aboutsummaryrefslogtreecommitdiff
path: root/src/net/http
AgeCommit message (Collapse)Author
2024-01-25all: prealloc slice with possible minimum capabilitiesShulhan
2024-01-22all: update vendored dependenciesCherry Mui
The Go 1.23 development tree has opened. This is a time to update all golang.org/x/... module versions that contribute packages to the std and cmd modules in the standard library to latest master versions. Generated with: go install golang.org/x/build/cmd/updatestd@latest go install golang.org/x/tools/cmd/bundle@latest updatestd -goroot=$(pwd) -branch=master For #36905. Change-Id: I46a68f27a54f1e3f9e1aa5af4de6ee0b26388f3f Reviewed-on: https://go-review.googlesource.com/c/go/+/557457 Reviewed-by: Carlos Amedee <carlos@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2024-01-22net/http/pprof: configure WriteDeadlineAlexander Yastrebov
Configure write deadline according to requested profiling duration. Fixes #62358 Change-Id: I2350110ff20a637c7e90bdda57026b0b0d9c87ba GitHub-Last-Rev: b79ae38defc4d9b58b23a9d13ff86fa863f18b00 GitHub-Pull-Request: golang/go#64360 Reviewed-on: https://go-review.googlesource.com/c/go/+/544756 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2024-01-10net: add available godoc linkcui fliter
Change-Id: Ib7c4baf0247c421954aedabfbb6a6af8a08a8936 Reviewed-on: https://go-review.googlesource.com/c/go/+/540021 Reviewed-by: Damien Neil <dneil@google.com> Run-TryBot: shuang cui <imcusg@gmail.com> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2024-01-09net/http: clarify the precedence order for Request.FormValueJes Cok
Fixes #64575 Change-Id: I0eaec642a9dc8ae3b273a6d41131cc7cb8332947 GitHub-Last-Rev: 17aa5170cbfe42cb86d56f1804266850d33c3eb5 GitHub-Pull-Request: golang/go#64578 Reviewed-on: https://go-review.googlesource.com/c/go/+/547855 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2024-01-04net/http: respond with 400 Bad Request for empty hex number of chunk lengthAndy Pan
Fixes #64517 Change-Id: I78b8a6a83301deee05c3ff052a6adcd1f965aef2 Reviewed-on: https://go-review.googlesource.com/c/go/+/553835 Auto-Submit: Damien Neil <dneil@google.com> Commit-Queue: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Bryan Mills <bcmills@google.com>
2024-01-04net/http/cgi: in TestCopyError, check for a Handler.ServeHTTP goroutine ↵Bryan C. Mills
instead of a running PID Previously, the test could fail spuriously if the CGI process's PID happened to be reused in between checks. That sort of reuse is highly unlikely on platforms that cycle through the PID space sequentially (such as Linux), but plausible on platforms that use randomized PIDs (such as OpenBSD). Also unskip the test on Windows, since it no longer relies on being able to send signal 0 to an arbitrary PID. Also change the expected failure mode of the test to a timeout instead of a call to t.Fatalf, so that on failure we get a useful goroutine dump for debugging instead of a non-actionable failure message. Fixes #57369 (maybe). Change-Id: Ib7e3fff556450b48cb5e6ea120fdf4d53547479b Reviewed-on: https://go-review.googlesource.com/c/go/+/554075 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Bryan Mills <bcmills@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2024-01-03net/http: make Request.Clone create fresh copies for matches and otherValuesJes Cok
This change fixes Request.Clone to correctly work with SetPathValue by creating fresh copies for matches and otherValues so that SetPathValue for cloned requests doesn't pollute the original request. While here, also added a doc for Request.SetPathValue. Fixes #64911 Change-Id: I2831b38e135935dfaea2b939bb9db554c75b65ef GitHub-Last-Rev: 1981db16475a49fe8d4b874a6bceec64d28a1332 GitHub-Pull-Request: golang/go#64913 Reviewed-on: https://go-review.googlesource.com/c/go/+/553375 Reviewed-by: Emmanuel Odeke <emmanuel@orijtech.com> Run-TryBot: Jes Cok <xigua67damn@gmail.com> Auto-Submit: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Jonathan Amsterdam <jba@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2023-12-14all: remove newline characters after return statementsDanil Timerbulatov
This commit is aimed at improving the readability and consistency of the code base. Extraneous newline characters were present after some return statements, creating unnecessary separation in the code. Fixes #64610 Change-Id: Ic1b05bf11761c4dff22691c2f1c3755f66d341f7 Reviewed-on: https://go-review.googlesource.com/c/go/+/548316 Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Michael Pratt <mpratt@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2023-12-07internal/profile: fully decode proto even if there are no samplesMichael Pratt
