aboutsummaryrefslogtreecommitdiff
path: root/src/net/http
AgeCommit message (Collapse)Author
2023-01-26net/http: keep sensitive headers on redirects to the same hostGustavo Falco
Preserve sensitive headers on a redirect to a different port of the same host. Fixes #35104 Change-Id: I5ab57c414ce92a70e688ee684b9ff02fb062b3c6 GitHub-Last-Rev: 8d53e71e2243c141d70d27a503d0f7e6dee64c3c GitHub-Pull-Request: golang/go#54539 Reviewed-on: https://go-review.googlesource.com/c/go/+/424935 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Cherry Mui <cherryyz@google.com> Reviewed-by: Damien Neil <dneil@google.com> Run-TryBot: Damien Neil <dneil@google.com>
2023-01-20net/http: close Request.Body when pconn write loop exits earlyDamien Neil
The pconn write loop closes a request's body after sending the request, but in the case where the write loop exits with an unsent request in writech the body is never closed. Close the request body in this case. Fixes #49621 Change-Id: Id94a92937bbfc0beb1396446f4dee32fd2059c7e Reviewed-on: https://go-review.googlesource.com/c/go/+/461675 TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Damien Neil <dneil@google.com> Reviewed-by: Cherry Mui <cherryyz@google.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2023-01-19internal/godebug: export non-default-behavior counters in runtime/metricsRuss Cox
Allow GODEBUG users to report how many times a setting resulted in non-default behavior. Record non-default-behaviors for all existing GODEBUGs. Also rework tests to ensure that runtime is in sync with runtime/metrics.All, and generate docs mechanically from metrics.All. For #56986. Change-Id: Iefa1213e2a5c3f19ea16cd53298c487952ef05a4 Reviewed-on: https://go-review.googlesource.com/c/go/+/453618 TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> Reviewed-by: Michael Knyszek <mknyszek@google.com>
2023-01-19runtime: replace panic(nil) with panic(new(runtime.PanicNilError))Russ Cox
Long ago we decided that panic(nil) was too unlikely to bother making a special case for purposes of recover. Unfortunately, it has turned out not to be a special case. There are many examples of code in the Go ecosystem where an author has written panic(nil) because they want to panic and don't care about the panic value. Using panic(nil) in this case has the unfortunate behavior of making recover behave as though the goroutine isn't panicking. As a result, code like: func f() { defer func() { if err := recover(); err != nil { log.Fatalf("panicked! %v", err) } }() call1() call2() } looks like it guarantees that call2 has been run any time f returns, but that turns out not to be strictly true. If call1 does panic(nil), then f returns "successfully", having recovered the panic, but without calling call2. Instead you have to write something like: func f() { done := false defer func() { if err := recover(); !done { log.Fatalf("panicked! %v", err) } }() call1() call2() done = true } which defeats nearly the whole point of recover. No one does this, with the result that almost all uses of recover are subtly broken. One specific broken use along these lines is in net/http, which recovers from panics in handlers and sends back an HTTP error. Users discovered in the early days of Go that panic(nil) was a convenient way to jump out of a handler up to the serving loop without sending back an HTTP error. This was a bug, not a feature. Go 1.8 added panic(http.ErrAbortHandler) as a better way to access the feature. Any lingering code that uses panic(nil) to abort an HTTP handler without a failure message should be changed to use http.ErrAbortHandler. Programs that need the old, unintended behavior from net/http or other packages can set GODEBUG=panicnil=1 to stop the run-time error. Uses of recover that want to detect panic(nil) in new programs can check for recover returning a value of type *runtime.PanicNilError. Because the new GODEBUG is used inside the runtime, we can't import internal/godebug, so there is some new machinery to cross-connect those in this CL, to allow a mutable GODEBUG setting. That won't be necessary if we add any other mutable GODEBUG settings in the future. The CL also corrects the handling of defaulted GODEBUG values in the runtime, for #56986. Fixes #25448. Change-Id: I2b39c7e83e4f7aa308777dabf2edae54773e03f5 Reviewed-on: https://go-review.googlesource.com/c/go/+/461956 Reviewed-by: Robert Griesemer <gri@google.com> Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Russ Cox <rsc@golang.org>
