github.com/aloncn/graphics-go@v0.0.1/src/net/http/request.go (about)

     1  // Copyright 2009 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  // HTTP Request reading and parsing.
     6  
     7  package http
     8  
     9  import (
    10  	"bufio"
    11  	"bytes"
    12  	"crypto/tls"
    13  	"encoding/base64"
    14  	"errors"
    15  	"fmt"
    16  	"io"
    17  	"io/ioutil"
    18  	"mime"
    19  	"mime/multipart"
    20  	"net/textproto"
    21  	"net/url"
    22  	"strconv"
    23  	"strings"
    24  	"sync"
    25  )
    26  
    27  const (
    28  	defaultMaxMemory = 32 << 20 // 32 MB
    29  )
    30  
    31  // ErrMissingFile is returned by FormFile when the provided file field name
    32  // is either not present in the request or not a file field.
    33  var ErrMissingFile = errors.New("http: no such file")
    34  
    35  // HTTP request parsing errors.
    36  type ProtocolError struct {
    37  	ErrorString string
    38  }
    39  
    40  func (err *ProtocolError) Error() string { return err.ErrorString }
    41  
    42  var (
    43  	ErrHeaderTooLong        = &ProtocolError{"header too long"}
    44  	ErrShortBody            = &ProtocolError{"entity body too short"}
    45  	ErrNotSupported         = &ProtocolError{"feature not supported"}
    46  	ErrUnexpectedTrailer    = &ProtocolError{"trailer header without chunked transfer encoding"}
    47  	ErrMissingContentLength = &ProtocolError{"missing ContentLength in HEAD response"}
    48  	ErrNotMultipart         = &ProtocolError{"request Content-Type isn't multipart/form-data"}
    49  	ErrMissingBoundary      = &ProtocolError{"no multipart boundary param in Content-Type"}
    50  )
    51  
    52  type badStringError struct {
    53  	what string
    54  	str  string
    55  }
    56  
    57  func (e *badStringError) Error() string { return fmt.Sprintf("%s %q", e.what, e.str) }
    58  
    59  // Headers that Request.Write handles itself and should be skipped.
    60  var reqWriteExcludeHeader = map[string]bool{
    61  	"Host":              true, // not in Header map anyway
    62  	"User-Agent":        true,
    63  	"Content-Length":    true,
    64  	"Transfer-Encoding": true,
    65  	"Trailer":           true,
    66  }
    67  
    68  // A Request represents an HTTP request received by a server
    69  // or to be sent by a client.
    70  //
    71  // The field semantics differ slightly between client and server
    72  // usage. In addition to the notes on the fields below, see the
    73  // documentation for Request.Write and RoundTripper.
    74  type Request struct {
    75  	// Method specifies the HTTP method (GET, POST, PUT, etc.).
    76  	// For client requests an empty string means GET.
    77  	Method string
    78  
    79  	// URL specifies either the URI being requested (for server
    80  	// requests) or the URL to access (for client requests).
    81  	//
    82  	// For server requests the URL is parsed from the URI
    83  	// supplied on the Request-Line as stored in RequestURI.  For
    84  	// most requests, fields other than Path and RawQuery will be
    85  	// empty. (See RFC 2616, Section 5.1.2)
    86  	//
    87  	// For client requests, the URL's Host specifies the server to
    88  	// connect to, while the Request's Host field optionally
    89  	// specifies the Host header value to send in the HTTP
    90  	// request.
    91  	URL *url.URL
    92  
    93  	// The protocol version for incoming server requests.
    94  	//
    95  	// For client requests these fields are ignored. The HTTP
    96  	// client code always uses either HTTP/1.1 or HTTP/2.
    97  	// See the docs on Transport for details.
    98  	Proto      string // "HTTP/1.0"
    99  	ProtoMajor int    // 1
   100  	ProtoMinor int    // 0
   101  
   102  	// Header contains the request header fields either received
   103  	// by the server or to be sent by the client.
   104  	//
   105  	// If a server received a request with header lines,
   106  	//
   107  	//	Host: example.com
   108  	//	accept-encoding: gzip, deflate
   109  	//	Accept-Language: en-us
   110  	//	fOO: Bar
   111  	//	foo: two
   112  	//
   113  	// then
   114  	//
   115  	//	Header = map[string][]string{
   116  	//		"Accept-Encoding": {"gzip, deflate"},
   117  	//		"Accept-Language": {"en-us"},
   118  	//		"Foo": {"Bar", "two"},
   119  	//	}
   120  	//
   121  	// For incoming requests, the Host header is promoted to the
   122  	// Request.Host field and removed from the Header map.
   123  	//
   124  	// HTTP defines that header names are case-insensitive. The
   125  	// request parser implements this by using CanonicalHeaderKey,
   126  	// making the first character and any characters following a
   127  	// hyphen uppercase and the rest lowercase.
   128  	//
   129  	// For client requests, certain headers such as Content-Length
   130  	// and Connection are automatically written when needed and
   131  	// values in Header may be ignored. See the documentation
   132  	// for the Request.Write method.
   133  	Header Header
   134  
   135  	// Body is the request's body.
   136  	//
   137  	// For client requests a nil body means the request has no
   138  	// body, such as a GET request. The HTTP Client's Transport
   139  	// is responsible for calling the Close method.
   140  	//
   141  	// For server requests the Request Body is always non-nil
   142  	// but will return EOF immediately when no body is present.
   143  	// The Server will close the request body. The ServeHTTP
   144  	// Handler does not need to.
   145  	Body io.ReadCloser
   146  
   147  	// ContentLength records the length of the associated content.
   148  	// The value -1 indicates that the length is unknown.
   149  	// Values >= 0 indicate that the given number of bytes may
   150  	// be read from Body.
   151  	// For client requests, a value of 0 means unknown if Body is not nil.
   152  	ContentLength int64
   153  
   154  	// TransferEncoding lists the transfer encodings from outermost to
   155  	// innermost. An empty list denotes the "identity" encoding.