This is a partial revert of CL 483137. CL 483137 started checking errors in postDecode, which is good. Now we can catch more malformed pprof protos. However this made TestEmptyProfile fail, so an early return was added when the profile was "empty" (no samples). Unfortunately, this was problematic. Profiles with no samples can still be valid, but skipping postDecode meant that the resulting Profile was missing values from the string table. In particular, net/http/pprof needs to parse empty profiles in order to pass through the sample and period types to a final output proto. CL 483137 broke this behavior. internal/profile.Parse is only used in two places: in cmd/compile to parse PGO pprof profiles, and in net/http/pprof to parse before/after pprof profiles for delta profiles. In both cases, the input is never literally empty (0 bytes). Even a pprof proto with no samples still contains some header fields, such as sample and period type. Upstream github.com/google/pprof/profile even has an explicit error on 0 byte input, so `go tool pprof` will not support such an input. Thus TestEmptyProfile was misleading; this profile doesn't need to support empty input at all. Resolve this by removing TestEmptyProfile and replacing it with an explicit error on empty input, as upstream github.com/google/pprof/profile has. For non-empty input, always run postDecode to ensure the string table is processed. TestConvertCPUProfileEmpty is reverted back to assert the values from before CL 483137. Note that in this case "Empty" means no samples, not a 0 byte input. Continue to allow empty files for PGO in order to minimize the chance of last minute breakage if some users have empty files. Fixes #64566. Change-Id: I83a1f0200ae225ac6da0009d4b2431fe215b283f Reviewed-on: https://go-review.googlesource.com/c/go/+/547996 Reviewed-by: Michael Knyszek <mknyszek@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Cherry Mui <cherryyz@google.com>
2023-12-05net/http: limit chunked data overheadDamien Neil
The chunked transfer encoding adds some overhead to the content transferred. When writing one byte per chunk, for example, there are five bytes of overhead per byte of data transferred: "1\r\nX\r\n" to send "X". Chunks may include "chunk extensions", which we skip over and do not use. For example: "1;chunk extension here\r\nX\r\n". A malicious sender can use chunk extensions to add about 4k of overhead per byte of data. (The maximum chunk header line size we will accept.) Track the amount of overhead read in chunked data, and produce an error if it seems excessive. Fixes #64433 Fixes CVE-2023-39326 Change-Id: I40f8d70eb6f9575fb43f506eb19132ccedafcf39 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2076135 Reviewed-by: Tatiana Bradley <tatianabradley@google.com> Reviewed-by: Roland Shoemaker <bracewell@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/547335 Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-12-01net/http: avoid leaking io.Copy goroutines (and hijacked connections) in ↵Bryan C. Mills
TestTransportNoReuseAfterEarlyResponse Fixes #64252 (maybe). Change-Id: Iba2a403a9347be4206f14acb11591dc2eb7f9fb8 Reviewed-on: https://go-review.googlesource.com/c/go/+/546616 Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Bryan Mills <bcmills@google.com>
2023-11-29all: update vendored dependenciesDmitri Shuralyov
The Go 1.22 code freeze has recently started. This is a time to update all golang.org/x/... module versions that contribute packages to the std and cmd modules in the standard library to latest master versions. Generated with: go install golang.org/x/build/cmd/updatestd@latest go install golang.org/x/tools/cmd/bundle@latest updatestd -goroot=$(pwd) -branch=master For #36905. Change-Id: I76525261b9a954ed21a3bd3cb6c4a12e6c031d80 Cq-Include-Trybots: luci.golang.try:gotip-windows-amd64-longtest,gotip-linux-amd64-longtest,gotip-linux-386-longtest Reviewed-on: https://go-review.googlesource.com/c/go/+/546055 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Michael Knyszek <mknyszek@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org>
2023-11-21net/http: use pointers to array for copyBufPoolJorropo
This is inspired by CL 539915, I'm only submitting now that CL 456435 has been merged. This divide the number of objects kept alive by the heap by two and remove the slice header allocation in New and in the put back. Change-Id: Ibcd5166bac5a37f365a533e09a28f3b79f81ad58 Reviewed-on: https://go-review.googlesource.com/c/go/+/543515 Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: qiulaidongfeng <2645477756@qq.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Michael Knyszek <mknyszek@google.com>