2022-12-21net/http/httputil: don't add X-Forwarded-{Host,Proto} after invoking ↵Damien Neil
Director funcs This reverts CL 407414. When forwarding an inbound request that contains an existing X-Forwarded-Host or X-Forwarded-Proto header, a proxy might want to preserve the header from the inbound request, replace it with its own header, or not include any header at all. CL 407414 replaces inbound X-Forwarded-{Host,Proto} headers by default, and allows a Director func to disable sending these headers at all. However, the Director hook API isn't sufficiently flexible to permit the previous behavior of preserving inbound values unchanged. The new Rewrite API does have this flexibility; users of Rewrite can easily pick the exact behavior they want. Revert the change to ReverseProxy when using a Director func. Users who want a convenient way to set X-Forwarded-* headers to reasonable values can migrate to Rewrite at their convenience, and users depending on the current behavior will be unaffected. For #50465. Fixes #57132. Change-Id: Ic42449c1bb525d6c9920bf721efbc519697f4f20 Reviewed-on: https://go-review.googlesource.com/c/go/+/457595 Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org>
2022-12-16net/http: improve errors in TestCancelRequestWhenSharingConnectionDamien Neil
Provide more information about why this test might be hanging waiting for PutIdleConn to be called (#56587): If the round trip that should result in PutIdleConn being invoked completes, report that to the goroutine waiting for PutIdleConn. For #56587 Change-Id: Ie476ea0ce4a48d2bda6b9b109f89d675a10e7e45 Reviewed-on: https://go-review.googlesource.com/c/go/+/457775 Auto-Submit: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Damien Neil <dneil@google.com> Reviewed-by: Bryan Mills <bcmills@google.com>
2022-12-07all: update vendored golang.org/x/netDamien Neil
Pull in HTTP/2 security fix: 1e63c2f08a http2: limit canonical header cache by bytes, not entries Fixes #56350 Change-Id: Ib14024ed894ba266f05d4a6e8c454234a45677d2 Reviewed-on: https://go-review.googlesource.com/c/go/+/455717 Run-TryBot: Damien Neil <dneil@google.com> Reviewed-by: Jenny Rakoczy <jenny@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-12-06os, net/http: avoid escapes from os.DirFS and http.Dir on WindowsDamien Neil
Do not permit access to Windows reserved device names (NUL, COM1, etc.) via os.DirFS and http.Dir filesystems. Avoid escapes from os.DirFS(`\`) on Windows. DirFS would join the the root to the relative path with a path separator, making os.DirFS(`\`).Open(`/foo/bar`) open the path `\\foo\bar`, which is a UNC name. Not only does this not open the intended file, but permits reference to any file on the system rather than only files on the current drive. Make os.DirFS("") invalid, with all file access failing. Previously, a root of "" was interpreted as "/", which is surprising and probably unintentional. Fixes CVE-2022-41720 Fixes #56694 Change-Id: I275b5fa391e6ad7404309ea98ccc97405942e0f0 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1663834 Reviewed-by: Tatiana Bradley <tatianabradley@google.com> Reviewed-by: Julie Qiu <julieqiu@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/455362 Reviewed-by: Michael Pratt <mpratt@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Jenny Rakoczy <jenny@golang.org> Reviewed-on: https://go-review.googlesource.com/c/go/+/455716 Reviewed-by: Jenny Rakoczy <jenny@golang.org> Run-TryBot: Damien Neil <dneil@google.com>
2022-11-30net/http: deflake and fix TestWrappedResponseControllerDamien Neil