   156  	// TransferEncoding can usually be ignored; chunked encoding is
   157  	// automatically added and removed as necessary when sending and
   158  	// receiving requests.
   159  	TransferEncoding []string
   160  
   161  	// Close indicates whether to close the connection after
   162  	// replying to this request (for servers) or after sending this
   163  	// request and reading its response (for clients).
   164  	//
   165  	// For server requests, the HTTP server handles this automatically
   166  	// and this field is not needed by Handlers.
   167  	//
   168  	// For client requests, setting this field prevents re-use of
   169  	// TCP connections between requests to the same hosts, as if
   170  	// Transport.DisableKeepAlives were set.
   171  	Close bool
   172  
   173  	// For server requests Host specifies the host on which the
   174  	// URL is sought. Per RFC 2616, this is either the value of
   175  	// the "Host" header or the host name given in the URL itself.
   176  	// It may be of the form "host:port".
   177  	//
   178  	// For client requests Host optionally overrides the Host
   179  	// header to send. If empty, the Request.Write method uses
   180  	// the value of URL.Host.
   181  	Host string
   182  
   183  	// Form contains the parsed form data, including both the URL
   184  	// field's query parameters and the POST or PUT form data.
   185  	// This field is only available after ParseForm is called.
   186  	// The HTTP client ignores Form and uses Body instead.
   187  	Form url.Values
   188  
   189  	// PostForm contains the parsed form data from POST, PATCH,
   190  	// or PUT body parameters.
   191  	//
   192  	// This field is only available after ParseForm is called.
   193  	// The HTTP client ignores PostForm and uses Body instead.
   194  	PostForm url.Values
   195  
   196  	// MultipartForm is the parsed multipart form, including file uploads.
   197  	// This field is only available after ParseMultipartForm is called.
   198  	// The HTTP client ignores MultipartForm and uses Body instead.
   199  	MultipartForm *multipart.Form
   200  
   201  	// Trailer specifies additional headers that are sent after the request
   202  	// body.
   203  	//
   204  	// For server requests the Trailer map initially contains only the
   205  	// trailer keys, with nil values. (The client declares which trailers it
   206  	// will later send.)  While the handler is reading from Body, it must
   207  	// not reference Trailer. After reading from Body returns EOF, Trailer
   208  	// can be read again and will contain non-nil values, if they were sent
   209  	// by the client.
   210  	//
   211  	// For client requests Trailer must be initialized to a map containing
   212  	// the trailer keys to later send. The values may be nil or their final
   213  	// values. The ContentLength must be 0 or -1, to send a chunked request.
   214  	// After the HTTP request is sent the map values can be updated while
   215  	// the request body is read. Once the body returns EOF, the caller must
   216  	// not mutate Trailer.
   217  	//
   218  	// Few HTTP clients, servers, or proxies support HTTP trailers.
   219  	Trailer Header
   220  
   221  	// RemoteAddr allows HTTP servers and other software to record
   222  	// the network address that sent the request, usually for
   223  	// logging. This field is not filled in by ReadRequest and
   224  	// has no defined format. The HTTP server in this package
   225  	// sets RemoteAddr to an "IP:port" address before invoking a
   226  	// handler.
   227  	// This field is ignored by the HTTP client.
   228  	RemoteAddr string
   229  
   230  	// RequestURI is the unmodified Request-URI of the
   231  	// Request-Line (RFC 2616, Section 5.1) as sent by the client
   232  	// to a server. Usually the URL field should be used instead.
   233  	// It is an error to set this field in an HTTP client request.
   234  	RequestURI string
   235  
   236  	// TLS allows HTTP servers and other software to record
   237  	// information about the TLS connection on which the request
   238  	// was received. This field is not filled in by ReadRequest.
   239  	// The HTTP server in this package sets the field for
   240  	// TLS-enabled connections before invoking a handler;
   241  	// otherwise it leaves the field nil.
   242  	// This field is ignored by the HTTP client.
   243  	TLS *tls.ConnectionState
   244  
   245  	// Cancel is an optional channel whose closure indicates that the client
   246  	// request should be regarded as canceled. Not all implementations of
   247  	// RoundTripper may support Cancel.
   248  	//
   249  	// For server requests, this field is not applicable.
   250  	Cancel <-chan struct{}
   251  }
   252  
   253  // ProtoAtLeast reports whether the HTTP protocol used
   254  // in the request is at least major.minor.
   255  func (r *Request) ProtoAtLeast(major, minor int) bool {
   256  	return r.ProtoMajor > major ||
   257  		r.ProtoMajor == major && r.ProtoMinor >= minor
   258  }
   259  
   260  // UserAgent returns the client's User-Agent, if sent in the request.
   261  func (r *Request) UserAgent() string {
   262  	return r.Header.Get("User-Agent")
   263  }
   264  
   265  // Cookies parses and returns the HTTP cookies sent with the request.
   266  func (r *Request) Cookies() []*Cookie {
   267  	return readCookies(r.Header, "")
   268  }
   269  
   270  // ErrNoCookie is returned by Request's Cookie method when a cookie is not found.
   271  var ErrNoCookie = errors.New("http: named cookie not present")
   272  
   273  // Cookie returns the named cookie provided in the request or
   274  // ErrNoCookie if not found.
   275  func (r *Request) Cookie(name string) (*Cookie, error) {
   276  	for _, c := range readCookies(r.Header, name) {
   277  		return c, nil
   278  	}
   279  	return nil, ErrNoCookie
   280  }
   281  
   282  // AddCookie adds a cookie to the request.  Per RFC 6265 section 5.4,
   283  // AddCookie does not attach more than one Cookie header field.  That
   284  // means all cookies, if any, are written into the same line,
   285  // separated by semicolon.
