aboutsummaryrefslogtreecommitdiff
path: root/src/net/http
AgeCommit message (Collapse)Author
2024-03-11net/http/httptest: add NewRequestWithContextKevin Burke
This matches the net/http API. Updates #59473. Change-Id: I99917cef3ed42a0b4a2b39230b492be00da8bbfd Reviewed-on: https://go-review.googlesource.com/c/go/+/548355 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Cherry Mui <cherryyz@google.com>
2024-03-11net/http: support socks5h proxy schema胡玮文
Extend the net/http Transport to recognize the 'socks5h' schema as an alias for 'socks5'. Traditionally, the 'socks5h' schema indicates that the hostname should be resolved by the proxy server, which is behavior already implemented in Go for 'socks5'. Fixes #24135 Change-Id: I0a6a92bbd282a3200dc4dc7b47a9b0628f931783 Reviewed-on: https://go-review.googlesource.com/c/go/+/569977 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Cherry Mui <cherryyz@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2024-03-10net/http: update bundleRuss Cox
go install golang.org/x/tools/cmd/bundle@latest go generate net/http This fixes the longtest builders, which broke at CL 570156. Change-Id: I85e6a1c20bd0080228400a561efd750342ae2d67 Reviewed-on: https://go-review.googlesource.com/c/go/+/570276 Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Russ Cox <rsc@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2024-03-09internal/godebugs: test for use of IncNonDefaultRuss Cox
A few recent godebugs are missing IncNonDefault uses. Test for that, so that people remember to do it. Filed bugs for the missing ones. For #66215. For #66216. For #66217. Change-Id: Ia3fd10fd108e1b003bb30a8bc2f83995c768fab6 Reviewed-on: https://go-review.googlesource.com/c/go/+/570275 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com>
2024-03-08net/http: close res.Bodyguoguangwu
Change-Id: I0f9faf2a946ebebf9ae30f065f20ec6028c65c22 GitHub-Last-Rev: d957ce10202896f2da4262340cd73fb4faa75836 GitHub-Pull-Request: golang/go#66181 Reviewed-on: https://go-review.googlesource.com/c/go/+/569976 Reviewed-by: Michael Knyszek <mknyszek@google.com> Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com>
2024-03-08net/http: remove persistConn reference from wantConnAlexander Yastrebov
Transport getConn creates wantConn w, tries to obtain idle connection for it based on the w.key and, when there is no idle connection, puts wantConn into idleConnWait wantConnQueue. Then getConn dials connection for w in a goroutine and blocks. After dial succeeds getConn unblocks and returns connection to the caller. At this point w is stored in the idleConnWait and will not be evicted until another wantConn with the same w.key is requested or alive connection returned into the idle pool which may not happen e.g. if server closes the connection. The problem is that even after tryDeliver succeeds w references persistConn wrapper that allocates bufio.Reader and bufio.Writer and prevents them from being garbage collected. To fix the problem this change removes persistConn and error references from wantConn and delivers them via channel to getConn. This way wantConn could be kept in wantConnQueues arbitrary long. Fixes #43966 Fixes #50798 Change-Id: I77942552f7db04c225fb40d770b3101a8cfe655d GitHub-Last-Rev: 027a0833f98b23ddadb3ec7ee4f2e62653bc7705 GitHub-Pull-Request: golang/go#62227 Reviewed-on: https://go-review.googlesource.com/c/go/+/522095 Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Michael Knyszek <mknyszek@google.com> Auto-Submit: Damien Neil <dneil@google.com>
2024-03-07net/http: set Cache-Control header only if presents on errorCuong Manh Le
CL 544019 changes http.Error to remove misleading response headers. However, it also adds new "Cache-Control" header unconditionally, which may breaks existing clients out there, who do not expect to see the this header in the response like test in golang.org/x/net/http2. To keep thing backward compatible, http.Error should only add Cache-Control header if it has been presented. Updates #50905 Change-Id: I989e9f999a30ec170df4fb28905f50aed0267dad Reviewed-on: https://go-review.googlesource.com/c/go/+/569815 Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Cuong Manh Le <cuong.manhle.vn@gmail.com> Reviewed-by: Bryan Mills <bcmills@google.com>
2024-03-07all: remove redundant string conversions when formatting []byte with %scui fliter
Change-Id: I1285ee047fd465f48028186ae04d4de60cc9969e Reviewed-on: https://go-review.googlesource.com/c/go/+/569715 Reviewed-by: Ian Lance Taylor <iant@google.com> Run-TryBot: shuang cui <imcusg@gmail.com> Reviewed-by: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Ian Lance Taylor <iant@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2024-03-06net/http: add ResponseController http2 request without body read deadline testAlexander Yastrebov
