert change making NewRequest set ContentLength -1Brad Fitzpatrick
The introduction of NoBody and related body-peeking bug fixes also added a "cleanup" of sorts to make NewRequest set the returned Requests's ContentLength to -1 when it didn't know it. Using -1 to mean unknown is what the documentation says, but then people apparently(?) depended on it being zero so they could do this: req, _ := http.NewRequest("POST", url, someNonNilReaderWithUnkownSize) req.Body = nil res, err := http.DefaultClient.Do(req) ... and expect it to work. After https://golang.org/cl/31445 the contrived(?) code above stopped working, since Body was nil and ContentLength was -1, which has been disallowed since Go 1.0. So this restores the old behavior of NewRequest, not setting it to -1. That part of the fix isn't required as of https://golang.org/cl/31726 (which added NoBody) I still don't know whether this bug is hypothetical or actually affected people in practice. Let's assume it's real for now. Fixes #18117 Change-Id: I42400856ee92a1a4999b5b4668bef97d885fbb53 Reviewed-on: https://go-review.googlesource.com/33801 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2016-12-01net/http: teach NewRequest that NoBody has ContentLength zeroBrad Fitzpatrick
NoBody is new in Go 1.8. Found while investigating #18117 Change-Id: I6bda030f358e2270f090d108cb3a89c8a2665fcb Reviewed-on: https://go-review.googlesource.com/33714 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2016-10-22net/http: add NoBody, don't return nil from NewRequest on zero bodiesBrad Fitzpatrick
This is an alternate solution to https://golang.org/cl/31445 Instead of making NewRequest return a request with Request.Body == nil to signal a zero byte body, add a well-known variable that means explicitly zero. Too many tests inside Google (and presumably the outside world) broke. Change-Id: I78f6ecca8e8aa1e12179c234ccfb6bcf0ee29ba8 Reviewed-on: https://go-review.googlesource.com/31726 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Joe Tsai <thebrokentoaster@gmail.com>
2016-10-22net/http: add Request.GetBody func for 307/308 redirectsBrad Fitzpatrick
Updates #10767 Change-Id: I197535f71bc2dc45e783f38d8031aa717d50fd80 Reviewed-on: https://go-review.googlesource.com/31733 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-19net/http: make NewRequest set empty Body nil, don't peek Read Body in TransportBrad Fitzpatrick
This CL makes NewRequest set Body nil for known-zero bodies, and makes the http1 Transport not peek-Read a byte to determine whether there's a body. Background: Many fields of the Request struct have different meanings for whether they're outgoing (via the Transport) or incoming (via the Server). For outgoing requests, ContentLength and Body are documented as: // Body is the request's body. // // For client requests a nil body means the request has no // body, such as a GET request. The HTTP Client's Transport // is responsible for calling the Close method. Body io.ReadCloser // ContentLength records the length of the associated content. // The value -1 indicates that the length is unknown. // Values >= 0 indicate that the given number of bytes may // be read from Body. // For client requests, a value of 0 with a non-nil Body is // also treated as unknown. ContentLength int64 Because of the ambiguity of what ContentLength==0 means, the http1 and http2 Transports previously Read the first byte of a non-nil Body when the ContentLength was 0 to determine whether there was an actual body (with a non-zero length) and ContentLength just wasn't populated, or it was actually empty. That byte-sniff has been problematic and gross (see #17480, #17071) and was removed for http2 in a previous commit. That means, however, that users doing: req, _ := http.NewRequest("POST", url, strings.NewReader("")) ... would not send a Content-Length header in their http2 request, because the size of the reader (even though it was known, being one of the three common recognized types from NewRequest) was zero, and so the HTTP Transport thought it was simply unset. To signal explicitly-zero vs unset-zero, this CL changes NewRequest to signal explicitly-zero by setting the Body to nil, instead of the strings.NewReader("") or other zero-byte reader. This CL also removes the byte sniff from the http1 Transport, like https://golang.org/cl/31326 did for http2. Updates #17480 Updates #17071 Change-Id: I329f02f124659bf7d8bc01e2c9951ebdd236b52a Reviewed-on: https://go-review.googlesource.com/31445 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2016-10-17net/http: support multiple identical Content-Length headersEmmanuel Odeke