2023-11-20src: a/an grammar fixesVille Skyttä
Change-Id: I179b50ae8e73677d4d408b83424afbbfe6aa17a1 GitHub-Last-Rev: 2e2d9c1e45556155d02db4df381b99f2d1bc5c0e GitHub-Pull-Request: golang/go#63478 Reviewed-on: https://go-review.googlesource.com/c/go/+/534015 Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Michael Knyszek <mknyszek@google.com>
2023-11-17all: add missing copyright headerJes Cok
Change-Id: Ic61fb181923159e80a86a41582e83ec466ab9bc4 GitHub-Last-Rev: 92469845665fa1f864d257c8bc175201a43b4d43 GitHub-Pull-Request: golang/go#64080 Reviewed-on: https://go-review.googlesource.com/c/go/+/541741 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Michael Pratt <mpratt@google.com> Reviewed-by: Than McIntosh <thanm@google.com> Run-TryBot: Jes Cok <xigua67damn@gmail.com>
2023-11-17net,os: arrange zero-copy of os.File and net.TCPConn to net.UnixConnAndy Pan
Fixes #58808 goos: linux goarch: amd64 pkg: net cpu: DO-Premium-Intel │ old │ new │ │ sec/op │ sec/op vs base │ Splice/tcp-to-unix/1024-4 3.783µ ± 10% 3.201µ ± 7% -15.40% (p=0.001 n=10) Splice/tcp-to-unix/2048-4 3.967µ ± 13% 3.818µ ± 16% ~ (p=0.971 n=10) Splice/tcp-to-unix/4096-4 4.988µ ± 16% 4.590µ ± 11% ~ (p=0.089 n=10) Splice/tcp-to-unix/8192-4 6.981µ ± 13% 5.236µ ± 9% -25.00% (p=0.000 n=10) Splice/tcp-to-unix/16384-4 10.192µ ± 9% 7.350µ ± 7% -27.89% (p=0.000 n=10) Splice/tcp-to-unix/32768-4 19.65µ ± 13% 10.28µ ± 16% -47.69% (p=0.000 n=10) Splice/tcp-to-unix/65536-4 41.89µ ± 18% 15.70µ ± 13% -62.52% (p=0.000 n=10) Splice/tcp-to-unix/131072-4 90.05µ ± 11% 29.55µ ± 10% -67.18% (p=0.000 n=10) Splice/tcp-to-unix/262144-4 170.24µ ± 15% 52.66µ ± 4% -69.06% (p=0.000 n=10) Splice/tcp-to-unix/524288-4 326.4µ ± 13% 109.3µ ± 11% -66.52% (p=0.000 n=10) Splice/tcp-to-unix/1048576-4 651.4µ ± 9% 228.3µ ± 14% -64.95% (p=0.000 n=10) geomean 29.42µ 15.62µ -46.90% │ old │ new │ │ B/s │ B/s vs base │ Splice/tcp-to-unix/1024-4 258.2Mi ± 11% 305.2Mi ± 8% +18.21% (p=0.001 n=10) Splice/tcp-to-unix/2048-4 492.5Mi ± 15% 511.7Mi ± 13% ~ (p=0.971 n=10) Splice/tcp-to-unix/4096-4 783.5Mi ± 14% 851.2Mi ± 12% ~ (p=0.089 n=10) Splice/tcp-to-unix/8192-4 1.093Gi ± 11% 1.458Gi ± 8% +33.36% (p=0.000 n=10) Splice/tcp-to-unix/16384-4 1.497Gi ± 9% 2.076Gi ± 7% +38.67% (p=0.000 n=10) Splice/tcp-to-unix/32768-4 1.553Gi ± 11% 2.969Gi ± 14% +91.17% (p=0.000 n=10) Splice/tcp-to-unix/65536-4 1.458Gi ± 23% 3.888Gi ± 11% +166.69% (p=0.000 n=10) Splice/tcp-to-unix/131072-4 1.356Gi ± 10% 4.131Gi ± 9% +204.72% (p=0.000 n=10) Splice/tcp-to-unix/262144-4 1.434Gi ± 13% 4.637Gi ± 4% +223.32% (p=0.000 n=10) Splice/tcp-to-unix/524288-4 1.497Gi ± 15% 4.468Gi ± 10% +198.47% (p=0.000 n=10) Splice/tcp-to-unix/1048576-4 1.501Gi ± 10% 4.277Gi ± 16% +184.88% (p=0.000 n=10) geomean 1.038Gi 1.954Gi +88.28% │ old │ new │ │ B/op │ B/op vs base │ Splice/tcp-to-unix/1024-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/2048-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/4096-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/8192-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/16384-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/32768-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/65536-4 1.000 ± ? 0.000 ± 0% -100.00% (p=0.001 n=10) Splice/tcp-to-unix/131072-4 2.000 ± 0% 0.000 ± 0% -100.00% (p=0.000 n=10) Splice/tcp-to-unix/262144-4 4.000 ± 25% 0.000 ± 0% -100.00% (p=0.000 n=10) Splice/tcp-to-unix/524288-4 7.500 ± 33% 0.000 ± 0% -100.00% (p=0.000 n=10) Splice/tcp-to-unix/1048576-4 17.00 ± 12% 0.00 ± 0% -100.00% (p=0.000 n=10) geomean ² ? ² ³ ¹ all samples are equal ² summaries must be >0 to compute geomean ³ ratios must be >0 to compute geomean │ old │ new │ │ allocs/op │ allocs/op vs base │ Splice/tcp-to-unix/1024-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/2048-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/4096-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/8192-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/16384-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/32768-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/65536-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/131072-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/262144-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/524288-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/1048576-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ geomean ² +0.00% ² ¹ all samples are equal ² summaries must be >0 to compute geomean Change-Id: I829061b009a0929a8ef1a15c183793c0b9104dde Reviewed-on: https://go-review.googlesource.com/c/go/+/472475 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Bryan Mills <bcmills@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-11-15net/http: don't set length for non-range encoded content requestsDamien Neil