Requires CL 464936 For #58237 Change-Id: I007b61f0f216d759f8e5327d77affbd9e8f8ff23 GitHub-Last-Rev: 30a10909b03bb0e8e4cd370a6f5ca386cd4ebc39 GitHub-Pull-Request: golang/go#58282 Reviewed-on: https://go-review.googlesource.com/c/go/+/465035 Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Michael Knyszek <mknyszek@google.com>
2024-03-06net/http: remove misleading response headers on errorMitar
ServeContent API is to set some headers you want to see in the response before calling ServeContent. But if there is an error, those headers should be removed otherwise they might confused the client. Removing those headers is useful in general in the case of an error, so we remove them in http.Error. Fixes #50905. Change-Id: If8d2786c1512906ac93e6b388df6ab1c5ecd1ea9 GitHub-Last-Rev: 32b6f045a791cf7bc391f018452a05cc872041ba GitHub-Pull-Request: golang/go#64312 Reviewed-on: https://go-review.googlesource.com/c/go/+/544019 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Michael Knyszek <mknyszek@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2024-03-05net/http, net/http/cookiejar: avoid subdomain matches on IPv6 zonesDamien Neil
When deciding whether to forward cookies or sensitive headers across a redirect, do not attempt to interpret an IPv6 address as a domain name. Avoids a case where a maliciously-crafted redirect to an IPv6 address with a scoped addressing zone could be misinterpreted as a within-domain redirect. For example, we could interpret "::1%.www.example.com" as a subdomain of "www.example.com". Thanks to Juho Nurminen of Mattermost for reporting this issue. Fixes CVE-2023-45289 Fixes #65065 Change-Id: I8f463f59f0e700c8a18733d2b264a8bcb3a19599 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2131938 Reviewed-by: Tatiana Bradley <tatianabradley@google.com> Reviewed-by: Roland Shoemaker <bracewell@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/569340 Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Carlos Amedee <carlos@golang.org> Auto-Submit: Michael Knyszek <mknyszek@google.com>
2024-03-04net/http: adjust wording on ServeMux godocDave Russell
When reading through the docs, I found that the sentence flows better with the `to` present. Change-Id: I51c21fa33c7a13748c0814dd87c76b9a8d64e2ec GitHub-Last-Rev: 0642bd7185343ba562c7057071d4689ead7a378e GitHub-Pull-Request: golang/go#63587 Reviewed-on: https://go-review.googlesource.com/c/go/+/535935 Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Roland Shoemaker <roland@golang.org>
2024-03-04net/http/cgi: close res.Bodyguoguangwu
Change-Id: I4682442f4f9f3d112b78582c3b9fc2d24c2d58a7 GitHub-Last-Rev: 0823701905b8facdde7204aa6d90df6facd6dc51 GitHub-Pull-Request: golang/go#66049 Reviewed-on: https://go-review.googlesource.com/c/go/+/568316 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Michael Knyszek <mknyszek@google.com> Auto-Submit: Damien Neil <dneil@google.com>
2024-02-29net/http: remove Content-Length header in http.ErrorDamien Neil
Error replies to a request with an error message and HTTP code. Delete any preexisting Content-Length header before writing the header; if a Content-Length is present, it's probably for content that the caller has given up on writing. For #50905 Change-Id: Ia3d4ca008be46fa5d41afadf29ca5cacb1c47660 Reviewed-on: https://go-review.googlesource.com/c/go/+/554216 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Jonathan Amsterdam <jba@google.com>
2024-02-28net/http: make timeout errors match context.DeadlineExceededDamien Neil
When returning an error which implements net.Error and reports itself as a timeout, also report it as matching context.DeadlineExceeded. This matches the behavior of timeout errors in the net package and elsewhere. Fixes #50856 Change-Id: I2ca911e3677a699af27ba89b1200401baa8b3b1b Reviewed-on: https://go-review.googlesource.com/c/go/+/567537 Reviewed-by: Jonathan Amsterdam <jba@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2024-02-27net/http/httputil: avoid ReverseProxy data race on 1xx response and errorDamien Neil
ReverseProxy uses a httptrace.ClientTrace.Got1xxResponse trace hook to capture 1xx response headers for proxying. This hook can be called asynchrnously after RoundTrip returns. (This should only happen when RoundTrip has failed for some reason.) Add synchronization so we don't attempt to modifying the ResponseWriter headers map from the hook after another goroutine has begun making use of it. Fixes #65123 Change-Id: I8b7ecb1a140f7ba7e37b9d27b8a20bca41a118b1 Reviewed-on: https://go-review.googlesource.com/c/go/+/567216 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Jonathan Amsterdam <jba@google.com> Auto-Submit: Damien Neil <dneil@google.com>
