github.com/aloncn/graphics-go@v0.0.1/src/net/http/request.go (about) 1 // Copyright 2009 The Go Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style 3 // license that can be found in the LICENSE file. 4 5 // HTTP Request reading and parsing. 6 7 package http 8 9 import ( 10 "bufio" 11 "bytes" 12 "crypto/tls" 13 "encoding/base64" 14 "errors" 15 "fmt" 16 "io" 17 "io/ioutil" 18 "mime" 19 "mime/multipart" 20 "net/textproto" 21 "net/url" 22 "strconv" 23 "strings" 24 "sync" 25 ) 26 27 const ( 28 defaultMaxMemory = 32 << 20 // 32 MB 29 ) 30 31 // ErrMissingFile is returned by FormFile when the provided file field name 32 // is either not present in the request or not a file field. 33 var ErrMissingFile = errors.New("http: no such file") 34 35 // HTTP request parsing errors. 36 type ProtocolError struct { 37 ErrorString string 38 } 39 40 func (err *ProtocolError) Error() string { return err.ErrorString } 41 42 var ( 43 ErrHeaderTooLong = &ProtocolError{"header too long"} 44 ErrShortBody = &ProtocolError{"entity body too short"} 45 ErrNotSupported = &ProtocolError{"feature not supported"} 46 ErrUnexpectedTrailer = &ProtocolError{"trailer header without chunked transfer encoding"} 47 ErrMissingContentLength = &ProtocolError{"missing ContentLength in HEAD response"} 48 ErrNotMultipart = &ProtocolError{"request Content-Type isn't multipart/form-data"} 49 ErrMissingBoundary = &ProtocolError{"no multipart boundary param in Content-Type"} 50 ) 51 52 type badStringError struct { 53 what string 54 str string 55 } 56 57 func (e *badStringError) Error() string { return fmt.Sprintf("%s %q", e.what, e.str) } 58 59 // Headers that Request.Write handles itself and should be skipped. 60 var reqWriteExcludeHeader = map[string]bool{ 61 "Host": true, // not in Header map anyway 62 "User-Agent": true, 63 "Content-Length": true, 64 "Transfer-Encoding": true, 65 "Trailer": true, 66 } 67 68 // A Request represents an HTTP request received by a server 69 // or to be sent by a client. 70 // 71 // The field semantics differ slightly between client and server 72 // usage. In addition to the notes on the fields below, see the 73 // documentation for Request.Write and RoundTripper. 74 type Request struct { 75 // Method specifies the HTTP method (GET, POST, PUT, etc.). 76 // For client requests an empty string means GET. 77 Method string 78 79 // URL specifies either the URI being requested (for server 80 // requests) or the URL to access (for client requests). 81 // 82 // For server requests the URL is parsed from the URI 83 // supplied on the Request-Line as stored in RequestURI. For 84 // most requests, fields other than Path and RawQuery will be 85 // empty. (See RFC 2616, Section 5.1.2) 86 // 87 // For client requests, the URL's Host specifies the server to 88 // connect to, while the Request's Host field optionally 89 // specifies the Host header value to send in the HTTP 90 // request. 91 URL *url.URL 92 93 // The protocol version for incoming server requests. 94 // 95 // For client requests these fields are ignored. The HTTP 96 // client code always uses either HTTP/1.1 or HTTP/2. 97 // See the docs on Transport for details. 98 Proto string // "HTTP/1.0" 99 ProtoMajor int // 1 100 ProtoMinor int // 0 101 102 // Header contains the request header fields either received 103 // by the server or to be sent by the client. 104 // 105 // If a server received a request with header lines, 106 // 107 // Host: example.com 108 // accept-encoding: gzip, deflate 109 // Accept-Language: en-us 110 // fOO: Bar 111 // foo: two 112 // 113 // then 114 // 115 // Header = map[string][]string{ 116 // "Accept-Encoding": {"gzip, deflate"}, 117 // "Accept-Language": {"en-us"}, 118 // "Foo": {"Bar", "two"}, 119 // } 120 // 121 // For incoming requests, the Host header is promoted to the 122 // Request.Host field and removed from the Header map. 123 // 124 // HTTP defines that header names are case-insensitive. The 125 // request parser implements this by using CanonicalHeaderKey, 126 // making the first character and any characters following a 127 // hyphen uppercase and the rest lowercase. 128 // 129 // For client requests, certain headers such as Content-Length 130 // and Connection are automatically written when needed and 131 // values in Header may be ignored. See the documentation 132 // for the Request.Write method. 