From acb189ea59d7f47e5db075e502dcce5eac6571dc Mon Sep 17 00:00:00 2001 From: ian woolf Date: Mon, 12 Apr 2021 17:19:03 +0800 Subject: net/http: make ReadRequest return an error when requests have multiple Host headers Fixes #45513 Change-Id: I59e717a4bbd3e71320deff519e4f9587ee5c8756 Reviewed-on: https://go-review.googlesource.com/c/go/+/308952 Trust: Damien Neil Reviewed-by: Brad Fitzpatrick --- src/net/http/server.go | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) (limited to 'src/net/http/server.go') diff --git a/src/net/http/server.go b/src/net/http/server.go index d90418b56d..e52a78e652 100644 --- a/src/net/http/server.go +++ b/src/net/http/server.go @@ -983,7 +983,7 @@ func (c *conn) readRequest(ctx context.Context) (w *response, err error) { peek, _ := c.bufr.Peek(4) // ReadRequest will get err below c.bufr.Discard(numLeadingCRorLF(peek)) } - req, err := readRequest(c.bufr, keepHostHeader) + req, err := readRequest(c.bufr) if err != nil { if c.r.hitReadLimit() { return nil, errTooLarge @@ -1003,9 +1003,6 @@ func (c *conn) readRequest(ctx context.Context) (w *response, err error) { if req.ProtoAtLeast(1, 1) && (!haveHost || len(hosts) == 0) && !isH2Upgrade && req.Method != "CONNECT" { return nil, badRequestError("missing required Host header") } - if len(hosts) > 1 { - return nil, badRequestError("too many Host headers") - } if len(hosts) == 1 && !httpguts.ValidHostHeader(hosts[0]) { return nil, badRequestError("malformed Host header") } -- cgit v1.3-5-g9baa