Read the full (empty) response body before closing it, to avoid cancelling the request while the server handler is still running. Wrap the ResponseWriter before calling NewResponseController: This test is intended to verify that wrapping the controller works properly, but neglected to actually wrap the controller. Fixes #56961. Change-Id: I00269f897448ab34676338707b7a04d19ff17963 Reviewed-on: https://go-review.googlesource.com/c/go/+/453860 Run-TryBot: Damien Neil <dneil@google.com> Reviewed-by: Bryan Mills <bcmills@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-11-22all: enable disabled HTTP/2 testsDamien Neil
Update net/http to enable tests that pass with the latest update to the vendored x/net. Update a few tests: Windows apparently doesn't guarantee that time.Since(time.Now()) is >=0, so to set a definitely-expired write deadline, use a time firmly in the past rather than now. Put a backoff loop on TestServerReadTimeout to avoid failures when the timeout expires mid-TLS-handshake. (The TLS handshake timeout is set to min(ReadTimeout, WriteTimeout, ReadHeaderTimeout); there's no way to set a long TLS handshake timeout and a short read timeout.) Don't close the http.Server in TestServerWriteTimeout while the handler may still be executing, since this can result in us getting the wrong error. Change the GOOS=js fake net implementation to properly return ErrDeadlineExceeded when a read/write deadline is exceeded, rather than EAGAIN. For #49837 For #54136 Change-Id: Id8a4ff6ac58336ff212dda3c8799b320cd6b9c19 Reviewed-on: https://go-review.googlesource.com/c/go/+/449935 Reviewed-by: Bryan Mills <bcmills@google.com> Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-11-22Revert "net/url, net/http/httputil: accept invalid percent encodings"Damien Neil
This reverts CL 450375. Reason for revert: This change causes test failures (and possibly other problems) for users depending on the existing validation behavior. Rolling back the change for now to give us more time to consider its impact. This landed late in the cycle and isn't urgent; it can wait for 1.21 if we do want to make the change. Fixes #56884 For #56732 Change-Id: I082023c67f1bbb933a617453ab92b67abba876ef Reviewed-on: https://go-review.googlesource.com/c/go/+/452795 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@google.com> Run-TryBot: Damien Neil <dneil@google.com> Reviewed-by: Heschi Kreinick <heschi@google.com>
2022-11-22all: update vendored golang.org/x dependencies for Go 1.20 releaseCherry Mui
The Go 1.20 code freeze has recently started. This is a time to update all golang.org/x/... module versions that contribute packages to the std and cmd modules in the standard library to latest master versions. This CL updates them with x/build/cmd/updatestd. For #36905. Change-Id: Ie0ec91daeb848f00f64686003012297161ad02fa Reviewed-on: https://go-review.googlesource.com/c/go/+/452766 Run-TryBot: Cherry Mui <cherryyz@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2022-11-19net/http: deflake TestIssue4191_InfiniteGetTimeoutDamien Neil
This test exercises the case where a net.Conn error occurs while writing a response body. It injects an error by setting a timeout on the Conn. If this timeout expires before response headers are written, the test fails. The test attempts to recover from this failure by extending the timeout and retrying. Set the timeout after the response headers are removed, and remove the retry loop. Fixes #56274. Change-Id: I293f8bedb7b20a21d14f43ea9bb48fc56b59441c Reviewed-on: https://go-review.googlesource.com/c/go/+/452175 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Bryan Mills <bcmills@google.com> Run-TryBot: Damien Neil <dneil@google.com>
2022-11-19net/http: direct server logs to test output in testsDamien Neil
Set a logger in newClientServerTest that directs the server log output to the testing.T's log, so log output gets properly associated with the test that caused it. Change-Id: I13686ca35c3e21adae16b2fc37ce36daea3df9d5 Reviewed-on: https://go-review.googlesource.com/c/go/+/452075 Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Bryan Mills <bcmills@google.com>