   286  func (r *Request) AddCookie(c *Cookie) {
   287  	s := fmt.Sprintf("%s=%s", sanitizeCookieName(c.Name), sanitizeCookieValue(c.Value))
   288  	if c := r.Header.Get("Cookie"); c != "" {
   289  		r.Header.Set("Cookie", c+"; "+s)
   290  	} else {
   291  		r.Header.Set("Cookie", s)
   292  	}
   293  }
   294  
   295  // Referer returns the referring URL, if sent in the request.
   296  //
   297  // Referer is misspelled as in the request itself, a mistake from the
   298  // earliest days of HTTP.  This value can also be fetched from the
   299  // Header map as Header["Referer"]; the benefit of making it available
   300  // as a method is that the compiler can diagnose programs that use the
   301  // alternate (correct English) spelling req.Referrer() but cannot
   302  // diagnose programs that use Header["Referrer"].
   303  func (r *Request) Referer() string {
   304  	return r.Header.Get("Referer")
   305  }
   306  
   307  // multipartByReader is a sentinel value.
   308  // Its presence in Request.MultipartForm indicates that parsing of the request
   309  // body has been handed off to a MultipartReader instead of ParseMultipartFrom.
   310  var multipartByReader = &multipart.Form{
   311  	Value: make(map[string][]string),
   312  	File:  make(map[string][]*multipart.FileHeader),
   313  }
   314  
   315  // MultipartReader returns a MIME multipart reader if this is a
   316  // multipart/form-data POST request, else returns nil and an error.
   317  // Use this function instead of ParseMultipartForm to
   318  // process the request body as a stream.
   319  func (r *Request) MultipartReader() (*multipart.Reader, error) {
   320  	if r.MultipartForm == multipartByReader {
   321  		return nil, errors.New("http: MultipartReader called twice")
   322  	}
   323  	if r.MultipartForm != nil {
   324  		return nil, errors.New("http: multipart handled by ParseMultipartForm")
   325  	}
   326  	r.MultipartForm = multipartByReader
   327  	return r.multipartReader()
   328  }
   329  
   330  func (r *Request) multipartReader() (*multipart.Reader, error) {
   331  	v := r.Header.Get("Content-Type")
   332  	if v == "" {
   333  		return nil, ErrNotMultipart
   334  	}
   335  	d, params, err := mime.ParseMediaType(v)
   336  	if err != nil || d != "multipart/form-data" {
   337  		return nil, ErrNotMultipart
   338  	}
   339  	boundary, ok := params["boundary"]
   340  	if !ok {
   341  		return nil, ErrMissingBoundary
   342  	}
   343  	return multipart.NewReader(r.Body, boundary), nil
   344  }
   345  
   346  // Return value if nonempty, def otherwise.
   347  func valueOrDefault(value, def string) string {
   348  	if value != "" {
   349  		return value
   350  	}
   351  	return def
   352  }
   353  
   354  // NOTE: This is not intended to reflect the actual Go version being used.
   355  // It was changed at the time of Go 1.1 release because the former User-Agent
   356  // had ended up on a blacklist for some intrusion detection systems.
   357  // See https://codereview.appspot.com/7532043.
   358  const defaultUserAgent = "Go-http-client/1.1"
   359  
   360  // Write writes an HTTP/1.1 request, which is the header and body, in wire format.
   361  // This method consults the following fields of the request:
   362  //	Host
   363  //	URL
   364  //	Method (defaults to "GET")
   365  //	Header
   366  //	ContentLength
   367  //	TransferEncoding
   368  //	Body
   369  //
   370  // If Body is present, Content-Length is <= 0 and TransferEncoding
   371  // hasn't been set to "identity", Write adds "Transfer-Encoding:
   372  // chunked" to the header. Body is closed after it is sent.
   373  func (r *Request) Write(w io.Writer) error {
   374  	return r.write(w, false, nil, nil)
   375  }
   376  
   377  // WriteProxy is like Write but writes the request in the form
   378  // expected by an HTTP proxy.  In particular, WriteProxy writes the
   379  // initial Request-URI line of the request with an absolute URI, per
   380  // section 5.1.2 of RFC 2616, including the scheme and host.
   381  // In either case, WriteProxy also writes a Host header, using
   382  // either r.Host or r.URL.Host.
   383  func (r *Request) WriteProxy(w io.Writer) error {
   384  	return r.write(w, true, nil, nil)
   385  }
   386  
   387  // errMissingHost is returned by Write when there is no Host or URL present in
   388  // the Request.
   389  var errMissingHost = errors.New("http: Request.Write on Request with no Host or URL set")
   390  
   391  // extraHeaders may be nil
   392  // waitForContinue may be nil
   393  func (req *Request) write(w io.Writer, usingProxy bool, extraHeaders Header, waitForContinue func() bool) error {
   394  	// Find the target host. Prefer the Host: header, but if that
   395  	// is not given, use the host from the request URL.
   396  	//
   397  	// Clean the host, in case it arrives with unexpected stuff in it.
   398  	host := cleanHost(req.Host)
   399  	if host == "" {
   400  		if req.URL == nil {
   401  			return errMissingHost
   402  		}
   403  		host = cleanHost(req.URL.Host)
   404  	}
   405  
   406  	// According to RFC 6874, an HTTP client, proxy, or other
   407  	// intermediary must remove any IPv6 zone identifier attached
   408  	// to an outgoing URI.
   409  	host = removeZone(host)
   410  
   411  	ruri := req.URL.RequestURI()
   412  	if usingProxy && req.URL.Scheme != "" && req.URL.Opaque == "" {
   413  		ruri = req.URL.Scheme + "://" + host + ruri
   414  	} else if req.Method == "CONNECT" && req.URL.Path == "" {
   415  		// CONNECT requests normally give just the host and port, not a full URL.
   416  		ruri = host
   417  	}
   418  	// TODO(bradfitz): escape at least newlines in ruri?
   419  
   420  	// Wrap the writer in a bufio Writer if it's not already buffered.
   421  	// Don't always call NewWriter, as that forces a bytes.Buffer
   422  	// and other small bufio Writers to have a minimum 4k buffer
   423  	// size.