Historically, serveContent has not set Content-Length when the user provides Content-Encoding. This causes broken responses when the user sets both Content-Length and Content-Encoding, and the request is a range request, because the returned data doesn't match the declared length. CL 381956 fixed this case by changing serveContent to always set a Content-Length header. Unfortunately, I've discovered multiple cases in the wild of users setting Content-Encoding: gzip and passing serveContent a ResponseWriter wrapper that gzips the data written to it. This breaks serveContent in a number of ways. In particular, there's no way for it to respond to Range requests properly, because it doesn't know the recipient's view of the content. What the user should be doing in this case is just using io.Copy to send the gzipped data to the response. Or possibly setting Transfer-Encoding: gzip. But whatever they should be doing, what they are doing has mostly worked for non-Range requests, and setting Content-Length makes it stop working because the length of the file being served doesn't match the number of bytes being sent. So in the interests of not breaking users (even if they're misusing serveContent in ways that are already broken), partially revert CL 381956. For non-Range requests, don't set Content-Length when the user has set Content-Encoding. This matches our previous behavior and causes minimal harm in cases where we could have set Content-Length. (We will send using chunked encoding rather than identity, but that's fine.) For Range requests, set Content-Length unconditionally. Either the user isn't mangling the data in the ResponseWriter, in which case the length is correct, or they are, in which case the response isn't going to contain the right bytes anyway. (Note that a Range request for a Content-Length: gzip file is requesting a range of *gzipped* bytes, not a range from the uncompressed file.) Change-Id: I5e788e6756f34cee520aa7c456826f462a59f7eb Reviewed-on: https://go-review.googlesource.com/c/go/+/542595 Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Jonathan Amsterdam <jba@google.com>
2023-11-14crypto/tls: remove RSA KEX ciphers from the default listRoland Shoemaker
Removes the RSA KEX based ciphers from the default list. This can be reverted using the tlsrsakex GODEBUG. Fixes #63413 Change-Id: Id221be3eb2f6c24b91039d380313f0c87d339f98 Reviewed-on: https://go-review.googlesource.com/c/go/+/541517 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com>
2023-11-09net/http: use copyBufPool in transferWriter.doBodyCopy()Michał Matczuk
This is a followup to CL 14177. It applies copyBufPool optimization to transferWriter.doBodyCopy(). The function is used every time Request or Response is written. Without this patch for every Request and Response processed, if there is a body, we need to allocate and GC a 32k buffer. This is quickly causing GC pressure. Fixes #57202 Change-Id: I4c30e1737726ac8d9937846106efd02effbae300 GitHub-Last-Rev: 908573cdbe2e8b6f91ce026cf8632ff5f2c41110 GitHub-Pull-Request: golang/go#57205 Reviewed-on: https://go-review.googlesource.com/c/go/+/456435 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Bryan Mills <bcmills@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: qiulaidongfeng <2645477756@qq.com>
2023-11-07net/http/cookiejar: remove unused variablewulianglongrd
The errNoHostname variable is not used, delete it. Change-Id: I62ca6390fd026e6a8cb1e8147f3fbfc3078c2249 Reviewed-on: https://go-review.googlesource.com/c/go/+/538455 Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Bryan Mills <bcmills@google.com>
2023-11-07net/http/cgi: eliminate use of Perl in testsaimuz
Previously, a Perl script was used to test the net/http/cgi package. This sometimes led to hidden failures as these tests were not run on builders without Perl. Also, this approach posed maintenance difficulties for those unfamiliar with Perl. We have now replaced Perl-based tests with a Go handler to simplify maintenance and ensure consistent testing environments. It's part of our ongoing effort to reduce reliance on Perl throughout the Go codebase (see #20032,#25586,#25669,#27779), thus improving reliability and ease of maintenance. Fixes #63800 Fixes #63828 Change-Id: I8d554af93d4070036cf0cc3aaa9c9b256affbd17 GitHub-Last-Rev: a8034083d824da7d68e5995a7997a1199d78de15 GitHub-Pull-Request: golang/go#63869 Reviewed-on: https://go-review.googlesource.com/c/go/+/538861 Reviewed-by: Bryan Mills <bcmills@google.com> Run-TryBot: qiulaidongfeng <2645477756@qq.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Bryan Mills <bcmills@google.com> Commit-Queue: Bryan Mills <bcmills@google.com>