133 Header Header 134 135 // Body is the request's body. 136 // 137 // For client requests a nil body means the request has no 138 // body, such as a GET request. The HTTP Client's Transport 139 // is responsible for calling the Close method. 140 // 141 // For server requests the Request Body is always non-nil 142 // but will return EOF immediately when no body is present. 143 // The Server will close the request body. The ServeHTTP 144 // Handler does not need to. 145 Body io.ReadCloser 146 147 // ContentLength records the length of the associated content. 148 // The value -1 indicates that the length is unknown. 149 // Values >= 0 indicate that the given number of bytes may 150 // be read from Body. 151 // For client requests, a value of 0 means unknown if Body is not nil. 152 ContentLength int64 153 154 // TransferEncoding lists the transfer encodings from outermost to 155 // innermost. An empty list denotes the "identity" encoding. 156 // TransferEncoding can usually be ignored; chunked encoding is 157 // automatically added and removed as necessary when sending and 158 // receiving requests. 159 TransferEncoding []string 160 161 // Close indicates whether to close the connection after 162 // replying to this request (for servers) or after sending this 163 // request and reading its response (for clients). 164 // 165 // For server requests, the HTTP server handles this automatically 166 // and this field is not needed by Handlers. 167 // 168 // For client requests, setting this field prevents re-use of 169 // TCP connections between requests to the same hosts, as if 170 // Transport.DisableKeepAlives were set. 171 Close bool 172 173 // For server requests Host specifies the host on which the 174 // URL is sought. Per RFC 2616, this is either the value of 175 // the "Host" header or the host name given in the URL itself. 176 // It may be of the form "host:port". 177 // 178 // For client requests Host optionally overrides the Host 179 // header to send. If empty, the Request.Write method uses 180 // the value of URL.Host. 181 Host string 182 183 // Form contains the parsed form data, including both the URL 184 // field's query parameters and the POST or PUT form data. 185 // This field is only available after ParseForm is called. 186 // The HTTP client ignores Form and uses Body instead. 187 Form url.Values 188 189 // PostForm contains the parsed form data from POST, PATCH, 190 // or PUT body parameters. 191 // 192 // This field is only available after ParseForm is called. 193 // The HTTP client ignores PostForm and uses Body instead. 194 PostForm url.Values 195 196 // MultipartForm is the parsed multipart form, including file uploads. 197 // This field is only available after ParseMultipartForm is called. 198 // The HTTP client ignores MultipartForm and uses Body instead. 199 MultipartForm *multipart.Form 200 201 // Trailer specifies additional headers that are sent after the request 202 // body. 203 // 204 // For server requests the Trailer map initially contains only the 205 // trailer keys, with nil values. (The client declares which trailers it 206 // will later send.) While the handler is reading from Body, it must 207 // not reference Trailer. After reading from Body returns EOF, Trailer 208 // can be read again and will contain non-nil values, if they were sent 209 // by the client. 210 // 211 // For client requests Trailer must be initialized to a map containing 212 // the trailer keys to later send. The values may be nil or their final 213 // values. The ContentLength must be 0 or -1, to send a chunked request. 214 // After the HTTP request is sent the map values can be updated while 215 // the request body is read. Once the body returns EOF, the caller must 216 // not mutate Trailer. 217 // 218 // Few HTTP clients, servers, or proxies support HTTP trailers. 219 Trailer Header 220 221 // RemoteAddr allows HTTP servers and other software to record 222 // the network address that sent the request, usually for 223 // logging. This field is not filled in by ReadRequest and 224 // has no defined format. The HTTP server in this package 225 // sets RemoteAddr to an "IP:port" address before invoking a 226 // handler. 227 // This field is ignored by the HTTP client. 