   424  	var bw *bufio.Writer
   425  	if _, ok := w.(io.ByteWriter); !ok {
   426  		bw = bufio.NewWriter(w)
   427  		w = bw
   428  	}
   429  
   430  	_, err := fmt.Fprintf(w, "%s %s HTTP/1.1\r\n", valueOrDefault(req.Method, "GET"), ruri)
   431  	if err != nil {
   432  		return err
   433  	}
   434  
   435  	// Header lines
   436  	_, err = fmt.Fprintf(w, "Host: %s\r\n", host)
   437  	if err != nil {
   438  		return err
   439  	}
   440  
   441  	// Use the defaultUserAgent unless the Header contains one, which
   442  	// may be blank to not send the header.
   443  	userAgent := defaultUserAgent
   444  	if _, ok := req.Header["User-Agent"]; ok {
   445  		userAgent = req.Header.Get("User-Agent")
   446  	}
   447  	if userAgent != "" {
   448  		_, err = fmt.Fprintf(w, "User-Agent: %s\r\n", userAgent)
   449  		if err != nil {
   450  			return err
   451  		}
   452  	}
   453  
   454  	// Process Body,ContentLength,Close,Trailer
   455  	tw, err := newTransferWriter(req)
   456  	if err != nil {
   457  		return err
   458  	}
   459  	err = tw.WriteHeader(w)
   460  	if err != nil {
   461  		return err
   462  	}
   463  
   464  	err = req.Header.WriteSubset(w, reqWriteExcludeHeader)
   465  	if err != nil {
   466  		return err
   467  	}
   468  
   469  	if extraHeaders != nil {
   470  		err = extraHeaders.Write(w)
   471  		if err != nil {
   472  			return err
   473  		}
   474  	}
   475  
   476  	_, err = io.WriteString(w, "\r\n")
   477  	if err != nil {
   478  		return err
   479  	}
   480  
   481  	// Flush and wait for 100-continue if expected.
   482  	if waitForContinue != nil {
   483  		if bw, ok := w.(*bufio.Writer); ok {
   484  			err = bw.Flush()
   485  			if err != nil {
   486  				return err
   487  			}
   488  		}
   489  
   490  		if !waitForContinue() {
   491  			req.closeBody()
   492  			return nil
   493  		}
   494  	}
   495  
   496  	// Write body and trailer
   497  	err = tw.WriteBody(w)
   498  	if err != nil {
   499  		return err
   500  	}
   501  
   502  	if bw != nil {
   503  		return bw.Flush()
   504  	}
   505  	return nil
   506  }
   507  
   508  // cleanHost strips anything after '/' or ' '.
   509  // Ideally we'd clean the Host header according to the spec:
   510  //   https://tools.ietf.org/html/rfc7230#section-5.4 (Host = uri-host [ ":" port ]")
   511  //   https://tools.ietf.org/html/rfc7230#section-2.7 (uri-host -> rfc3986's host)
   512  //   https://tools.ietf.org/html/rfc3986#section-3.2.2 (definition of host)
   513  // But practically, what we are trying to avoid is the situation in
   514  // issue 11206, where a malformed Host header used in the proxy context
   515  // would create a bad request. So it is enough to just truncate at the
   516  // first offending character.
   517  func cleanHost(in string) string {
   518  	if i := strings.IndexAny(in, " /"); i != -1 {
   519  		return in[:i]
   520  	}
   521  	return in
   522  }
   523  
   524  // removeZone removes IPv6 zone identifer from host.
   525  // E.g., "[fe80::1%en0]:8080" to "[fe80::1]:8080"
   526  func removeZone(host string) string {
   527  	if !strings.HasPrefix(host, "[") {
   528  		return host
   529  	}
   530  	i := strings.LastIndex(host, "]")
   531  	if i < 0 {
   532  		return host
   533  	}
   534  	j := strings.LastIndex(host[:i], "%")
   535  	if j < 0 {
   536  		return host
   537  	}
   538  	return host[:j] + host[i:]
   539  }
   540  
   541  // ParseHTTPVersion parses a HTTP version string.
   542  // "HTTP/1.0" returns (1, 0, true).
   543  func ParseHTTPVersion(vers string) (major, minor int, ok bool) {
   544  	const Big = 1000000 // arbitrary upper bound
   545  	switch vers {
   546  	case "HTTP/1.1":
   547  		return 1, 1, true
   548  	case "HTTP/1.0":
   549  		return 1, 0, true
   550  	}
   551  	if !strings.HasPrefix(vers, "HTTP/") {
   552  		return 0, 0, false
   553  	}
   554  	dot := strings.Index(vers, ".")
   555  	if dot < 0 {
   556  		return 0, 0, false
   557  	}
   558  	major, err := strconv.Atoi(vers[5:dot])
   559  	if err != nil || major < 0 || major > Big {
   560  		return 0, 0, false
   561  	}
   562  	minor, err = strconv.Atoi(vers[dot+1:])
   563  	if err != nil || minor < 0 || minor > Big {
   564  		return 0, 0, false
   565  	}
   566  	return major, minor, true
   567  }
   568  
   569  func validMethod(method string) bool {
   570  	/*
   571  	     Method         = "OPTIONS"                ; Section 9.2
   572  	                    | "GET"                    ; Section 9.3
   573  	                    | "HEAD"                   ; Section 9.4
   574  	                    | "POST"                   ; Section 9.5
   575  	                    | "PUT"                    ; Section 9.6
   576  	                    | "DELETE"                 ; Section 9.7
   577  	                    | "TRACE"                  ; Section 9.8
   578  	                    | "CONNECT"                ; Section 9.9
   579  	                    | extension-method
   580  	   extension-method = token
   581  	     token          = 1*<any CHAR except CTLs or separators>
   582  	*/
   583  	return len(method) > 0 && strings.IndexFunc(method, isNotToken) == -1
   584  }
   585  
   586  // NewRequest returns a new Request given a method, URL, and optional body.