2024-02-27net/http: prevent redirect loop in serveFile if "/" is a normal fileMauri de Souza Meneguzzo
When FileServer(Dir("file")) is used where "file" is a normal file and not a directory, the server enters a redirect loop. The usage of a file inplace of a directory path is not documented in http.Dir and it could be considered undefined behavior. This CL updates serveFile to check if we are trying to traverse a normal file instead of a directory and return an error, preventing the redirect loop. Fixes #63769 Change-Id: I81e289444e7d0bd72189c2e7b763f5540333e2d0 GitHub-Last-Rev: 754c9a1167916b5a8c3c827391d7e4a2ff3bc44d GitHub-Pull-Request: golang/go#63860 Reviewed-on: https://go-review.googlesource.com/c/go/+/538719 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Emmanuel Odeke <emmanuel@orijtech.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Bryan Mills <bcmills@google.com> Auto-Submit: Bryan Mills <bcmills@google.com> Commit-Queue: Bryan Mills <bcmills@google.com>
2024-02-27net/http/pprof: avoid panic with user-defined "GET /" routeMatteo Vaccari
With the new routing style in go 1.22, declaring http.Handle("GET /", h) generates a conflict with route "/debug/pprof/" and the others declared in the net/http/pprof package. You get an error such as: panic: pattern "GET /" (registered at .../pprof.go:94): GET / matches fewer methods than /debug/pprof/, but has a more general path pattern This patch prevents that error. Adding GET is correct because no other method makes sense with the /debug/pprof routes. However, a tool using any method other than GET will break. We preserve the traditional behaviour when GODEBUG=httpmuxgo121=1 is specified. Updates #65723 Change-Id: I49c21f5f3e802ad7538062d824354b2e4d8a800e GitHub-Last-Rev: 35e4012663f454fee8f00a321c43592ce4754feb GitHub-Pull-Request: golang/go#65791 Reviewed-on: https://go-review.googlesource.com/c/go/+/565176 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Jonathan Amsterdam <jba@google.com> Reviewed-by: Carlos Amedee <carlos@golang.org>
2024-02-26net/http: reject client-side retries in server timeout testsBryan C. Mills
This breaks an unbounded client-side retry loop if the server's timeout happens to fire during its final read of the TLS handshake. The retry loop was observed on wasm platforms at CL 557437. I was also able to reproduce chains of dozens of retries on my linux/amd64 workstation by adjusting some timeouts and adding a couple of sleeps, as in this patch: https://gist.github.com/bcmills/d0a0a57e5f64eebc24e8211d8ea502b3 However, on linux/amd64 on my workstation the test always eventually breaks out of the retry loop due to timing jitter. I couldn't find a retry-specific hook in the http.Client, http.Transport, or tls.Config structs, so I have instead abused the Transport.Proxy hook for this purpose. Separately, we may want to consider adding a retry-specific hook, or changing the net/http implementation to avoid transparently retrying in this case. Fixes #65410. Updates #65178. Change-Id: I0e43c039615fe815f0a4ba99a8813c48b1fdc7e6 Reviewed-on: https://go-review.googlesource.com/c/go/+/559835 Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Bryan Mills <bcmills@google.com> Reviewed-by: Michael Pratt <mpratt@google.com>
2024-02-26path/filepath: add LocalizeDamien Neil
Add the Localize function, which takes an io/fs slash-separated path and returns an operating system path. Localize returns an error if the path cannot be represented on the current platform. Replace internal/safefile.FromFS with Localize, which serves the same purpose as this function. The internal/safefile package remains separate from path/filepath to avoid a dependency cycle with the os package. Fixes #57151 Change-Id: I75c88047ddea17808276761da07bf79172c4f6fc Reviewed-on: https://go-review.googlesource.com/c/go/+/531677 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Ian Lance Taylor <iant@google.com>
2024-02-26net/http: allow multiple spaces between method and path in mux patternsJes Cok
Fixes #64910 Change-Id: I14fd1e35c95b14591e3ad7b889dc1ab19a008730 GitHub-Last-Rev: b8d436cdee93d103703e7e6d4bb28315c5035300 GitHub-Pull-Request: golang/go#65868 Reviewed-on: https://go-review.googlesource.com/c/go/+/565916 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Jonathan Amsterdam <jba@google.com>