2023-11-06net/http/cgi: the PATH_INFO should be empty or start with a slashaimuz
fixed PATH_INFO not starting with a slash as described in RFC 3875 for PATH_INFO. Fixes #63925 Change-Id: I1ead98dff190c53eb7a50546569ef6ded3199a0a GitHub-Last-Rev: 1c532e330b0d74ee42afc412611a005bc565bb26 GitHub-Pull-Request: golang/go#63926 Reviewed-on: https://go-review.googlesource.com/c/go/+/539615 Reviewed-by: Bryan Mills <bcmills@google.com> Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-11-06net/http: remove Content-Encoding header in roundtrip_jscarl.tao
The fetch api will decode the gzip, but Content-Encoding not be deleted. To ensure that the behavior of roundtrip_js is consistent with native. delete the Content-Encoding header when the response body is decompressed by js fetch api. Fixes #63139 Change-Id: Ie35b3aa050786e2ef865f9ffa992e30ab060506e Reviewed-on: https://go-review.googlesource.com/c/go/+/530155 Commit-Queue: Damien Neil <dneil@google.com> Reviewed-by: Bryan Mills <bcmills@google.com> Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Damien Neil <dneil@google.com>
2023-11-06net/http: set/override Content-Length for encoded range requestsMitar
Currently, http.ServeContent returns invalid Content-Length header if: * Request is a range request. * Content is encoded (e.g., gzip compressed). * Content-Length of the encoded content has been set before calling http.ServeContent, as suggested in https://github.com/golang/go/issues/19420. Example: w.Header().Set("Content-Type", "application/json") w.Header().Set("Content-Length", strconv.Itoa(len(compressedJsonBody))) w.Header().Set("Content-Encoding", "gzip") w.Header().Set("Etag", etag) http.ServeContent( w, req, "", time.Time{}, bytes.NewReader(compressedJsonBody), ) The issue is that http.ServeContent currently sees Content-Length as something optional when Content-Encoding is set, but that is a problem with range request which can send a payload of different size. So this reverts https://go.dev/cl/4538111 and makes Content-Length be set always to the number of bytes which will actually be send (both for range and non-range requests). Without this fix, this is an example response: HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Encoding: gzip Content-Length: 351 Content-Range: bytes 100-350/351 Content-Type: application/json; charset=UTF-8 Etag: "amCTP_vgT5PQt5OsAEI7NFJ6Hx1UfEpR5nIaYEInfOA" Date: Sat, 29 Jan 2022 14:42:15 GMT As you see, Content-Length is invalid and should be 251. Change-Id: I4d2ea3a8489a115f92ef1f7e98250d555b47a94e GitHub-Last-Rev: 3aff9126f5d62725c7d539df2d0eb2b860a84ca6 GitHub-Pull-Request: golang/go#50904 Reviewed-on: https://go-review.googlesource.com/c/go/+/381956 Reviewed-by: Damien Neil <dneil@google.com> Run-TryBot: t hepudds <thepudds1460@gmail.com> Reviewed-by: David Chase <drchase@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-11-06net/http/httptest: remove unnecessary creation of http.TransportZeke Lu
In (*Server).StartTLS, it's unnecessary to create an http.Client with a Transport, because a new one will be created with the TLSClientConfig later. Change-Id: I086e28717e9739787529006c3f0296c8224cd790 GitHub-Last-Rev: 33724596bd901a05a91654f8c2df233aa6563ea6 GitHub-Pull-Request: golang/go#60124 Reviewed-on: https://go-review.googlesource.com/c/go/+/494355 Run-TryBot: t hepudds <thepudds1460@gmail.com> Reviewed-by: Heschi Kreinick <heschi@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: qiulaidongfeng <2645477756@qq.com>
2023-11-02net/http: remove arbitrary timeouts in tests of Server.ErrorLogBryan C. Mills
This also allows us to remove the chanWriter helper from the test, using a simpler strings.Builder instead, relying on clientServerTest.close for synchronization. (I don't think this runs afoul of #38370, because the handler functions themselves in these tests should never be executed, let alone result in an asynchronous write to the error log.) Fixes #57599. Change-Id: I45c6cefca0bb218f6f9a9659de6bde454547f704 Reviewed-on: https://go-review.googlesource.com/c/go/+/539436 Run-TryBot: Bryan Mills <bcmills@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Bryan Mills <bcmills@google.com> Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-10-26net/http: pull http2 underflow fix from x/net/http2Mauri de Souza Meneguzzo
