Stowage/go
2
0
Fork 0
mirror of https://github.com/golang/go.git synced 2025-12-08 06:10:04 +00:00
Code Issues Projects Releases Packages Wiki Activity

net/http: switch HTTP1 to ASCII equivalents of string functions

Browse source 
The current implementation uses UTF-aware functions
like strings.EqualFold and strings.ToLower.

This could, in some cases, cause http smuggling.

Change-Id: I0e76a993470a1e1b1b472f4b2859ea0a2b22ada0
Reviewed-on: https://go-review.googlesource.com/c/go/+/308009
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Trust: Roberto Clapis <roberto@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
This commit is contained in:
Roberto Clapis 2021-04-07 14:36:40 +02:00 • committed by Filippo Valsorda
parent dc50683bf7
commit 5c489514bc
14 changed files with 215 additions and 38 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/net/http/httputil/reverseproxy_test.go
View file

@ -16,6 +16,7 @@ import (
"log"
"net/http"
"net/http/httptest"
"net/http/internal/ascii"
"net/url"
"os"
"reflect"
@ -1183,7 +1184,7 @@ func TestReverseProxyWebSocket(t *testing.T) {
t.Errorf("Header(XHeader) = %q; want %q", got, want)
}
if upgradeType(res.Header) != "websocket" {
if !ascii.EqualFold(upgradeType(res.Header), "websocket") {
t.Fatalf("not websocket upgrade; got %#v", res.Header)
}
rwc, ok := res.Body.(io.ReadWriteCloser)
@ -1300,7 +1301,7 @@ func TestReverseProxyWebSocketCancelation(t *testing.T) {
t.Errorf("X-Header mismatch\n\tgot: %q\n\twant: %q", g, w)
}
if g, w := upgradeType(res.Header), "websocket"; g != w {
if g, w := upgradeType(res.Header), "websocket"; !ascii.EqualFold(g, w) {
t.Fatalf("Upgrade header mismatch\n\tgot: %q\n\twant: %q", g, w)
}