2022-11-18net/http: regenerate h2_bundle.goDmitri Shuralyov
Done with: go generate -run=bundle std After CL 452096 updated the x/net version. Change-Id: I1c1cd76d4ec9e14f45dc66c945c74e41ff689a30 Reviewed-on: https://go-review.googlesource.com/c/go/+/452195 Reviewed-by: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> Run-TryBot: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2022-11-18crypto/tls: add CertificateVerificationError to tls handshakeGabor Tanz
Fixes #48152 Change-Id: I503f088edeb5574fd5eb5905bff7c3c23b2bc8fc GitHub-Last-Rev: 2b0e982f3f6bca33062b0bbd64ed1804801e2c13 GitHub-Pull-Request: golang/go#56686 Reviewed-on: https://go-review.googlesource.com/c/go/+/449336 Run-TryBot: Roland Shoemaker <roland@golang.org> Auto-Submit: Roland Shoemaker <roland@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Julie Qiu <julieqiu@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org>
2022-11-18all: add missing periods in commentscui fliter
Change-Id: I69065f8adf101fdb28682c55997f503013a50e29 Reviewed-on: https://go-review.googlesource.com/c/go/+/449757 Auto-Submit: Ian Lance Taylor <iant@google.com> Reviewed-by: Joedian Reid <joedian@golang.org> Reviewed-by: Keith Randall <khr@google.com> Reviewed-by: Keith Randall <khr@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Joedian Reid <joedian@golang.org> Run-TryBot: Ian Lance Taylor <iant@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com>
2022-11-17net/http: deflake TestResponseControllerSetFutureWriteDeadlineDamien Neil
Don't set the server's write deadline until after the client has read the response headers, avoiding test failures if the deadline expires before or while writing headers. Fixes #56807. Change-Id: I5f80c108b360d030132a13661774a30fac453856 Reviewed-on: https://go-review.googlesource.com/c/go/+/451715 Auto-Submit: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Damien Neil <dneil@google.com> Reviewed-by: Bryan Mills <bcmills@google.com>
2022-11-15net/url, net/http/httputil: accept invalid percent encodingsIan Lance Taylor
Per https://url.spec.whatwg.org/#percent-encoded-bytes an invalid percent encoding should be handled as ordinary text. Fixes #56732 Change-Id: Ib0259dfd704922905289eebaacbf722e28f6d636 Reviewed-on: https://go-review.googlesource.com/c/go/+/450375 Run-TryBot: Ian Lance Taylor <iant@google.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com> Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-11-14internal/godebug: define more efficient APIRuss Cox
We have been expanding our use of GODEBUG for compatibility, and the current implementation forces a tradeoff between freshness and efficiency. It parses the environment variable in full each time it is called, which is expensive. But if clients cache the result, they won't respond to run-time GODEBUG changes, as happened with x509sha1 (#56436). This CL changes the GODEBUG API to provide efficient, up-to-date results. Instead of a single Get function, New returns a *godebug.Setting that itself has a Get method. Clients can save the result of New, which is no more expensive than errors.New, in a global variable, and then call that variable's Get method to get the value. Get costs only two atomic loads in the case where the variable hasn't changed since the last call. Unfortunately, these changes do require importing sync from godebug, which will mean that sync itself will never be able to use a GODEBUG setting. That doesn't seem like such a hardship. If it was really necessary, the runtime could pass a setting to package sync itself at startup, with the caveat that that setting, like the ones used by runtime itself, would not respond to run-time GODEBUG changes. Change-Id: I99a3acfa24fb2a692610af26a5d14bbc62c966ac Reviewed-on: https://go-review.googlesource.com/c/go/+/449504 Run-TryBot: Russ Cox <rsc@golang.org> Auto-Submit: Russ Cox <rsc@golang.org> Reviewed-by: Michael Knyszek <mknyszek@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-11-11net/http: fix triv.goRuss Cox