After CL 534295 was merged to fix a CVE it introduced an underflow when we try to decrement sc.curHandlers in handlerDone. Pull in a fix from x/net/http2: http2: fix underflow in http2 server push https://go-review.googlesource.com/c/net/+/535595 Fixes #63511 Change-Id: I5c678ce7dcc53635f3ad5e4999857cb120dfc1ab GitHub-Last-Rev: 587ffa3cafbb9da6bc82ba8a5b83313f81e5c89b GitHub-Pull-Request: golang/go#63561 Reviewed-on: https://go-review.googlesource.com/c/go/+/535575 Run-TryBot: Mauri de Souza Meneguzzo <mauri870@gmail.com> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: David Chase <drchase@google.com> Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-10-23net/http: remove outdated comment about a support of CONNECT methodKeiichi Hirobe
The net/http.Transport already supports CONNECT after https://go-review.googlesource.com/c/go/+/123156 was merged, which deleted comments in transport.go. Change-Id: I784fdb9b044bc8a4a29bf252328c80a11aaf6901 Reviewed-on: https://go-review.googlesource.com/c/go/+/536057 Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: David Chase <drchase@google.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Damien Neil <dneil@google.com>
2023-10-19all: update vendored dependenciesDmitri Shuralyov
One of the remaining uses of the old +build syntax was in the bundled copy of golang.org/x/net/http2 in net/http. Pull in a newer version of bundle with CL 536075 that drops said +build syntax line. Also pull in newer x/sys and other golang.org/x modules where old +build lines were recently dropped. Generated with: go install golang.org/x/build/cmd/updatestd@latest go install golang.org/x/tools/cmd/bundle@latest updatestd -goroot=$(pwd) -branch=master For #36905. For #41184. For #60268. Change-Id: Ia18d1ce9eadce85b38176058ad1fe38562b004e9 Cq-Include-Trybots: luci.golang.try:gotip-linux-386-longtest,gotip-linux-amd64-longtest,gotip-windows-amd64-longtest Reviewed-on: https://go-review.googlesource.com/c/go/+/536575 Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Ian Lance Taylor <iant@google.com>
2023-10-19all: drop old +build linesDmitri Shuralyov
Running 'go fix' on the cmd+std packages handled much of this change. Also update code generators to use only the new go:build lines, not the old +build ones. For #41184. For #60268. Change-Id: If35532abe3012e7357b02c79d5992ff5ac37ca23 Cq-Include-Trybots: luci.golang.try:gotip-linux-386-longtest,gotip-linux-amd64-longtest,gotip-windows-amd64-longtest Reviewed-on: https://go-review.googlesource.com/c/go/+/536237 Reviewed-by: Ian Lance Taylor <iant@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-10-10all: pull in x/net v0.17.0 and its dependenciesDmitri Shuralyov
Pull in a security fix from x/net/http2: http2: limit maximum handler goroutines to MaxConcurrentStreams Fixes #63417. Fixes CVE-2023-39325. Change-Id: I01e7774912e81007a7cf70f33e5989fb50a0b708 Cq-Include-Trybots: luci.golang.try:gotip-linux-amd64-longtest Reviewed-on: https://go-review.googlesource.com/c/go/+/534295 Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Michael Pratt <mpratt@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-10-05net/http: fix ServeMux pattern registrationJonathan Amsterdam
When the httpmuxgo121 GODEBUG setting was active, we were registering patterns in the old and the new way. Fix to register only in the old way. Change-Id: Ibc1fd41e7f4d162ee5bc34575df409e1db5657cd Reviewed-on: https://go-review.googlesource.com/c/go/+/533095 Run-TryBot: Jonathan Amsterdam <jba@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Olena Synenka <olenasynenka@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2023-10-04net/http/cgi: set SERVER_PORT to 443 when req.TLS != niledef
A hostname without a port leaves the port implied by the protocol. For HTTPS, the implied port is 443, not 80. Change-Id: I873a076068f84c8041abf10a435d9499635730a0 Reviewed-on: https://go-review.googlesource.com/c/go/+/454975 Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-10-03net/http: document new ServeMux patternsJonathan Amsterdam
Updates #61410. Change-Id: Ib9dd8ebca43cec6e27c6fdfcf01ee6a1539c2fa0 Reviewed-on: https://go-review.googlesource.com/c/go/+/530481 Reviewed-by: Eli Bendersky <eliben@google.com> Run-TryBot: Jonathan Amsterdam <jba@google.com> Reviewed-by: Alan Donovan <adonovan@google.com> Reviewed-by: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-10-02net/http: add a test for an empty ServeMuxJonathan Amsterdam
Make sure a ServeMux with no patterns is well-behaved. Updates #61410. Change-Id: Ib3eb85b384e1309e785663902d2c45ae01e64807 Reviewed-on: https://go-review.googlesource.com/c/go/+/530479 Reviewed-by: Damien Neil <dneil@google.com> Run-TryBot: Jonathan Amsterdam <jba@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-10-02net/http: add GODEBUG setting for old ServeMux behaviorJonathan Amsterdam
