From 957255f5ab1ca4aff3195a20b80fe2aa4eb9e336 Mon Sep 17 00:00:00 2001 From: Mikio Hara Date: Wed, 21 Jan 2015 19:27:34 +0900 Subject: net/http: don't send IPv6 zone identifier in outbound request, per RFC 6874 When making a request to an IPv6 address with a zone identifier, for exmaple [fe80::1%en0], RFC 6874 says HTTP clients must remove the zone identifier "%en0" before writing the request for security reason. This change removes any IPv6 zone identifer attached to URI in the Host header field in requests. Fixes #9544. Change-Id: I7406bd0aa961d260d96f1f887c2e45854e921452 Reviewed-on: https://go-review.googlesource.com/3111 Reviewed-by: Brad Fitzpatrick --- src/net/http/requestwrite_test.go | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) (limited to 'src/net/http/requestwrite_test.go') diff --git a/src/net/http/requestwrite_test.go b/src/net/http/requestwrite_test.go index 7a6bd58786..e9a5f5f080 100644 --- a/src/net/http/requestwrite_test.go +++ b/src/net/http/requestwrite_test.go @@ -455,6 +455,37 @@ var reqWriteTests = []reqWriteTest{ "ALL-CAPS: x\r\n" + "\r\n", }, + + // Request with host header field; IPv6 address with zone identifier + { + Req: Request{ + Method: "GET", + URL: &url.URL{ + Host: "[fe80::1%en0]", + }, + }, + + WantWrite: "GET / HTTP/1.1\r\n" + + "Host: [fe80::1]\r\n" + + "User-Agent: Go 1.1 package http\r\n" + + "\r\n", + }, + + // Request with optional host header field; IPv6 address with zone identifier + { + Req: Request{ + Method: "GET", + URL: &url.URL{ + Host: "www.example.com", + }, + Host: "[fe80::1%en0]:8080", + }, + + WantWrite: "GET / HTTP/1.1\r\n" + + "Host: [fe80::1]:8080\r\n" + + "User-Agent: Go 1.1 package http\r\n" + + "\r\n", + }, } func TestRequestWrite(t *testing.T) { -- cgit v1.3-5-g9baa