CL 428137 replaced 'buf := make(bytes.Buffer)' with 'var buf strings.Builder'. That change also requires passing &buf to io.Copy instead of buf. Change-Id: I72b3faa46693e7d1441298f49dc6b95859c3bff3 Reviewed-on: https://go-review.googlesource.com/c/go/+/449635 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Run-TryBot: Russ Cox <rsc@golang.org>
2022-11-10net/http: build error chains in transport that can be unwrappedMarcus Weiner
In some places of the HTTP transport errors were constructed that wrapped other errors without providing the ability to call `errors.Unwrap` on them to get the underlying error. These places have been fixed to use `%w` when using `fmt.Errorf` or to implement `Unwrap() error`. Fixes #56435 Change-Id: Ieed3359281574485c8d0b18298e25e5f1e14555c GitHub-Last-Rev: 504efbc507a50bd2cf63001511733e232927089f GitHub-Pull-Request: golang/go#56451 Reviewed-on: https://go-review.googlesource.com/c/go/+/445775 Reviewed-by: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Michael Knyszek <mknyszek@google.com> Run-TryBot: Damien Neil <dneil@google.com>
2022-11-10net/http: add ResponseController and per-handler timeoutsDamien Neil
The ResponseController type provides a discoverable interface to optional methods implemented by ResponseWriters. c := http.NewResponseController(w) c.Flush() vs. if f, ok := w.(http.Flusher); ok { f.Flush() } Add the ability to control per-request read and write deadlines via the ResponseController SetReadDeadline and SetWriteDeadline methods. For #54136 Change-Id: I3f97de60d4c9ff150cda559ef86c6620eee665d2 Reviewed-on: https://go-review.googlesource.com/c/go/+/436890 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Bryan Mills <bcmills@google.com> Run-TryBot: Damien Neil <dneil@google.com>
2022-11-10net/http: add tests for Server.ReadTimeout and server.WriteTimeoutDamien Neil
We don't seem to have tests verifying that handler reads from the request body or writes to the response body time out properly. Add some. For #49837 For #56478 Change-Id: I0828edd6c86b071073fd1b22ccbb24f86114ab94 Reviewed-on: https://go-review.googlesource.com/c/go/+/446255 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Bryan Mills <bcmills@google.com> Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-11-09net/http: add Transport.OnProxyConnectResponsecuiweixie
Fixes #54299 Change-Id: I3a29527bde7ac71f3824e771982db4257234e9ef Reviewed-on: https://go-review.googlesource.com/c/go/+/447216 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: xie cui <523516579@qq.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Bryan Mills <bcmills@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2022-11-09all: fix some commentscui fliter
Change-Id: I163ea3a770f2228f67d4fb1374653566e64b91f7 Reviewed-on: https://go-review.googlesource.com/c/go/+/448575 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Run-TryBot: Ian Lance Taylor <iant@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Ian Lance Taylor <iant@google.com>
2022-11-08net/textproto: reject invalid header keys/values in ReadMIMEHeaderDamien Neil
Return an error when parsing a MIME header containing bytes in the key or value outside the set allowed by RFC 7230. For historical compatibility, accept spaces in keys (but do not canonicalize the key in this case). For #53188. Change-Id: I195319362a2fc69c4e506644f78c5026db070379 Reviewed-on: https://go-review.googlesource.com/c/go/+/410714 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Bryan Mills <bcmills@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Damien Neil <dneil@google.com>
2022-11-08net/http: remove redundant codetk
Remove redundant code at line 365, `oldCtx := req.Context()`, because it's the same as line 349. Change-Id: I9b028e8c8740c22945708b143e4e86a0baa40f64 GitHub-Last-Rev: 4ad0f3871b1d473246af7cf27c158140c7248cf1 GitHub-Pull-Request: golang/go#54925 Reviewed-on: https://go-review.googlesource.com/c/go/+/428977 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Michael Knyszek <mknyszek@google.com> Run-TryBot: Damien Neil <dneil@google.com>