Add the GODEBUG setting httpmuxgo121. When set to "1", ServeMux behaves exactly like it did in Go 1.21. Implemented by defining a new, unexported type, serveMux121, that uses the original code. Updates #61410. Change-Id: I0a9d0fe2a2286e442d680393e62895ab50683cea Reviewed-on: https://go-review.googlesource.com/c/go/+/530461 Run-TryBot: Jonathan Amsterdam <jba@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Damien Neil <dneil@google.com>
2023-09-27net/http: add extra synchronization for a Logf call in ↵Bryan C. Mills
TestTransportAndServerSharedBodyRace This race was reported in https://build.golang.org/log/6f043170946b665edb85b50804a62db68348c52f. As best as I can tell, it is another instance of #38370. The deferred call to backend.close() ought to be enough to ensure that the t.Logf happens before the end of the test, but in practice it is not, and with enough scheduling delay we can manage to trip the race detector on a call to Logf after the test function has returned. Updates #38370. Change-Id: I5ee45df45c6bfad3239d665df65a138f1c4573a3 Reviewed-on: https://go-review.googlesource.com/c/go/+/531195 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Bryan Mills <bcmills@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2023-09-25net/http: remove unused functionJonathan Amsterdam
Change-Id: I4364d94663282249e632d12026a810147844ad2e Reviewed-on: https://go-review.googlesource.com/c/go/+/530615 Run-TryBot: Jonathan Amsterdam <jba@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Damien Neil <dneil@google.com>
2023-09-25net/http: unescape paths and patterns by segmentJonathan Amsterdam
When parsing patterns and matching, split the path into segments at slashes, then unescape each segment. This behaves as most people would expect: - The pattern "/%61" matches the paths "/a" and "/%61". - The pattern "/%7B" matches the path "/{". (If we did not unescape patterns, there would be no way to write that pattern: because "/{" is a parse error because it is an invalid wildcard.) - The pattern "/user/{u}" matches "/user/john%2Fdoe" with u set to "john/doe". - The unexpected redirections of #21955 will not occur. A later CL will restore the old behavior behind a GODEBUG setting. Updates #61410. Fixes #21955. Change-Id: I99025e149021fc94bf87d351699270460db532d9 Reviewed-on: https://go-review.googlesource.com/c/go/+/530575 Run-TryBot: Jonathan Amsterdam <jba@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Damien Neil <dneil@google.com>
2023-09-20all: simplify bool conditionsOleksandr Redko
Change-Id: Id2079f7012392dea8dfe2386bb9fb1ea3f487a4a Reviewed-on: https://go-review.googlesource.com/c/go/+/526015 Reviewed-by: Matthew Dempsky <mdempsky@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: qiulaidongfeng <2645477756@qq.com>
2023-09-20net/http: eliminate more clientServerTest leaks in tests that use ↵Bryan C. Mills
runTimeSensitiveTest Change-Id: I77684a095af03d5c4e50da8e7af210b10639ff23 Reviewed-on: https://go-review.googlesource.com/c/go/+/529756 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Bryan Mills <bcmills@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2023-09-20net/http: eliminate a goroutine leak in (*persistConn.addTLS)Bryan C. Mills
In case of a handshake timeout, the goroutine running addTLS closes the underlying connection, which should unblock the call to tlsConn.HandshakeContext. However, it didn't then wait for HandshakeContext to actually return. I thought this might have something to do with #57602, but as far as I can tell it does not. Still, it seems best to avoid the leak: if tracing is enabled we emit a TLSHandshakeDone event, and it seems misleading to produce that event when the handshake is still in progress. For #57602. Change-Id: Ibfc0cf4ef8df2ccf11d8897f23d7d79ee482d5fb Reviewed-on: https://go-review.googlesource.com/c/go/+/529755 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Bryan Mills <bcmills@google.com> Commit-Queue: Bryan Mills <bcmills@google.com>
2023-09-19net/http: add a benchmark for multi indexingJonathan Amsterdam
We don't index multis, so a corpus full of them will take quadratic time to check for conflicts. How slow is that going to be in practice? This benchmark indexes and checks a thousand multi patterns, all disjoint. It runs in about 35ms. Change-Id: Id27940ab19ad003627bd5c43c53466e01456b796 Reviewed-on: https://go-review.googlesource.com/c/go/+/529477 Run-TryBot: Jonathan Amsterdam <jba@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Damien Neil <dneil@google.com>
2023-09-19net/http: test index exhaustivelyJonathan Amsterdam