2024-02-24net/http: make FileServer look good on mobileMax 👨🏽‍💻 Coplan
Currently when viewing directories on a phone, the text is small and often hard to tap correctly. This commit adds the viewport property to the page to make it look correct on phones. This commit also makes the page behave in Standards Mode instead of Quirks Mode which does not effect the behavior of this page but makes me feel good inside ☺️ Change-Id: I4babcf79085e85fba57453b7a235e4750a269a42 Reviewed-on: https://go-review.googlesource.com/c/go/+/552595 Auto-Submit: Ian Lance Taylor <iant@golang.org> Commit-Queue: Ian Lance Taylor <iant@golang.org> Reviewed-by: Cherry Mui <cherryyz@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Max Coplan <mchcopl@gmail.com>
2024-02-20net/http: add missing call to decConnsPerHostJulian Tibble
A recent change to Transport.dialConnFor introduced an early return that skipped dialing. This path did not call decConnsPerHost, which can cause subsequent HTTP calls to hang if Transport.MaxConnsPerHost is set. Fixes: #65705 Change-Id: I157591114b02a3a66488d3ead7f1e6dbd374a41c Reviewed-on: https://go-review.googlesource.com/c/go/+/564036 Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Than McIntosh <thanm@google.com>
2024-02-14net/http: reject requests with invalid Content-Length headersAndy Pan
According to RFC 9110 and RFC 9112, invalid "Content-Length" headers might involve request smuggling or response splitting, which could also cause security failures. Currently, `net/http` ignores all "Content-Length" headers when there is a "Transfer-Encoding" header and forward the message anyway while other mainstream HTTP implementations such as Apache Tomcat, Nginx, HAProxy, Node.js, Deno, Tornado, etc. reject invalid Content-Length headers regardless of the presence of a "Transfer-Encoding" header and only forward chunked-encoding messages with either valid "Content-Length" headers or no "Content-Length" headers. Fixes #65505 Change-Id: I73af2ee0785137e56c7546a4cce4a5c5c348dbc5 Reviewed-on: https://go-review.googlesource.com/c/go/+/561075 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Bryan Mills <bcmills@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2024-02-13net/http: close connection if OnProxyConnectResponse returns an errorDamien Neil
Fixes #64804 Change-Id: Ibe56ab8d114b8826e477b0718470d0b9fbfef9b0 Reviewed-on: https://go-review.googlesource.com/c/go/+/560856 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Jonathan Amsterdam <jba@google.com>
2024-02-13net/http: refine trailing-slash redirect logicJonathan Amsterdam
Do not add a trailing slash and redirect if the path already ends in a slash. Also, and unrelatedly, add a test for cleanPath. Fixes #65624. Change-Id: Ifcf9edc929d2eb6db88132c09d2bade85c5dda3d Reviewed-on: https://go-review.googlesource.com/c/go/+/562557 Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2024-02-12net/http: remove superfluous newline on redirectscodesoap
Change-Id: I30d3ae9d540f9cc85ea5a6875ee8884d3e646d6f GitHub-Last-Rev: 29cabdcb3a8746ef51953617f4ec47deac3608da GitHub-Pull-Request: golang/go#65623 Reviewed-on: https://go-review.googlesource.com/c/go/+/562356 Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Than McIntosh <thanm@google.com> TryBot-Bypass: Dmitri Shuralyov <dmitshur@golang.org>
2024-01-30net/textproto: reject HTTP requests with empty header keysAndy Pan
According to RFC 7230, empty field names in HTTP header are invalid. However, there are no specific instructions for developers to deal with that kind of case in the specification. CL 11242 chose to skip it and do nothing about it, which now seems like a bad idea because it has led `net/http` to behave inconsistently with the most widely-used HTTP implementations: Apache, Nginx, Node with llhttp, H2O, Lighttpd, etc. in the case of empty header keys. There is a very small chance that this CL will break a few existing HTTP clients. Fixes #65244 Change-Id: Ie01e9a6693d27caea4d81d1539345cf42b225535 Reviewed-on: https://go-review.googlesource.com/c/go/+/558095 Reviewed-by: Bryan Mills <bcmills@google.com> Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2024-01-29net/http: allow nothingWrittenError in TestTransportPersistConnReadLoopEOFMichael Pratt
Flakes in #64317 are a result of a race where the server shutdown schedules ahead of the client read loop. Normal network latency usually hides this, but wasm's net_fake.go has very low latency. Explicitly allow the results of this race in the test. For #64317. Change-Id: I9c2572fb44643762fe3f3d7cb133d7e7a8a47881 Reviewed-on: https://go-review.googlesource.com/c/go/+/558595 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Michael Pratt <mpratt@google.com>