2022-11-04all: fix function names in commentscui fliter
Change-Id: I871a747b4b47bccc889f2fdc93a2bcebb041b719 Reviewed-on: https://go-review.googlesource.com/c/go/+/447895 Reviewed-by: Ian Lance Taylor <iant@google.com> Reviewed-by: Robert Griesemer <gri@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Ian Lance Taylor <iant@google.com>
2022-11-04net/http: ignore ranges if the content is empty in serveContentJorropo
Fixes #54794 Change-Id: I6f2b7b86b82ea27b9d53cf989daa21cb8ace13da Reviewed-on: https://go-review.googlesource.com/c/go/+/427195 Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Bryan Mills <bcmills@google.com>
2022-10-31net/http: deflake TestCancelRequestWhenSharingConnectionZeke Lu
The test sleeps for 1 millisecond to give the cancellation a moment to take effect. This is flaky because the request can finish before the cancellation of the context is seen. It's easy to verify by adding time.Sleep(2*time.Millisecond) after https://github.com/golang/go/blob/0a6c4c87404ecb018faf002919e5d5db04c69ee2/src/net/http/transport.go#L2619. With this modification, the test fails about 5 times out of 10 runs. The fix is easy. We just need to block the handler of the second request until this request is cancelled. I have verify that the updated test can uncover the issue fixed by CL 257818. Fixes #55226. Change-Id: I81575beef1a920a2ffaa5c6a5ca70a4008bd5f94 GitHub-Last-Rev: 99cb1c2eaed7839394adbb6bbcd4950cd4bfb6f3 GitHub-Pull-Request: golang/go#56500 Reviewed-on: https://go-review.googlesource.com/c/go/+/446676 Run-TryBot: Bryan Mills <bcmills@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Bryan Mills <bcmills@google.com>
2022-10-26all: update golang.org/x/tools to 8166dca1cec9Wayne Zuo
To pick up CL 443575. Note: This CL also update other x repositories because CL 444536 updates x/tools dependencies to latest tagged version. Done by go get -d golang.org/x/tools@8166dca1cec9 go mod tidy go mod vendor Change-Id: Ie2836bb4ebc1db0150ba240af4e2b750dbf1e0b4 Reviewed-on: https://go-review.googlesource.com/c/go/+/445055 Run-TryBot: Wayne Zuo <wdvxdr@golangcn.org> Reviewed-by: Heschi Kreinick <heschi@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Cherry Mui <cherryyz@google.com>
2022-10-14net/http: skip TestTransportPersistConnLeak/h2Damien Neil
We started running this test under HTTP/2 in a recent refactoring. It seems to be flaky for HTTP/2; skip it for now. Change-Id: I8b270afe7f0d3db307b5a951e16f576116333003 Reviewed-on: https://go-review.googlesource.com/c/go/+/443075 Run-TryBot: Damien Neil <dneil@google.com> Reviewed-by: Michael Pratt <mpratt@google.com> Auto-Submit: Damien Neil <dneil@google.com>
2022-10-12net/http: fix some test flakes caused by test refactoringDamien Neil
Skip TestTransportPersistConnLeakShortBody in HTTP/2 mode; it's flaky and was previously HTTP/1-only. Don't run TestTransportEventTrace and TestTransportIgnores408 in parallel. Change-Id: I76bc540fac9317185ef7d414c9deafb35bc926b6 Reviewed-on: https://go-review.googlesource.com/c/go/+/442495 Reviewed-by: Bryan Mills <bcmills@google.com> Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-10-07net/http: refactor tests to run most in HTTP/1 and HTTP/2 modesDamien Neil
Replace the ad-hoc approach to running tests in HTTP/1 and HTTP/2 modes with a 'run' function that executes a test in various modes. By default, these modes are HTTP/1 and HTTP/2, but tests can opt-in to HTTPS/1 as well. The 'run' function also takes care of post-test cleanup (running the afterTest function). The 'run' function runs tests in parallel by default. Tests which can't run in parallel (generally because they use global test hooks) pass a testNotParallel option to disable parallelism. Update clientServerTest to use t.Cleanup to clean up after itself, rather than leaving this up to tests to handle. Drop an unnecessary mutex in SetReadLoopBeforeNextReadHook. Test hooks can't be set in parallel, and we want the race detector to notify us if two simultaneous tests try to set a hook. Fixes #56032 Change-Id: I16be64913c426fc93d84abc6ad85dbd3bc191224 Reviewed-on: https://go-review.googlesource.com/c/go/+/438137 TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Damien Neil <dneil@google.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: David Chase <drchase@google.com>