Replace the fuzz test with one that enumerates all relevant patterns up to a certain length. For conflict detection, we don't need to check every possible method, host and segment, only a few that cover all the possibilities. There are only 2400 distinct patterns in the corpus we generate, and the test generates, indexes and compares them all in about a quarter of a second. Change-Id: I9fde88e87cec07b1b244306119e4e71f7205bb77 Reviewed-on: https://go-review.googlesource.com/c/go/+/529556 Run-TryBot: Jonathan Amsterdam <jba@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Damien Neil <dneil@google.com>
2023-09-19net/http: show offset in pattern parsing errorJonathan Amsterdam
Track the offset in the pattern string being parsed so we can show it in the error message. Change-Id: I495b99378d866f359f45974ffc33587e2c1e366d Reviewed-on: https://go-review.googlesource.com/c/go/+/529123 Run-TryBot: Jonathan Amsterdam <jba@google.com> Reviewed-by: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-09-19net/http: explain why two patterns conflictJonathan Amsterdam
It can be difficult to tell at a glance why two patterns conflict, so explain it with example paths. Change-Id: Ie384f0a4ef64f30e6e6898bce4b88027bc81034b Reviewed-on: https://go-review.googlesource.com/c/go/+/529122 Run-TryBot: Jonathan Amsterdam <jba@google.com> Reviewed-by: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-09-19net/http: index patterns for faster conflict detectionJonathan Amsterdam
Add an index so that pattern registration isn't always quadratic. If there were no index, then every pattern that was registered would have to be compared to every existing pattern for conflicts. This would make registration quadratic in the number of patterns, in every case. The index in this CL should help most of the time. If a pattern has a literal segment, it will weed out all other patterns that have a different literal in that position. The worst case will still be quadratic, but it is unlikely that a set of such patterns would arise naturally. One novel (to me) aspect of the CL is the use of fuzz testing on data that is neither a string nor a byte slice. The test uses fuzzing to generate a byte slice, then decodes the byte slice into a valid pattern (most of the time). This test actually caught a bug: see https://go.dev/cl/529119. Change-Id: Ice0be6547decb5ce75a8062e4e17227815d5d0b0 Reviewed-on: https://go-review.googlesource.com/c/go/+/529121 Run-TryBot: Jonathan Amsterdam <jba@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Damien Neil <dneil@google.com>
2023-09-19net/http: buffer the testConn close channel in ↵Bryan C. Mills
TestHandlerFinishSkipBigContentLengthRead Previously the test used an unbuffered channel, but testConn.Close sends to it with a select-with-default, so the send would be dropped if the test goroutine happened not to have parked on the receive yet. To make this kind of bug less likely in future tests, use a newTestConn helper function instead of constructing testConn channel literals in each test individually. Fixes #62622. Change-Id: I016cd0a89cf8a2a748ed57a4cdbd01a178f04dab Reviewed-on: https://go-review.googlesource.com/c/go/+/529475 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Bryan Mills <bcmills@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2023-09-18net/http: fix bugs in comparePaths and combineRelationshipsJonathan Amsterdam
combineRelationships was wrong on one case: if one part of a pattern overlaps and the other is disjoint, the result is disjoint, not overlaps. For example: /a/{x}/c /{x}/b/d Here the prefix consisting of the first two segments overlaps, but the third segments are disjoint. The patterns as a whole are disjoint. comparePaths was wrong in a couple of ways: First, the loop shouldn't exit early when it sees an overlap, for the reason above: later information may change that. Once the loop was allowed to continue, we had to handle the "overlaps" case at the end. The insight there, which generalized the existing code, is that if the shorter path ends in a multi, that multi matches the remainder of the longer path and more. (It must be "and more": the longer path has at least two segments, so it couldn't match one segment while the shorter path's multi can.) That means we can treat the result as the combination moreGeneral and the relationship of the common prefix. Change-Id: I11dab2c020d820730fb38296d9d6b072bd2a5350 Reviewed-on: https://go-review.googlesource.com/c/go/+/529119 Reviewed-by: Damien Neil <dneil@google.com> Run-TryBot: Jonathan Amsterdam <jba@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
generated by cgit v1.3 (git 2.53.0) at 2026-04-15 07:47:15 +0000