228 RemoteAddr string 229 230 // RequestURI is the unmodified Request-URI of the 231 // Request-Line (RFC 2616, Section 5.1) as sent by the client 232 // to a server. Usually the URL field should be used instead. 233 // It is an error to set this field in an HTTP client request. 234 RequestURI string 235 236 // TLS allows HTTP servers and other software to record 237 // information about the TLS connection on which the request 238 // was received. This field is not filled in by ReadRequest. 239 // The HTTP server in this package sets the field for 240 // TLS-enabled connections before invoking a handler; 241 // otherwise it leaves the field nil. 242 // This field is ignored by the HTTP client. 243 TLS *tls.ConnectionState 244 245 // Cancel is an optional channel whose closure indicates that the client 246 // request should be regarded as canceled. Not all implementations of 247 // RoundTripper may support Cancel. 248 // 249 // For server requests, this field is not applicable. 250 Cancel <-chan struct{} 251 } 252 253 // ProtoAtLeast reports whether the HTTP protocol used 254 // in the request is at least major.minor. 255 func (r *Request) ProtoAtLeast(major, minor int) bool { 256 return r.ProtoMajor > major || 257 r.ProtoMajor == major && r.ProtoMinor >= minor 258 } 259 260 // UserAgent returns the client's User-Agent, if sent in the request. 261 func (r *Request) UserAgent() string { 262 return r.Header.Get("User-Agent") 263 } 264 265 // Cookies parses and returns the HTTP cookies sent with the request. 266 func (r *Request) Cookies() []*Cookie { 267 return readCookies(r.Header, "") 268 } 269 270 // ErrNoCookie is returned by Request's Cookie method when a cookie is not found. 271 var ErrNoCookie = errors.New("http: named cookie not present") 272 273 // Cookie returns the named cookie provided in the request or 274 // ErrNoCookie if not found. 275 func (r *Request) Cookie(name string) (*Cookie, error) { 276 for _, c := range readCookies(r.Header, name) { 277 return c, nil 278 } 279 return nil, ErrNoCookie 280 } 281 282 // AddCookie adds a cookie to the request. Per RFC 6265 section 5.4, 283 // AddCookie does not attach more than one Cookie header field. That 284 // means all cookies, if any, are written into the same line, 285 // separated by semicolon. 286 func (r *Request) AddCookie(c *Cookie) { 287 s := fmt.Sprintf("%s=%s", sanitizeCookieName(c.Name), sanitizeCookieValue(c.Value)) 288 if c := r.Header.Get("Cookie"); c != "" { 289 r.Header.Set("Cookie", c+"; "+s) 290 } else { 291 r.Header.Set("Cookie", s) 292 } 293 } 294 295 // Referer returns the referring URL, if sent in the request. 296 // 297 // Referer is misspelled as in the request itself, a mistake from the 298 // earliest days of HTTP. This value can also be fetched from the 299 // Header map as Header["Referer"]; the benefit of making it available 300 // as a method is that the compiler can diagnose programs that use the 301 // alternate (correct English) spelling req.Referrer() but cannot 302 // diagnose programs that use Header["Referrer"]. 303 func (r *Request) Referer() string { 304 return r.Header.Get("Referer") 305 } 306 307 // multipartByReader is a sentinel value. 308 // Its presence in Request.MultipartForm indicates that parsing of the request 309 // body has been handed off to a MultipartReader instead of ParseMultipartFrom. 310 var multipartByReader = &multipart.Form{ 311 Value: make(map[string][]string), 312 File: make(map[string][]*multipart.FileHeader), 313 } 314 315 // MultipartReader returns a MIME multipart reader if this is a 316 // multipart/form-data POST request, else returns nil and an error. 317 // Use this function instead of ParseMultipartForm to 318 // process the request body as a stream. 319 func (r *Request) MultipartReader() (*multipart.Reader, error) { 320 if r.MultipartForm == multipartByReader { 321 return nil, errors.New("http: MultipartReader called twice") 322 } 323 if r.MultipartForm != nil { 324 return nil, errors.New("http: multipart handled by ParseMultipartForm") 325 } 326 r.MultipartForm = multipartByReader 327 return r.multipartReader() 328 } 329 330 func (r *Request) multipartReader() (*multipart.Reader, error) { 331 v := r.Header.Get("Content-Type") 332 if v == "" { 333 return nil, ErrNotMultipart 334 } 335 d, params, err := mime.ParseMediaType(v) 336 if err != nil || d != "multipart/form-data" { 337 return nil, ErrNotMultipart 338 } 339 boundary, ok := params["boundary"] 340 if !ok { 341 return nil, ErrMissingBoundary 342 } 343 return multipart.NewReader(r.Body, boundary), nil 344 } 345 346 // Return value if nonempty, def otherwise. 