2022-09-29net/http: using strings.CutPrefix replace strings.HasPrefix and ↵cuiweixie
strings.TrimPrefix Change-Id: I0b7b6e4e9d2539e4fcb5c08430ba5a74733fad3c Reviewed-on: https://go-review.googlesource.com/c/go/+/435136 Reviewed-by: Ian Lance Taylor <iant@google.com> Run-TryBot: Ian Lance Taylor <iant@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com> Run-TryBot: xie cui <523516579@qq.com>
2022-09-29net/http: remove deadstore statementcuiweixie
Change-Id: Icfa3fd519df48f8d7d7aa3795535fd7e6aaa159f Reviewed-on: https://go-review.googlesource.com/c/go/+/435936 Reviewed-by: Ian Lance Taylor <iant@google.com> Run-TryBot: Ian Lance Taylor <iant@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-09-29net/http: use time.Comparecuiweixie
Change-Id: I4730673130bdfbda9987dcb5869f421082f92150 Reviewed-on: https://go-review.googlesource.com/c/go/+/435615 Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com> Run-TryBot: Ian Lance Taylor <iant@google.com>
2022-09-28all: fix some typoscui fliter
Change-Id: I8b28aebbb9494b2c877139a4584a5a42253e3bea GitHub-Last-Rev: e3703fd3a50b811785df75751472aa3ab098b3d1 GitHub-Pull-Request: golang/go#55902 Reviewed-on: https://go-review.googlesource.com/c/go/+/435617 Reviewed-by: Robert Griesemer <gri@google.com> Reviewed-by: Cherry Mui <cherryyz@google.com>
2022-09-27net/http: fix the potential leak of textproto.Reader from poolAndy Pan
Fixes #55835 Change-Id: I6109bab2941b859e8cfef22f65a6a3a5f977a8d7 Reviewed-on: https://go-review.googlesource.com/c/go/+/433835 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com> Run-TryBot: Andy Pan <panjf2000@gmail.com> Run-TryBot: Ian Lance Taylor <iant@google.com>
2022-09-23net/http/httputil: avoid query parameter smugglingDamien Neil
Query parameter smuggling occurs when a proxy's interpretation of query parameters differs from that of a downstream server. Change ReverseProxy to avoid forwarding ignored query parameters. Remove unparsable query parameters from the outbound request * if req.Form != nil after calling ReverseProxy.Director; and * before calling ReverseProxy.Rewrite. This change preserves the existing behavior of forwarding the raw query untouched if a Director hook does not parse the query by calling Request.ParseForm (possibly indirectly). Fixes #54663 Fixes CVE-2022-2880 Change-Id: If1621f6b0e73a49d79059dae9e6b256e0ff18ca9 Reviewed-on: https://go-review.googlesource.com/c/go/+/432976 Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Damien Neil <dneil@google.com>
2022-09-21net/http: add tracing to TestTransportReuseConnection_Gzip_*Damien Neil
These tests are flaky; add some additional logging in hopes it will aid in debugging. For #53373 Change-Id: I971a2815f50932a9700ef8c2f684c5416951e6de Reviewed-on: https://go-review.googlesource.com/c/go/+/432375 Reviewed-by: Bryan Mills <bcmills@google.com> Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-09-21net/http: accept HEAD requests with a bodyDamien Neil
RFC 7231 permits HEAD requests to contain a body, although it does state there are no defined semantics for payloads of HEAD requests and that some servers may reject HEAD requests with a payload. Accept HEAD requests with a body. Fix a bug where a HEAD request with a chunked body would interpret the body as the headers for the next request on the connection. For #53960. Change-Id: I83f7112fdedabd6d6291cd956151d718ee6942cd Reviewed-on: https://go-review.googlesource.com/c/go/+/418614 Run-TryBot: Damien Neil <dneil@google.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Cherry Mui <cherryyz@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-09-21all: update vendored golang.org/x/netDamien Neil