Referencing RFC 7230 Section 3.3.2, this CL deduplicates multiple identical Content-Length headers of a message or rejects the message as invalid if the Content-Length values differ. Fixes #16490 Change-Id: Ia6b0f58ec7d35710b11a36113d2bd9128f693f64 Reviewed-on: https://go-review.googlesource.com/31252 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-10-09net/http: Add missing tests for parsePostFormQuentin Renard
Renamed TestPOSTQuery to TestParseFormQuery and added testing for the ";" delimiter, an empty key, an empty value and an empty key + value. Also added TestParseFormQueryMethods to make sure forms sent in PATCH and PUT (and no others) request are parsed correctly in ParseForm. Fixes #17368 Change-Id: I445aad324ffc7b38d179ea41953bffbac0cddffe Reviewed-on: https://go-review.googlesource.com/30555 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-10-05Revert "net/http: improve performance for parsePostForm"Joe Tsai
This reverts commit 59320c396e6448132a52cb5a5d96491eee1e0ad8. Reasons: This CL was causing failures on a large regression test that we run within Google. The issues arises from two bugs in the CL: * The CL dropped support for ';' as a delimiter (see https://golang.org/issue/2210) * The handling of an empty string caused an empty record to be added when no record was added (see https://golang.org/cl/30454 for my attempted fix) The logic being added is essentially a variation of url.ParseQuery, but altered to accept an io.Reader instead of a string. Since it is duplicated (but modified) logic, there needs to be good tests to ensure that it's implementation doesn't drift in functionality from url.ParseQuery. Fixing the above issues and adding the associated regression tests leads to >100 lines of codes. For a 4% reduction in CPU time, I think this complexity and duplicated logic is not worth the effort. As such, I am abandoning my efforts to fix the existing issues and believe that reverting CL/20301 is the better course of action. Updates #14655 Change-Id: Ibb5be0a5b48a16c46337e213b79467fcafee69df Reviewed-on: https://go-review.googlesource.com/30470 Run-TryBot: Joe Tsai <thebrokentoaster@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-04net/http: improve performance for parsePostFormQuentin Renard
Remove the use of io.ReadAll in http.parsePostForm to avoid converting the whole input from []byte to string and not performing well space-allocated-wise. Instead a new function called parsePostFormURLEncoded is used and is fed directly an io.Reader that is parsed using a bufio.Reader. Benchmark: name old time/op new time/op delta PostQuery-4 2.90µs ± 6% 2.82µs ± 4% ~ (p=0.094 n=9+9) name old alloc/op new alloc/op delta PostQuery-4 1.05kB ± 0% 0.90kB ± 0% -14.49% (p=0.000 n=10+10) name old allocs/op new allocs/op delta PostQuery-4 6.00 ± 0% 7.00 ± 0% +16.67% (p=0.000 n=10+10) Fixes #14655 Change-Id: I112c263d4221d959ed6153cfe88bc57a2aa8ea73 Reviewed-on: https://go-review.googlesource.com/20301 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-05-11net/http: make the MaxBytesReader.Read error stickyBrad Fitzpatrick
Fixes #14981 Change-Id: I39b906d119ca96815801a0fbef2dbe524a3246ff Reviewed-on: https://go-review.googlesource.com/23009 Reviewed-by: Andrew Gerrand <adg@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-04-16net/http: normalize empty port in URL.Host's ":port"Emmanuel Odeke
- Ensures that the empty port and preceeding ":" in a URL.Host are stripped. Normalize the empty port in a URL.Host's ":port" as mandated by RFC 3986 Section 6.2.3 which states that: `Likewise an explicit ":port", for which the port is empty or the default for the scheme, is equivalent to one where the port and its ":" delimiter are elided and thus should be removed by scheme-based normalization.` - Moves function `hasPort` from client.go (where it was defined but not used directly), to http.go the common area. Fixes #14836 Change-Id: I2067410377be9c71106b1717abddc2f8b1da1c03 Reviewed-on: https://go-review.googlesource.com/22140 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-03-12net/http: make ParseMultipartForm also populate Request.PostFormEmmanuel Odeke