   587  //
   588  // If the provided body is also an io.Closer, the returned
   589  // Request.Body is set to body and will be closed by the Client
   590  // methods Do, Post, and PostForm, and Transport.RoundTrip.
   591  //
   592  // NewRequest returns a Request suitable for use with Client.Do or
   593  // Transport.RoundTrip.
   594  // To create a request for use with testing a Server Handler use either
   595  // ReadRequest or manually update the Request fields. See the Request
   596  // type's documentation for the difference between inbound and outbound
   597  // request fields.
   598  func NewRequest(method, urlStr string, body io.Reader) (*Request, error) {
   599  	if method == "" {
   600  		// We document that "" means "GET" for Request.Method, and people have
   601  		// relied on that from NewRequest, so keep that working.
   602  		// We still enforce validMethod for non-empty methods.
   603  		method = "GET"
   604  	}
   605  	if !validMethod(method) {
   606  		return nil, fmt.Errorf("net/http: invalid method %q", method)
   607  	}
   608  	u, err := url.Parse(urlStr)
   609  	if err != nil {
   610  		return nil, err
   611  	}
   612  	rc, ok := body.(io.ReadCloser)
   613  	if !ok && body != nil {
   614  		rc = ioutil.NopCloser(body)
   615  	}
   616  	req := &Request{
   617  		Method:     method,
   618  		URL:        u,
   619  		Proto:      "HTTP/1.1",
   620  		ProtoMajor: 1,
   621  		ProtoMinor: 1,
   622  		Header:     make(Header),
   623  		Body:       rc,
   624  		Host:       u.Host,
   625  	}
   626  	if body != nil {
   627  		switch v := body.(type) {
   628  		case *bytes.Buffer:
   629  			req.ContentLength = int64(v.Len())
   630  		case *bytes.Reader:
   631  			req.ContentLength = int64(v.Len())
   632  		case *strings.Reader:
   633  			req.ContentLength = int64(v.Len())
   634  		}
   635  	}
   636  
   637  	return req, nil
   638  }
   639  
   640  // BasicAuth returns the username and password provided in the request's
   641  // Authorization header, if the request uses HTTP Basic Authentication.
   642  // See RFC 2617, Section 2.
   643  func (r *Request) BasicAuth() (username, password string, ok bool) {
   644  	auth := r.Header.Get("Authorization")
   645  	if auth == "" {
   646  		return
   647  	}
   648  	return parseBasicAuth(auth)
   649  }
   650  
   651  // parseBasicAuth parses an HTTP Basic Authentication string.
   652  // "Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==" returns ("Aladdin", "open sesame", true).
   653  func parseBasicAuth(auth string) (username, password string, ok bool) {
   654  	const prefix = "Basic "
   655  	if !strings.HasPrefix(auth, prefix) {
   656  		return
   657  	}
   658  	c, err := base64.StdEncoding.DecodeString(auth[len(prefix):])
   659  	if err != nil {
   660  		return
   661  	}
   662  	cs := string(c)
   663  	s := strings.IndexByte(cs, ':')
   664  	if s < 0 {
   665  		return
   666  	}
   667  	return cs[:s], cs[s+1:], true
   668  }
   669  
   670  // SetBasicAuth sets the request's Authorization header to use HTTP
   671  // Basic Authentication with the provided username and password.
   672  //
   673  // With HTTP Basic Authentication the provided username and password
   674  // are not encrypted.
   675  func (r *Request) SetBasicAuth(username, password string) {
   676  	r.Header.Set("Authorization", "Basic "+basicAuth(username, password))
   677  }
   678  
   679  // parseRequestLine parses "GET /foo HTTP/1.1" into its three parts.
   680  func parseRequestLine(line string) (method, requestURI, proto string, ok bool) {
   681  	s1 := strings.Index(line, " ")
   682  	s2 := strings.Index(line[s1+1:], " ")
   683  	if s1 < 0 || s2 < 0 {
   684  		return
   685  	}
   686  	s2 += s1 + 1
   687  	return line[:s1], line[s1+1 : s2], line[s2+1:], true
   688  }
   689  
   690  var textprotoReaderPool sync.Pool
   691  
   692  func newTextprotoReader(br *bufio.Reader) *textproto.Reader {
   693  	if v := textprotoReaderPool.Get(); v != nil {
   694  		tr := v.(*textproto.Reader)
   695  		tr.R = br
   696  		return tr
   697  	}
   698  	return textproto.NewReader(br)
   699  }
   700  
   701  func putTextprotoReader(r *textproto.Reader) {
   702  	r.R = nil
   703  	textprotoReaderPool.Put(r)
   704  }
   705  
   706  // ReadRequest reads and parses an incoming request from b.
   707  func ReadRequest(b *bufio.Reader) (req *Request, err error) { return readRequest(b, deleteHostHeader) }
   708  
   709  // Constants for readRequest's deleteHostHeader parameter.
   710  const (
   711  	deleteHostHeader = true
   712  	keepHostHeader   = false
   713  )
   714  
   715  func readRequest(b *bufio.Reader, deleteHostHeader bool) (req *Request, err error) {
   716  	tp := newTextprotoReader(b)
   717  	req = new(Request)
   718  
   719  	// First line: GET /index.html HTTP/1.0
   720  	var s string
   721  	if s, err = tp.ReadLine(); err != nil {
   722  		return nil, err
   723  	}
   724  	defer func() {
   725  		putTextprotoReader(tp)
   726  		if err == io.EOF {
   727  			err = io.ErrUnexpectedEOF
   728  		}
   729  	}()
   730  
   731  	var ok bool
   732  	req.Method, req.RequestURI, req.Proto, ok = parseRequestLine(s)
   733  	if !ok {
   734  		return nil, &badStringError{"malformed HTTP request", s}
   735  	}
   736  	rawurl := req.RequestURI
   737  	if req.ProtoMajor, req.ProtoMinor, ok = ParseHTTPVersion(req.Proto); !ok {
   738  		return nil, &badStringError{"malformed HTTP version", req.Proto}
   739  	}
   740  
   741  	// CONNECT requests are used two different ways, and neither uses a full URL:
   742  	// The standard use is to tunnel HTTPS through an HTTP proxy.
