22 Commits

Author SHA1 Message Date
Filippo Valsorda
21898524f6 net/http: use ASCII space trimming throughout
Security hardening against HTTP request smuggling. Thank you to ZeddYu
for reporting this issue.

Change-Id: I98bd9f8ffe58360fc3bca9dc5d9a106773e55373
Reviewed-on: https://go-review.googlesource.com/c/go/+/231419
Reviewed-by: Katie Hockman <katie@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2020-05-06 16:25:52 +00:00
Brad Fitzpatrick
c6f9321b5a net/http/httptest: update docs, remove old inaccurate sentence
The "After it is called, changing rw.Header will not affect
rw.HeaderMap" claim predates the Result method which changed how the
Recorder should be used.

Fixes #32144
Fixes #32136

Change-Id: I95bdfa5ac489ce7b0202824bb5663f4da188e8a7
Reviewed-on: https://go-review.googlesource.com/c/go/+/178058
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
2019-05-20 04:22:40 +00:00
Brad Fitzpatrick
13d0af4e70 net/http: export Header.Clone, reduce its allocations, use it everywhere
Fixes #29915

Change-Id: I6e6edf4f9a0e062211f74d120ae1a242bce1b274
Reviewed-on: https://go-review.googlesource.com/c/go/+/173658
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Ingo Oeser <nightlyone@googlemail.com>
Reviewed-by: Benny Siegert <bsiegert@gmail.com>
2019-04-24 18:43:11 +00:00
Bryan C. Mills
c5cf662407 all: move internal/x to vendor/golang.org/x and revendor using 'go mod vendor'
This also updates the vendored-in versions of several packages: 'go
mod vendor' selects a consistent version of each module, but we had
previously vendored an ad-hoc selection of packages.

Notably, x/crypto/hkdf was previously vendored in at a much newer
commit than the rest of x/crypto. Bringing the rest of x/crypto up to
that commit introduced an import of golang.org/x/sys/cpu, which broke
the js/wasm build, requiring an upgrade of x/sys to pick up CL 165749.

Updates #30228
Updates #30241
Updates #25822

Change-Id: I5b3dbc232b7e6a048a158cbd8d36137af1efb711
Reviewed-on: https://go-review.googlesource.com/c/go/+/164623
Reviewed-by: Filippo Valsorda <filippo@golang.org>
2019-03-11 20:28:54 +00:00
Bryan C. Mills
2012227b01 vendor/golang_org/x: move to internal/x
Packages in vendor/ directories have a "vendor/" path prefix in GOPATH
mode, but intentionally do not in module mode. Since the import path
is embedded in the compiled output, changing that path invalidates
cache entries and causes cmd/go to try to rebuild (and reinstall) the
vendored libraries, which will fail if the directory containing those
libraries is read-only.

If I understood correctly, this is the approach Russ suggested as an
alternative to https://golang.org/cl/136138.

Fixes #27285
Fixes #26988

Change-Id: I8a2507fa892b84cde0a803aaa79e460723da572b
Reviewed-on: https://go-review.googlesource.com/c/147443
Run-TryBot: Bryan C. Mills <bcmills@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Russ Cox <rsc@golang.org>
2018-11-29 15:42:16 +00:00
Jack
59699aa166 net/http/httptest: guarantee ResponseRecorder.Result returns a non-nil body
The doc for ResponseRecorder.Result guarantees that the body of the returned
http.Response will be non-nil, but this only holds true if the caller's body is
non-nil. With this change, if the caller's body is nil then the returned
response's body will be an empty io.ReadCloser.

Fixes #26442

Change-Id: I3b2fe4a2541caf9997dbb8978bbaf1f58cd1f471
GitHub-Last-Rev: d802967d89e89c50077fb2d0d455163dcea0eb43
GitHub-Pull-Request: golang/go#26453
Reviewed-on: https://go-review.googlesource.com/124875
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
2018-07-20 19:04:25 +00:00
Caleb Spare
a5f83037ae net/http/httptest: deprecate ResponseRecorder.HeaderMap
Users of this field are better off using Result instead.

Fixes #25763.