2024-01-26Revert "net/http: wrap client errors"Cherry Mui
This reverts CL 533119. Reason for revert: the test fails frequently, see #65287. Fixes #65287. Change-Id: I5bf2ee2b7ce435608ff76b892da261c0a4a189bf Reviewed-on: https://go-review.googlesource.com/c/go/+/558916 Reviewed-by: Bryan Mills <bcmills@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Cherry Mui <cherryyz@google.com>
2024-01-25net/http: wrap client errorskayos@tcp.direct
Fixes #50856 Change-Id: I7fe89fcce223e1571debb73436f8aeb3bfbe4b9f GitHub-Last-Rev: be570e7883be06adbd227a1dfe63a80e384d96f6 GitHub-Pull-Request: golang/go#63448 Reviewed-on: https://go-review.googlesource.com/c/go/+/533119 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: qiulaidongfeng <2645477756@qq.com> Reviewed-by: Cherry Mui <cherryyz@google.com>
2024-01-22all: update vendored dependenciesCherry Mui
The Go 1.23 development tree has opened. This is a time to update all golang.org/x/... module versions that contribute packages to the std and cmd modules in the standard library to latest master versions. Generated with: go install golang.org/x/build/cmd/updatestd@latest go install golang.org/x/tools/cmd/bundle@latest updatestd -goroot=$(pwd) -branch=master For #36905. Change-Id: I46a68f27a54f1e3f9e1aa5af4de6ee0b26388f3f Reviewed-on: https://go-review.googlesource.com/c/go/+/557457 Reviewed-by: Carlos Amedee <carlos@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2024-01-22net/http/pprof: configure WriteDeadlineAlexander Yastrebov
Configure write deadline according to requested profiling duration. Fixes #62358 Change-Id: I2350110ff20a637c7e90bdda57026b0b0d9c87ba GitHub-Last-Rev: b79ae38defc4d9b58b23a9d13ff86fa863f18b00 GitHub-Pull-Request: golang/go#64360 Reviewed-on: https://go-review.googlesource.com/c/go/+/544756 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2024-01-10net: add available godoc linkcui fliter
Change-Id: Ib7c4baf0247c421954aedabfbb6a6af8a08a8936 Reviewed-on: https://go-review.googlesource.com/c/go/+/540021 Reviewed-by: Damien Neil <dneil@google.com> Run-TryBot: shuang cui <imcusg@gmail.com> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2024-01-09net/http: clarify the precedence order for Request.FormValueJes Cok
Fixes #64575 Change-Id: I0eaec642a9dc8ae3b273a6d41131cc7cb8332947 GitHub-Last-Rev: 17aa5170cbfe42cb86d56f1804266850d33c3eb5 GitHub-Pull-Request: golang/go#64578 Reviewed-on: https://go-review.googlesource.com/c/go/+/547855 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2024-01-04net/http: respond with 400 Bad Request for empty hex number of chunk lengthAndy Pan
Fixes #64517 Change-Id: I78b8a6a83301deee05c3ff052a6adcd1f965aef2 Reviewed-on: https://go-review.googlesource.com/c/go/+/553835 Auto-Submit: Damien Neil <dneil@google.com> Commit-Queue: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Bryan Mills <bcmills@google.com>
2024-01-04net/http/cgi: in TestCopyError, check for a Handler.ServeHTTP goroutine ↵Bryan C. Mills
instead of a running PID Previously, the test could fail spuriously if the CGI process's PID happened to be reused in between checks. That sort of reuse is highly unlikely on platforms that cycle through the PID space sequentially (such as Linux), but plausible on platforms that use randomized PIDs (such as OpenBSD). Also unskip the test on Windows, since it no longer relies on being able to send signal 0 to an arbitrary PID. Also change the expected failure mode of the test to a timeout instead of a call to t.Fatalf, so that on failure we get a useful goroutine dump for debugging instead of a non-actionable failure message. Fixes #57369 (maybe). Change-Id: Ib7e3fff556450b48cb5e6ea120fdf4d53547479b Reviewed-on: https://go-review.googlesource.com/c/go/+/554075 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Bryan Mills <bcmills@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2024-01-03net/http: make Request.Clone create fresh copies for matches and otherValuesJes Cok
This change fixes Request.Clone to correctly work with SetPathValue by creating fresh copies for matches and otherValues so that SetPathValue for cloned requests doesn't pollute the original request. While here, also added a doc for Request.SetPathValue. Fixes #64911 Change-Id: I2831b38e135935dfaea2b939bb9db554c75b65ef GitHub-Last-Rev: 1981db16475a49fe8d4b874a6bceec64d28a1332 GitHub-Pull-Request: golang/go#64913 Reviewed-on: https://go-review.googlesource.com/c/go/+/553375 Reviewed-by: Emmanuel Odeke <emmanuel@orijtech.com> Run-TryBot: Jes Cok <xigua67damn@gmail.com> Auto-Submit: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Jonathan Amsterdam <jba@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2023-12-14all: remove newline characters after return statementsDanil Timerbulatov