   743  	// It looks like "CONNECT www.google.com:443 HTTP/1.1", and the parameter is
   744  	// just the authority section of a URL. This information should go in req.URL.Host.
   745  	//
   746  	// The net/rpc package also uses CONNECT, but there the parameter is a path
   747  	// that starts with a slash. It can be parsed with the regular URL parser,
   748  	// and the path will end up in req.URL.Path, where it needs to be in order for
   749  	// RPC to work.
   750  	justAuthority := req.Method == "CONNECT" && !strings.HasPrefix(rawurl, "/")
   751  	if justAuthority {
   752  		rawurl = "http://" + rawurl
   753  	}
   754  
   755  	if req.URL, err = url.ParseRequestURI(rawurl); err != nil {
   756  		return nil, err
   757  	}
   758  
   759  	if justAuthority {
   760  		// Strip the bogus "http://" back off.
   761  		req.URL.Scheme = ""
   762  	}
   763  
   764  	// Subsequent lines: Key: value.
   765  	mimeHeader, err := tp.ReadMIMEHeader()
   766  	if err != nil {
   767  		return nil, err
   768  	}
   769  	req.Header = Header(mimeHeader)
   770  
   771  	// RFC2616: Must treat
   772  	//	GET /index.html HTTP/1.1
   773  	//	Host: www.google.com
   774  	// and
   775  	//	GET http://www.google.com/index.html HTTP/1.1
   776  	//	Host: doesntmatter
   777  	// the same.  In the second case, any Host line is ignored.
   778  	req.Host = req.URL.Host
   779  	if req.Host == "" {
   780  		req.Host = req.Header.get("Host")
   781  	}
   782  	if deleteHostHeader {
   783  		delete(req.Header, "Host")
   784  	}
   785  
   786  	fixPragmaCacheControl(req.Header)
   787  
   788  	req.Close = shouldClose(req.ProtoMajor, req.ProtoMinor, req.Header, false)
   789  
   790  	err = readTransfer(req, b)
   791  	if err != nil {
   792  		return nil, err
   793  	}
   794  
   795  	return req, nil
   796  }
   797  
   798  // MaxBytesReader is similar to io.LimitReader but is intended for
   799  // limiting the size of incoming request bodies. In contrast to
   800  // io.LimitReader, MaxBytesReader's result is a ReadCloser, returns a
   801  // non-EOF error for a Read beyond the limit, and closes the
   802  // underlying reader when its Close method is called.
   803  //
   804  // MaxBytesReader prevents clients from accidentally or maliciously
   805  // sending a large request and wasting server resources.
   806  func MaxBytesReader(w ResponseWriter, r io.ReadCloser, n int64) io.ReadCloser {
   807  	return &maxBytesReader{w: w, r: r, n: n}
   808  }
   809  
   810  type maxBytesReader struct {
   811  	w       ResponseWriter
   812  	r       io.ReadCloser // underlying reader
   813  	n       int64         // max bytes remaining
   814  	stopped bool
   815  	sawEOF  bool
   816  }
   817  
   818  func (l *maxBytesReader) tooLarge() (n int, err error) {
   819  	if !l.stopped {
   820  		l.stopped = true
   821  		if res, ok := l.w.(*response); ok {
   822  			res.requestTooLarge()
   823  		}
   824  	}
   825  	return 0, errors.New("http: request body too large")
   826  }
   827  
   828  func (l *maxBytesReader) Read(p []byte) (n int, err error) {
   829  	toRead := l.n
   830  	if l.n == 0 {
   831  		if l.sawEOF {
   832  			return l.tooLarge()
   833  		}
   834  		// The underlying io.Reader may not return (0, io.EOF)
   835  		// at EOF if the requested size is 0, so read 1 byte
   836  		// instead. The io.Reader docs are a bit ambiguous
   837  		// about the return value of Read when 0 bytes are
   838  		// requested, and {bytes,strings}.Reader gets it wrong
   839  		// too (it returns (0, nil) even at EOF).
   840  		toRead = 1
   841  	}
   842  	if int64(len(p)) > toRead {
   843  		p = p[:toRead]
   844  	}
   845  	n, err = l.r.Read(p)
   846  	if err == io.EOF {
   847  		l.sawEOF = true
   848  	}
   849  	if l.n == 0 {
   850  		// If we had zero bytes to read remaining (but hadn't seen EOF)
   851  		// and we get a byte here, that means we went over our limit.
   852  		if n > 0 {
   853  			return l.tooLarge()
   854  		}
   855  		return 0, err
   856  	}
   857  	l.n -= int64(n)
   858  	if l.n < 0 {
   859  		l.n = 0
   860  	}
   861  	return
   862  }
   863  
   864  func (l *maxBytesReader) Close() error {
   865  	return l.r.Close()
   866  }
   867  
   868  func copyValues(dst, src url.Values) {
   869  	for k, vs := range src {
   870  		for _, value := range vs {
   871  			dst.Add(k, value)
   872  		}
   873  	}
   874  }
   875  
   876  func parsePostForm(r *Request) (vs url.Values, err error) {
   877  	if r.Body == nil {
   878  		err = errors.New("missing form body")
   879  		return
   880  	}
   881  	ct := r.Header.Get("Content-Type")
   882  	// RFC 2616, section 7.2.1 - empty type
   883  	//   SHOULD be treated as application/octet-stream
   884  	if ct == "" {
   885  		ct = "application/octet-stream"
   886  	}
   887  	ct, _, err = mime.ParseMediaType(ct)
   888  	switch {
   889  	case ct == "application/x-www-form-urlencoded":
   890  		var reader io.Reader = r.Body
   891  		maxFormSize := int64(1<<63 - 1)
   892  		if _, ok := r.Body.(*maxBytesReader); !ok {
   893  			maxFormSize = int64(10 << 20) // 10 MB is a lot of text.