Change-Id: I4391afa6ed3873107628630adc1d409d77fb3f20
Reviewed-on: https://go-review.googlesource.com/117675
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2018-06-10 05:49:55 +00:00
David Url
ea3f329613 net/http: omit forbidden Trailer headers from response
Use the vendored ValidTrailerHeader function from x/net/http/httpguts to
check Trailer headers according to RFC 7230. The previous implementation
only omitted illegal Trailer headers defined in RFC 2616.

This CL adds x/net/http/httpguts from CL 104042 (git rev a35a21de97)

Fixes #23908

Change-Id: Ib2329a384040494093c18e209db9b62aaf86e921
Reviewed-on: https://go-review.googlesource.com/104075
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
2018-04-16 17:44:41 +00:00
David Url
7662e6588c net/http: use RFC 723x as normative reference in docs
Replace references to the obsoleted RFC 2616 with references to RFC
7230 through 7235, to avoid unnecessary confusion.
Obvious inconsistencies are marked with todo comments.

Updates #21974

Change-Id: I8fb4fcdd1333fc5193b93a2f09598f18c45e7a00
Reviewed-on: https://go-review.googlesource.com/94095
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2018-02-20 01:41:06 +00:00
Brad Fitzpatrick
6374a6607b net/http/httptest: make ResponseRecorder.Result.Status match http.Transport
Fixes #18438

Change-Id: I9599c1536d5e8bad7662b8ffa19e9b0746e27e60
Reviewed-on: https://go-review.googlesource.com/44000
Reviewed-by: Ian Lance Taylor <iant@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-05-23 23:10:55 +00:00
Brad Fitzpatrick
b2c54afe14 net/http, net/http/httptest: make http2's TrailerPrefix work for http1
Go's http1 implementation originally had a mechanism to send HTTP
trailers based on pre-declaring the trailer keys whose values you'd
later let after the header was written.

http2 copied the same mechanism, but it was found to be unsufficient
for gRPC's wire protocol. A second trailer mechanism was added later
(but only to http2) for handlers that want to send a trailer without
knowing in advance they'd need to.

Copy the same mechanism back to http1 and document it.

Fixes #15754

Change-Id: I8c40d55e28b0e5b7087d3d1a904a392c56ee1f9b
Reviewed-on: https://go-review.googlesource.com/32479
Reviewed-by: Ian Lance Taylor <iant@golang.org>
2016-11-01 17:01:30 +00:00
Brad Fitzpatrick
f697cf2255 net/http/httptest: doc tweaks
From lost-in-flight comments on CL 32190.

Change-Id: I2029cbac6d24b5944a796b359080011ec3a8da92
Reviewed-on: https://go-review.googlesource.com/32210
Reviewed-by: Caleb Spare <cespare@gmail.com>
Reviewed-by: Martin Möhrmann <martisch@uos.de>
2016-10-26 22:55:05 +00:00
Brad Fitzpatrick
8e4ea2f5e8 net/http/httptest: add more docs on ResponseRecord fields
Fixes #16717

Change-Id: I7b6518609796a537437539c35461a18e9e6f207f
Reviewed-on: https://go-review.googlesource.com/32190
Reviewed-by: Martin Möhrmann <martisch@uos.de>
2016-10-26 22:45:13 +00:00
Thomas de Zeeuw
ea143c2990 net/http/httptest: fill ContentLength in recorded Response
This change fills the ContentLength field in the http.Response returned by
ResponseRecorder.Result.

Fixes #16952.

Change-Id: I9c49b1bf83e3719b5275b03a43aff5033156637d
Reviewed-on: https://go-review.googlesource.com/28302
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-09-21 17:34:01 +00:00
Dhaivat Pandit
cd5ab97986 net/http/httptest: updated example to use Result()
example for httptest.Recorder was inspecting Recoder directly.
Using Result() to convert Recorder into a http.Response yields a much
better user experience.