Ensures that after request.ParseMultipartForm has been invoked, Request.PostForm and Request.Form are both populated with the same formValues read in, instead of only populating Request.Form. Fixes #9305 Change-Id: I3d4a11b006fc7dffaa35360014fe15b8c74d00a3 Reviewed-on: https://go-review.googlesource.com/19986 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-02-24all: fix typos and spellingMartin Möhrmann
Change-Id: Icd06d99c42b8299fd931c7da821e1f418684d913 Reviewed-on: https://go-review.googlesource.com/19829 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2015-12-11net/url: reject space in host; do not escape < > " in hostRuss Cox
Host names in URLs must not use %-escaping for ASCII bytes, per RFC 3986. url.Parse has historically allowed spaces and < > " in the URL host. In Go 1.5, URL's String method started escaping those, but then Parse would rejects the escaped form. This CL is an attempt at some consistency between Parse and String as far as the accepted host characters and the encoding of host characters, so that if Parse succeeds, then Parse -> String -> Parse also succeeds. Allowing space seems like a mistake, so reject that in Parse. (Similarly, reject \t, \x01, and so on, all of which were being allowed.) Allowing < > " doesn't seem awful, so continue to do that, and go back to the Go 1.4 behavior of not escaping them in String. Fixes #11302. Change-Id: I0bf65b874cd936598f20694574364352a5abbe5f Reviewed-on: https://go-review.googlesource.com/17387 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2015-12-10net/http: make NewRequest with empty method mean GETBrad Fitzpatrick
Until recently, we always permitted an empty string to NewRequest. Keep that property, since it broke tests within in Google when trying out Go 1.6, and probably would've broken others too. Change-Id: Idddab1ae7b9423d5caac00af2c897fe1065b600b Reviewed-on: https://go-review.googlesource.com/17699 Reviewed-by: Russ Cox <rsc@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2015-12-10net/http: run more tests in http2 modeBrad Fitzpatrick
Failing ones are marked skipped. Fixes #13543 (was just a test issue) Updates #13555 (to be fixed later) Updates #13556 (to be fixed later) Updates #13557 (to be fixed later) Fixes bug in golang.org/cl/17428 (http1 now uses HTTP status 431, not 413) Change-Id: I8f7431fee35f2fc081cfe2c232ae75a00800a60b Reviewed-on: https://go-review.googlesource.com/17683 Reviewed-by: Blake Mizerany <blake.mizerany@gmail.com> Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com> Reviewed-by: Burcu Dogan <jbd@google.com> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2015-12-05net/http: make TestRedirect also test in http2 modeEmmanuel Odeke
Change-Id: Idfbe91abc11b2b3b735cd8d11fb1938f9e5c0473 Reviewed-on: https://go-review.googlesource.com/17437 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2015-11-13net/http: require valid methods in NewRequest and Transport.RoundTripBrad Fitzpatrick
Fixes #12078 Change-Id: If09c927fae639ec4ed3894a2b393a87c1e677803 Reviewed-on: https://go-review.googlesource.com/16829 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Andrew Gerrand <adg@golang.org>
2015-07-15net/http: do not allow space or slash in Host headersJeff R. Allen
A malformed Host header can result in a malformed HTTP request. Clean them to avoid this. Updates #11206. We may come back and make this stricter for 1.6. Change-Id: I23c7d821cd9dbf66c3c15d26750f305e3672d984 Reviewed-on: https://go-review.googlesource.com/11241 Reviewed-by: Russ Cox <rsc@golang.org>
2015-07-07net/http: fix MaxBytesReader at EOFBrad Fitzpatrick
Fixes #10884 Change-Id: I7cab3c96548867612f579d2cd4ec736309787443 Reviewed-on: https://go-review.googlesource.com/11961 Reviewed-by: Andrew Gerrand <adg@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
generated by cgit v1.3 (git 2.53.0) at 2026-04-15 08:43:29 +0000