   894  			reader = io.LimitReader(r.Body, maxFormSize+1)
   895  		}
   896  		b, e := ioutil.ReadAll(reader)
   897  		if e != nil {
   898  			if err == nil {
   899  				err = e
   900  			}
   901  			break
   902  		}
   903  		if int64(len(b)) > maxFormSize {
   904  			err = errors.New("http: POST too large")
   905  			return
   906  		}
   907  		vs, e = url.ParseQuery(string(b))
   908  		if err == nil {
   909  			err = e
   910  		}
   911  	case ct == "multipart/form-data":
   912  		// handled by ParseMultipartForm (which is calling us, or should be)
   913  		// TODO(bradfitz): there are too many possible
   914  		// orders to call too many functions here.
   915  		// Clean this up and write more tests.
   916  		// request_test.go contains the start of this,
   917  		// in TestParseMultipartFormOrder and others.
   918  	}
   919  	return
   920  }
   921  
   922  // ParseForm parses the raw query from the URL and updates r.Form.
   923  //
   924  // For POST or PUT requests, it also parses the request body as a form and
   925  // put the results into both r.PostForm and r.Form.
   926  // POST and PUT body parameters take precedence over URL query string values
   927  // in r.Form.
   928  //
   929  // If the request Body's size has not already been limited by MaxBytesReader,
   930  // the size is capped at 10MB.
   931  //
   932  // ParseMultipartForm calls ParseForm automatically.
   933  // It is idempotent.
   934  func (r *Request) ParseForm() error {
   935  	var err error
   936  	if r.PostForm == nil {
   937  		if r.Method == "POST" || r.Method == "PUT" || r.Method == "PATCH" {
   938  			r.PostForm, err = parsePostForm(r)
   939  		}
   940  		if r.PostForm == nil {
   941  			r.PostForm = make(url.Values)
   942  		}
   943  	}
   944  	if r.Form == nil {
   945  		if len(r.PostForm) > 0 {
   946  			r.Form = make(url.Values)
   947  			copyValues(r.Form, r.PostForm)
   948  		}
   949  		var newValues url.Values
   950  		if r.URL != nil {
   951  			var e error
   952  			newValues, e = url.ParseQuery(r.URL.RawQuery)
   953  			if err == nil {
   954  				err = e
   955  			}
   956  		}
   957  		if newValues == nil {
   958  			newValues = make(url.Values)
   959  		}
   960  		if r.Form == nil {
   961  			r.Form = newValues
   962  		} else {
   963  			copyValues(r.Form, newValues)
   964  		}
   965  	}
   966  	return err
   967  }
   968  
   969  // ParseMultipartForm parses a request body as multipart/form-data.
   970  // The whole request body is parsed and up to a total of maxMemory bytes of
   971  // its file parts are stored in memory, with the remainder stored on
   972  // disk in temporary files.
   973  // ParseMultipartForm calls ParseForm if necessary.
   974  // After one call to ParseMultipartForm, subsequent calls have no effect.
   975  func (r *Request) ParseMultipartForm(maxMemory int64) error {
   976  	if r.MultipartForm == multipartByReader {
   977  		return errors.New("http: multipart handled by MultipartReader")
   978  	}
   979  	if r.Form == nil {
   980  		err := r.ParseForm()
   981  		if err != nil {
   982  			return err
   983  		}
   984  	}
   985  	if r.MultipartForm != nil {
   986  		return nil
   987  	}
   988  
   989  	mr, err := r.multipartReader()
   990  	if err != nil {
   991  		return err
   992  	}
   993  
   994  	f, err := mr.ReadForm(maxMemory)
   995  	if err != nil {
   996  		return err
   997  	}
   998  	for k, v := range f.Value {
   999  		r.Form[k] = append(r.Form[k], v...)
  1000  	}
  1001  	r.MultipartForm = f
  1002  
  1003  	return nil
  1004  }
  1005  
  1006  // FormValue returns the first value for the named component of the query.
  1007  // POST and PUT body parameters take precedence over URL query string values.
  1008  // FormValue calls ParseMultipartForm and ParseForm if necessary and ignores
  1009  // any errors returned by these functions.
  1010  // If key is not present, FormValue returns the empty string.
  1011  // To access multiple values of the same key, call ParseForm and
  1012  // then inspect Request.Form directly.
  1013  func (r *Request) FormValue(key string) string {
  1014  	if r.Form == nil {
  1015  		r.ParseMultipartForm(defaultMaxMemory)
  1016  	}
  1017  	if vs := r.Form[key]; len(vs) > 0 {
  1018  		return vs[0]
  1019  	}
  1020  	return ""
  1021  }
  1022  
  1023  // PostFormValue returns the first value for the named component of the POST
  1024  // or PUT request body. URL query parameters are ignored.
  1025  // PostFormValue calls ParseMultipartForm and ParseForm if necessary and ignores
  1026  // any errors returned by these functions.
  1027  // If key is not present, PostFormValue returns the empty string.
  1028  func (r *Request) PostFormValue(key string) string {
  1029  	if r.PostForm == nil {
  1030  		r.ParseMultipartForm(defaultMaxMemory)
  1031  	}
  1032  	if vs := r.PostForm[key]; len(vs) > 0 {
  1033  		return vs[0]
  1034  	}
  1035  	return ""
  1036  }
  1037  
  1038  // FormFile returns the first file for the provided form key.
  1039  // FormFile calls ParseMultipartForm and ParseForm if necessary.