This commit is aimed at improving the readability and consistency of the code base. Extraneous newline characters were present after some return statements, creating unnecessary separation in the code. Fixes #64610 Change-Id: Ic1b05bf11761c4dff22691c2f1c3755f66d341f7 Reviewed-on: https://go-review.googlesource.com/c/go/+/548316 Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Michael Pratt <mpratt@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2023-12-07internal/profile: fully decode proto even if there are no samplesMichael Pratt
This is a partial revert of CL 483137. CL 483137 started checking errors in postDecode, which is good. Now we can catch more malformed pprof protos. However this made TestEmptyProfile fail, so an early return was added when the profile was "empty" (no samples). Unfortunately, this was problematic. Profiles with no samples can still be valid, but skipping postDecode meant that the resulting Profile was missing values from the string table. In particular, net/http/pprof needs to parse empty profiles in order to pass through the sample and period types to a final output proto. CL 483137 broke this behavior. internal/profile.Parse is only used in two places: in cmd/compile to parse PGO pprof profiles, and in net/http/pprof to parse before/after pprof profiles for delta profiles. In both cases, the input is never literally empty (0 bytes). Even a pprof proto with no samples still contains some header fields, such as sample and period type. Upstream github.com/google/pprof/profile even has an explicit error on 0 byte input, so `go tool pprof` will not support such an input. Thus TestEmptyProfile was misleading; this profile doesn't need to support empty input at all. Resolve this by removing TestEmptyProfile and replacing it with an explicit error on empty input, as upstream github.com/google/pprof/profile has. For non-empty input, always run postDecode to ensure the string table is processed. TestConvertCPUProfileEmpty is reverted back to assert the values from before CL 483137. Note that in this case "Empty" means no samples, not a 0 byte input. Continue to allow empty files for PGO in order to minimize the chance of last minute breakage if some users have empty files. Fixes #64566. Change-Id: I83a1f0200ae225ac6da0009d4b2431fe215b283f Reviewed-on: https://go-review.googlesource.com/c/go/+/547996 Reviewed-by: Michael Knyszek <mknyszek@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Cherry Mui <cherryyz@google.com>
2023-12-05net/http: limit chunked data overheadDamien Neil
The chunked transfer encoding adds some overhead to the content transferred. When writing one byte per chunk, for example, there are five bytes of overhead per byte of data transferred: "1\r\nX\r\n" to send "X". Chunks may include "chunk extensions", which we skip over and do not use. For example: "1;chunk extension here\r\nX\r\n". A malicious sender can use chunk extensions to add about 4k of overhead per byte of data. (The maximum chunk header line size we will accept.) Track the amount of overhead read in chunked data, and produce an error if it seems excessive. Fixes #64433 Fixes CVE-2023-39326 Change-Id: I40f8d70eb6f9575fb43f506eb19132ccedafcf39 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2076135 Reviewed-by: Tatiana Bradley <tatianabradley@google.com> Reviewed-by: Roland Shoemaker <bracewell@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/547335 Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-12-01net/http: avoid leaking io.Copy goroutines (and hijacked connections) in ↵Bryan C. Mills
TestTransportNoReuseAfterEarlyResponse Fixes #64252 (maybe). Change-Id: Iba2a403a9347be4206f14acb11591dc2eb7f9fb8 Reviewed-on: https://go-review.googlesource.com/c/go/+/546616 Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Bryan Mills <bcmills@google.com>
2023-11-29all: update vendored dependenciesDmitri Shuralyov