Pull in HTTP/2 fix needed for net/http test case. f8f703f979 http2: accept HEAD requests with a body For #53960 Change-Id: I59bbd83977daced5ed21ec5345af8cdb607e532e Reviewed-on: https://go-review.googlesource.com/c/go/+/432197 Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Cherry Mui <cherryyz@google.com>
2022-09-19net/http: convert Server.disableKeepAlives to atomic typecuiweixie
Change-Id: I87526520b519554ea344288cc0f0940d7b182e21 Reviewed-on: https://go-review.googlesource.com/c/go/+/428815 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Michael Knyszek <mknyszek@google.com> Run-TryBot: Damien Neil <dneil@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2022-09-19net/http: correctly test for leading header spaces in TestReadRequest_BadDamien Neil
TestReadRequest_Bad's tests for leading whitespace in the first header were also exercising the test verifying that a HEAD request has no Content-Length. Also, the test intended to test a leading tab was actually testing for a leading \t (literal backslash, literal t). Change-Id: I05b46d05851b49bf75f1d1257c421b953b66ea9c Reviewed-on: https://go-review.googlesource.com/c/go/+/428134 Reviewed-by: Cherry Mui <cherryyz@google.com> Run-TryBot: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2022-09-16net/http: deflake TestServerCancelsReadHeaderTimeoutWhenIdleBryan C. Mills
Return errors instead of calling t.Fatalf for timing-sensitive failure modes. Scale the Sleep call to the timeout (so that it isn't too short for the longer durations). Fixes #54891. Change-Id: I574e85e121becdda9ab8ee6bfd37c18a549d366d Reviewed-on: https://go-review.googlesource.com/c/go/+/430955 Reviewed-by: Joel Sing <joel@sing.id.au> Run-TryBot: Bryan Mills <bcmills@google.com> Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Bryan Mills <bcmills@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-09-16net/http/httputil: remove duplicated code blockDamien Neil
Remove a harmless but redundant section of code introduced in CL 407214. Change-Id: Id6522e6ff13a283d726b3b97dfc72f101884f733 Reviewed-on: https://go-review.googlesource.com/c/go/+/431395 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Tatiana Bradley <tatiana@golang.org> Run-TryBot: Damien Neil <dneil@google.com>
2022-09-14net/http/httputil: forward 1xx responses in ReverseProxyKévin Dunglas
Support for 1xx responses has recently been merged in net/http (CL 269997). As discussed in this CL (https://go-review.googlesource.com/c/go/+/269997/comments/1ff70bef_c25a829a), support for forwarding 1xx responses in ReverseProxy has been extracted in this separate patch. According to RFC 7231, "a proxy MUST forward 1xx responses unless the proxy itself requested the generation of the 1xx response". Consequently, all received 1xx responses are automatically forwarded as long as the underlying transport supports ClientTrace.Got1xxResponse. Fixes #26088 Fixes #51914 Change-Id: I3a35ea023b798bfe56b7fb8696d5a49695229cfd GitHub-Last-Rev: dab8a461fb65b547306cae9b4c664e60020a8fa6 GitHub-Pull-Request: golang/go#53164 Reviewed-on: https://go-review.googlesource.com/c/go/+/409536 Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Rhys Hiltner <rhys@justin.tv> Run-TryBot: hopehook <hopehook@golangcn.org>
2022-09-13net/http: make DefaultTransport docs about HTTP proxy consistentVladimir Varankin
The changes improve the documentation for DefaultTransport, making the style with how the HTTP proxy environment variables are being referred to, consistent with the rest of the project's documentation. Also mention HTTPS_PROXY environment variables, as suggested in #32649. Change-Id: I4e6b49881d7b30b5a0d4699531fa7c2929fc49f7 GitHub-Last-Rev: 2fc751937be685aa45acf43cf37b8ba2da124e4e GitHub-Pull-Request: golang/go#54996 Reviewed-on: https://go-review.googlesource.com/c/go/+/430135 Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Jenny Rakoczy <jenny@golang.org> Run-TryBot: Damien Neil <dneil@google.com> Reviewed-by: Jenny Rakoczy <jenny@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
generated by cgit v1.3 (git 2.53.0) at 2026-04-15 10:44:02 +0000