Closes #16837

Change-Id: Id0e636c12cd6adb1ba11f89953ff2b0f43758cf3
Reviewed-on: https://go-review.googlesource.com/27495
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
2016-08-23 05:12:10 +00:00
Brad Fitzpatrick
0b80659832 net/http/httptest: restore historic ResponseRecorder.HeaderMap behavior
In Go versions 1 up to and including Go 1.6,
ResponseRecorder.HeaderMap was both the map that handlers got access
to, and was the map tests checked their results against. That did not
mimic the behavior of the real HTTP server (Issue #8857), so HeaderMap
was changed to be a snapshot at the first write in
https://golang.org/cl/20047. But that broke cases where the Handler
never did a write (#15560), so revert the behavior.

Instead, introduce the ResponseWriter.Result method, returning an
*http.Response. It subsumes ResponseWriter.Trailers which was added
for Go 1.7 in CL 20047. Result().Header now contains the correct
answer, and HeaderMap is unchanged in behavior from previous Go
releases, so we don't break people's tests. People wanting the correct
behavior can use ResponseWriter.Result.

Fixes #15560
Updates #8857

Change-Id: I7ea9b56a6b843103784553d67f67847b5315b3d2
Reviewed-on: https://go-review.googlesource.com/23257
Reviewed-by: Damien Neil <dneil@google.com>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-05-19 23:02:34 +00:00
Brad Fitzpatrick
694eadcce7 net/http/httptest: add NewRequest helper for ease of testing handlers
Fixes #14199

Change-Id: Ic9284023b663de3db1ca7b7b1e96eeab82ec0944
Reviewed-on: https://go-review.googlesource.com/21016
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
Reviewed-by: Andrew Gerrand <adg@golang.org>
2016-03-23 23:22:22 +00:00
Caio Marcelo de Oliveira Filho
c69e6869c9 net/http/httptest: record trailing headers in ResponseRecorder
Trailers() returns the headers that were set by the handler after the
headers were written "to the wire" (in this case HeaderMap) and that
were also specified in a proper header called "Trailer".

Neither HeaderMap or trailerMap (used for Trailers()) are manipulated by
the handler code, instead a third stagingMap is given to the
handler. This avoid a reference kept by handler to affect the recorded
results.

If a handler just modify the header but doesn't call any Write or Flush
method from ResponseWriter (or Flusher) interface, HeaderMap will not be
updated. In this case, calling Flush in the recorder is enough to get
the HeaderMap filled.

Fixes #14531.
Fixes #8857.

Change-Id: I42842341ec3e95c7b87d7e6f178c65cd03d63cc3
Reviewed-on: https://go-review.googlesource.com/20047
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-03-08 19:30:38 +00:00
Brad Fitzpatrick
9ccdc4edac net/http/httptest: don't crash in mime sniffing if HeaderMap is nil
Fixes some failing Google tests when run under Go tip (1.6).

Updates #12986

Change-Id: I0ca4d20f6103d10ea9464e45730085401336dada
Reviewed-on: https://go-review.googlesource.com/17698
Reviewed-by: Russ Cox <rsc@golang.org>
Reviewed-by: Nodir Turakulov <nodir@google.com>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
2015-12-10 18:51:54 +00:00
Nodir Turakulov
0bf515c8c4 net/http/httptest: detect Content-Type in ResponseRecorder
* detect Content-Type on ReponseRecorder.Write[String] call
  if header wasn't written yet, Content-Type header is not set and
  Transfer-Encoding is not set.
* fix typos in serve_test.go

Updates #12986

Change-Id: Id2ed8b1994e64657370fed71eb3882d611f76b31
Reviewed-on: https://go-review.googlesource.com/16096
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
2015-10-20 01:01:22 +00:00
Nodir Turakulov
8c2c35debe net/http/httptest: ResponseRecorder.WriteString
Fixes #11000

Change-Id: Ic137e8a6c5c6b5b7eee213aca9acf78368e1d686
Reviewed-on: https://go-review.googlesource.com/14296
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
2015-09-04 17:23:41 +00:00
Russ Cox
c007ce824d build: move package sources from src/pkg to src
Preparation was in CL 134570043.
This CL contains only the effect of 'hg mv src/pkg/* src'.
For more about the move, see golang.org/s/go14nopkg.
2014-09-08 00:08:51 -04:00