The Go 1.22 code freeze has recently started. This is a time to update all golang.org/x/... module versions that contribute packages to the std and cmd modules in the standard library to latest master versions. Generated with: go install golang.org/x/build/cmd/updatestd@latest go install golang.org/x/tools/cmd/bundle@latest updatestd -goroot=$(pwd) -branch=master For #36905. Change-Id: I76525261b9a954ed21a3bd3cb6c4a12e6c031d80 Cq-Include-Trybots: luci.golang.try:gotip-windows-amd64-longtest,gotip-linux-amd64-longtest,gotip-linux-386-longtest Reviewed-on: https://go-review.googlesource.com/c/go/+/546055 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Michael Knyszek <mknyszek@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org>
2023-11-21net/http: use pointers to array for copyBufPoolJorropo
This is inspired by CL 539915, I'm only submitting now that CL 456435 has been merged. This divide the number of objects kept alive by the heap by two and remove the slice header allocation in New and in the put back. Change-Id: Ibcd5166bac5a37f365a533e09a28f3b79f81ad58 Reviewed-on: https://go-review.googlesource.com/c/go/+/543515 Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: qiulaidongfeng <2645477756@qq.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Michael Knyszek <mknyszek@google.com>
2023-11-20src: a/an grammar fixesVille Skyttä
Change-Id: I179b50ae8e73677d4d408b83424afbbfe6aa17a1 GitHub-Last-Rev: 2e2d9c1e45556155d02db4df381b99f2d1bc5c0e GitHub-Pull-Request: golang/go#63478 Reviewed-on: https://go-review.googlesource.com/c/go/+/534015 Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Michael Knyszek <mknyszek@google.com>
2023-11-17all: add missing copyright headerJes Cok
Change-Id: Ic61fb181923159e80a86a41582e83ec466ab9bc4 GitHub-Last-Rev: 92469845665fa1f864d257c8bc175201a43b4d43 GitHub-Pull-Request: golang/go#64080 Reviewed-on: https://go-review.googlesource.com/c/go/+/541741 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Michael Pratt <mpratt@google.com> Reviewed-by: Than McIntosh <thanm@google.com> Run-TryBot: Jes Cok <xigua67damn@gmail.com>
2023-11-17net,os: arrange zero-copy of os.File and net.TCPConn to net.UnixConnAndy Pan
Fixes #58808 goos: linux goarch: amd64 pkg: net cpu: DO-Premium-Intel │ old │ new │ │ sec/op │ sec/op vs base │ Splice/tcp-to-unix/1024-4 3.783µ ± 10% 3.201µ ± 7% -15.40% (p=0.001 n=10) Splice/tcp-to-unix/2048-4 3.967µ ± 13% 3.818µ ± 16% ~ (p=0.971 n=10) Splice/tcp-to-unix/4096-4 4.988µ ± 16% 4.590µ ± 11% ~ (p=0.089 n=10) Splice/tcp-to-unix/8192-4 6.981µ ± 13% 5.236µ ± 9% -25.00% (p=0.000 n=10) Splice/tcp-to-unix/16384-4 10.192µ ± 9% 7.350µ ± 7% -27.89% (p=0.000 n=10) Splice/tcp-to-unix/32768-4 19.65µ ± 13% 10.28µ ± 16% -47.69% (p=0.000 n=10) Splice/tcp-to-unix/65536-4 41.89µ ± 18% 15.70µ ± 13% -62.52% (p=0.000 n=10) Splice/tcp-to-unix/131072-4 90.05µ ± 11% 29.55µ ± 10% -67.18% (p=0.000 n=10) Splice/tcp-to-unix/262144-4 170.24µ ± 15% 52.66µ ± 4% -69.06% (p=0.000 n=10) Splice/tcp-to-unix/524288-4 326.4µ ± 13% 109.3µ ± 11% -66.52% (p=0.000 n=10) Splice/tcp-to-unix/1048576-4 651.4µ ± 9% 228.3µ ± 14% -64.95% (p=0.000 n=10) geomean 29.42µ 15.62µ -46.90% │ old │ new │ │ B/s │ B/s vs base │ Splice/tcp-to-unix/1024-4 258.2Mi ± 11% 305.2Mi ± 8% +18.21% (p=0.001 n=10) Splice/tcp-to-unix/2048-4 492.5Mi ± 15% 511.7Mi ± 13% ~ (p=0.971 n=10) Splice/tcp-to-unix/4096-4 783.5Mi ± 14% 851.2Mi ± 12% ~ (p=0.089 n=10) Splice/tcp-to-unix/8192-4 1.093Gi ± 11% 1.458Gi ± 8% +33.36% (p=0.000 n=10) Splice/tcp-to-unix/16384-4 1.497Gi ± 9% 2.076Gi ± 7% +38.67% (p=0.000 n=10) Splice/tcp-to-unix/32768-4 1.553Gi ± 11% 2.969Gi ± 14% +91.17% (p=0.000 n=10) Splice/tcp-to-unix/65536-4 1.458Gi ± 23% 3.888Gi ± 11% +166.69% (p=0.000 n=10) Splice/tcp-to-unix/131072-4 1.356Gi ± 10% 4.131Gi ± 9% +204.72% (p=0.000 n=10) Splice/tcp-to-unix/262144-4 1.434Gi ± 13% 4.637Gi ± 4% +223.32% (p=0.000 n=10) Splice/tcp-to-unix/524288-4 1.497Gi ± 15% 4.468Gi ± 10% +198.47% (p=0.000 n=10) Splice/tcp-to-unix/1048576-4 1.501Gi ± 10% 4.277Gi ± 16% +184.88% (p=0.000 n=10) geomean 1.038Gi 1.954Gi +88.28% │ old │ new │ │ B/op │ B/op vs base │ Splice/tcp-to-unix/1024-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/2048-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/4096-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/8192-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/16384-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/32768-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/65536-4 1.000 ± ? 