  1040  func (r *Request) FormFile(key string) (multipart.File, *multipart.FileHeader, error) {
  1041  	if r.MultipartForm == multipartByReader {
  1042  		return nil, nil, errors.New("http: multipart handled by MultipartReader")
  1043  	}
  1044  	if r.MultipartForm == nil {
  1045  		err := r.ParseMultipartForm(defaultMaxMemory)
  1046  		if err != nil {
  1047  			return nil, nil, err
  1048  		}
  1049  	}
  1050  	if r.MultipartForm != nil && r.MultipartForm.File != nil {
  1051  		if fhs := r.MultipartForm.File[key]; len(fhs) > 0 {
  1052  			f, err := fhs[0].Open()
  1053  			return f, fhs[0], err
  1054  		}
  1055  	}
  1056  	return nil, nil, ErrMissingFile
  1057  }
  1058  
  1059  func (r *Request) expectsContinue() bool {
  1060  	return hasToken(r.Header.get("Expect"), "100-continue")
  1061  }
  1062  
  1063  func (r *Request) wantsHttp10KeepAlive() bool {
  1064  	if r.ProtoMajor != 1 || r.ProtoMinor != 0 {
  1065  		return false
  1066  	}
  1067  	return hasToken(r.Header.get("Connection"), "keep-alive")
  1068  }
  1069  
  1070  func (r *Request) wantsClose() bool {
  1071  	return hasToken(r.Header.get("Connection"), "close")
  1072  }
  1073  
  1074  func (r *Request) closeBody() {
  1075  	if r.Body != nil {
  1076  		r.Body.Close()
  1077  	}
  1078  }
  1079  
  1080  func (r *Request) isReplayable() bool {
  1081  	if r.Body == nil {
  1082  		switch valueOrDefault(r.Method, "GET") {
  1083  		case "GET", "HEAD", "OPTIONS", "TRACE":
  1084  			return true
  1085  		}
  1086  	}
  1087  	return false
  1088  }
  1089  
  1090  func validHostHeader(h string) bool {
  1091  	// The latests spec is actually this:
  1092  	//
  1093  	// http://tools.ietf.org/html/rfc7230#section-5.4
  1094  	//     Host = uri-host [ ":" port ]
  1095  	//
  1096  	// Where uri-host is:
  1097  	//     http://tools.ietf.org/html/rfc3986#section-3.2.2
  1098  	//
  1099  	// But we're going to be much more lenient for now and just
  1100  	// search for any byte that's not a valid byte in any of those
  1101  	// expressions.
  1102  	for i := 0; i < len(h); i++ {
  1103  		if !validHostByte[h[i]] {
  1104  			return false
  1105  		}
  1106  	}
  1107  	return true
  1108  }
  1109  
  1110  // See the validHostHeader comment.
  1111  var validHostByte = [256]bool{
  1112  	'0': true, '1': true, '2': true, '3': true, '4': true, '5': true, '6': true, '7': true,
  1113  	'8': true, '9': true,
  1114  
  1115  	'a': true, 'b': true, 'c': true, 'd': true, 'e': true, 'f': true, 'g': true, 'h': true,
  1116  	'i': true, 'j': true, 'k': true, 'l': true, 'm': true, 'n': true, 'o': true, 'p': true,
  1117  	'q': true, 'r': true, 's': true, 't': true, 'u': true, 'v': true, 'w': true, 'x': true,
  1118  	'y': true, 'z': true,
  1119  
  1120  	'A': true, 'B': true, 'C': true, 'D': true, 'E': true, 'F': true, 'G': true, 'H': true,
  1121  	'I': true, 'J': true, 'K': true, 'L': true, 'M': true, 'N': true, 'O': true, 'P': true,
  1122  	'Q': true, 'R': true, 'S': true, 'T': true, 'U': true, 'V': true, 'W': true, 'X': true,
  1123  	'Y': true, 'Z': true,
  1124  
  1125  	'!':  true, // sub-delims
  1126  	'$':  true, // sub-delims
  1127  	'%':  true, // pct-encoded (and used in IPv6 zones)
  1128  	'&':  true, // sub-delims
  1129  	'(':  true, // sub-delims
  1130  	')':  true, // sub-delims
  1131  	'*':  true, // sub-delims
  1132  	'+':  true, // sub-delims
  1133  	',':  true, // sub-delims
  1134  	'-':  true, // unreserved
  1135  	'.':  true, // unreserved
  1136  	':':  true, // IPv6address + Host expression's optional port
  1137  	';':  true, // sub-delims
  1138  	'=':  true, // sub-delims
  1139  	'[':  true,
  1140  	'\'': true, // sub-delims
  1141  	']':  true,
  1142  	'_':  true, // unreserved
  1143  	'~':  true, // unreserved
  1144  }
  1145  
  1146  func validHeaderName(v string) bool {
  1147  	if len(v) == 0 {
  1148  		return false
  1149  	}
  1150  	return strings.IndexFunc(v, isNotToken) == -1
  1151  }
  1152  
  1153  // validHeaderValue reports whether v is a valid "field-value" according to
  1154  // http://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html#sec4.2 :
  1155  //
  1156  //        message-header = field-name ":" [ field-value ]
  1157  //        field-value    = *( field-content | LWS )
  1158  //        field-content  = <the OCTETs making up the field-value
  1159  //                         and consisting of either *TEXT or combinations
  1160  //                         of token, separators, and quoted-string>
  1161  //
  1162  // http://www.w3.org/Protocols/rfc2616/rfc2616-sec2.html#sec2.2 :
  1163  //
  1164  //        TEXT           = <any OCTET except CTLs,
  1165  //                          but including LWS>
  1166  //        LWS            = [CRLF] 1*( SP | HT )
  1167  //        CTL            = <any US-ASCII control character
  1168  //                         (octets 0 - 31) and DEL (127)>
  1169  func validHeaderValue(v string) bool {
  1170  	for i := 0; i < len(v); i++ {
  1171  		b := v[i]
  1172  		if isCTL(b) && !isLWS(b) {
  1173  			return false
  1174  		}
  1175  	}
  1176  	return true
  1177  }