0.000 ± 0% -100.00% (p=0.001 n=10) Splice/tcp-to-unix/131072-4 2.000 ± 0% 0.000 ± 0% -100.00% (p=0.000 n=10) Splice/tcp-to-unix/262144-4 4.000 ± 25% 0.000 ± 0% -100.00% (p=0.000 n=10) Splice/tcp-to-unix/524288-4 7.500 ± 33% 0.000 ± 0% -100.00% (p=0.000 n=10) Splice/tcp-to-unix/1048576-4 17.00 ± 12% 0.00 ± 0% -100.00% (p=0.000 n=10) geomean ² ? ² ³ ¹ all samples are equal ² summaries must be >0 to compute geomean ³ ratios must be >0 to compute geomean │ old │ new │ │ allocs/op │ allocs/op vs base │ Splice/tcp-to-unix/1024-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/2048-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/4096-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/8192-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/16384-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/32768-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/65536-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/131072-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/262144-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/524288-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Splice/tcp-to-unix/1048576-4 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ geomean ² +0.00% ² ¹ all samples are equal ² summaries must be >0 to compute geomean Change-Id: I829061b009a0929a8ef1a15c183793c0b9104dde Reviewed-on: https://go-review.googlesource.com/c/go/+/472475 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Bryan Mills <bcmills@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-11-15net/http: don't set length for non-range encoded content requestsDamien Neil
Historically, serveContent has not set Content-Length when the user provides Content-Encoding. This causes broken responses when the user sets both Content-Length and Content-Encoding, and the request is a range request, because the returned data doesn't match the declared length. CL 381956 fixed this case by changing serveContent to always set a Content-Length header. Unfortunately, I've discovered multiple cases in the wild of users setting Content-Encoding: gzip and passing serveContent a ResponseWriter wrapper that gzips the data written to it. This breaks serveContent in a number of ways. In particular, there's no way for it to respond to Range requests properly, because it doesn't know the recipient's view of the content. What the user should be doing in this case is just using io.Copy to send the gzipped data to the response. Or possibly setting Transfer-Encoding: gzip. But whatever they should be doing, what they are doing has mostly worked for non-Range requests, and setting Content-Length makes it stop working because the length of the file being served doesn't match the number of bytes being sent. So in the interests of not breaking users (even if they're misusing serveContent in ways that are already broken), partially revert CL 381956. For non-Range requests, don't set Content-Length when the user has set Content-Encoding. This matches our previous behavior and causes minimal harm in cases where we could have set Content-Length. (We will send using chunked encoding rather than identity, but that's fine.) For Range requests, set Content-Length unconditionally. Either the user isn't mangling the data in the ResponseWriter, in which case the length is correct, or they are, in which case the response isn't going to contain the right bytes anyway. (Note that a Range request for a Content-Length: gzip file is requesting a range of *gzipped* bytes, not a range from the uncompressed file.) Change-Id: I5e788e6756f34cee520aa7c456826f462a59f7eb Reviewed-on: https://go-review.googlesource.com/c/go/+/542595 Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Jonathan Amsterdam <jba@google.com>
2023-11-14crypto/tls: remove RSA KEX ciphers from the default listRoland Shoemaker
Removes the RSA KEX based ciphers from the default list. This can be reverted using the tlsrsakex GODEBUG. Fixes #63413 Change-Id: Id221be3eb2f6c24b91039d380313f0c87d339f98 Reviewed-on: https://go-review.googlesource.com/c/go/+/541517 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com>
2023-11-09net/http: use copyBufPool in transferWriter.doBodyCopy()Michał Matczuk
This is a followup to CL 14177. It applies copyBufPool optimization to transferWriter.doBodyCopy(). The function is used every time Request or Response is written. Without this patch for every Request and Response processed, if there is a body, we need to allocate and GC a 32k buffer. This is quickly causing GC pressure. Fixes #57202 Change-Id: I4c30e1737726ac8d9937846106efd02effbae300 GitHub-Last-Rev: 908573cdbe2e8b6f91ce026cf8632ff5f2c41110 GitHub-Pull-Request: golang/go#57205 Reviewed-on: https://go-review.googlesource.com/c/go/+/456435 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Bryan Mills <bcmills@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: qiulaidongfeng <2645477756@qq.com>
generated by cgit v1.3-5-g9baa (git 2.53.0) at 2026-04-17 06:32:11 +0000