347 func valueOrDefault(value, def string) string { 348 if value != "" { 349 return value 350 } 351 return def 352 } 353 354 // NOTE: This is not intended to reflect the actual Go version being used. 355 // It was changed at the time of Go 1.1 release because the former User-Agent 356 // had ended up on a blacklist for some intrusion detection systems. 357 // See https://codereview.appspot.com/7532043. 358 const defaultUserAgent = "Go-http-client/1.1" 359 360 // Write writes an HTTP/1.1 request, which is the header and body, in wire format. 361 // This method consults the following fields of the request: 362 // Host 363 // URL 364 // Method (defaults to "GET") 365 // Header 366 // ContentLength 367 // TransferEncoding 368 // Body 369 // 370 // If Body is present, Content-Length is <= 0 and TransferEncoding 371 // hasn't been set to "identity", Write adds "Transfer-Encoding: 372 // chunked" to the header. Body is closed after it is sent. 373 func (r *Request) Write(w io.Writer) error { 374 return r.write(w, false, nil, nil) 375 } 376 377 // WriteProxy is like Write but writes the request in the form 378 // expected by an HTTP proxy. In particular, WriteProxy writes the 379 // initial Request-URI line of the request with an absolute URI, per 380 // section 5.1.2 of RFC 2616, including the scheme and host. 381 // In either case, WriteProxy also writes a Host header, using 382 // either r.Host or r.URL.Host. 383 func (r *Request) WriteProxy(w io.Writer) error { 384 return r.write(w, true, nil, nil) 385 } 386 387 // errMissingHost is returned by Write when there is no Host or URL present in 388 // the Request. 389 var errMissingHost = errors.New("http: Request.Write on Request with no Host or URL set") 390 391 // extraHeaders may be nil 392 // waitForContinue may be nil 393 func (req *Request) write(w io.Writer, usingProxy bool, extraHeaders Header, waitForContinue func() bool) error { 394 // Find the target host. Prefer the Host: header, but if that 395 // is not given, use the host from the request URL. 396 // 397 // Clean the host, in case it arrives with unexpected stuff in it. 398 host := cleanHost(req.Host) 399 if host == "" { 400 if req.URL == nil { 401 return errMissingHost 402 } 403 host = cleanHost(req.URL.Host) 404 } 405 406 // According to RFC 6874, an HTTP client, proxy, or other 407 // intermediary must remove any IPv6 zone identifier attached 408 // to an outgoing URI. 409 host = removeZone(host) 410 411 ruri := req.URL.RequestURI() 412 if usingProxy && req.URL.Scheme != "" && req.URL.Opaque == "" { 413 ruri = req.URL.Scheme + "://" + host + ruri 414 } else if req.Method == "CONNECT" && req.URL.Path == "" { 415 // CONNECT requests normally give just the host and port, not a full URL. 416 ruri = host 417 } 418 // TODO(bradfitz): escape at least newlines in ruri? 419 420 // Wrap the writer in a bufio Writer if it's not already buffered. 421 // Don't always call NewWriter, as that forces a bytes.Buffer 422 // and other small bufio Writers to have a minimum 4k buffer 423 // size. 424 var bw *bufio.Writer 425 if _, ok := w.(io.ByteWriter); !ok { 426 bw = bufio.NewWriter(w) 427 w = bw 428 } 429 430 _, err := fmt.Fprintf(w, "%s %s HTTP/1.1\r\n", valueOrDefault(req.Method, "GET"), ruri) 431 if err != nil { 432 return err 433 } 434 435 // Header lines 436 _, err = fmt.Fprintf(w, "Host: %s\r\n", host) 437 if err != nil { 438 return err 439 } 440 441 // Use the defaultUserAgent unless the Header contains one, which 442 // may be blank to not send the header. 443 userAgent := defaultUserAgent 444 if _, ok := req.Header["User-Agent"]; ok { 445 userAgent = req.Header.Get("User-Agent") 446 } 447 if userAgent != "" { 448 _, err = fmt.Fprintf(w, "User-Agent: %s\r\n", userAgent) 449 if err != nil { 450 return err 451 } 452 } 453 454 // Process Body,ContentLength,Close,Trailer 455 tw, err := newTransferWriter(req) 456 if err != nil { 457 return err 458 } 459 err = tw.WriteHeader(w) 460 if err != nil { 461 return err 462 } 463 464 err = req.Header.WriteSubset(w, reqWriteExcludeHeader) 465 if err != nil { 466 return err 467 } 468 469 if extraHeaders != nil { 470 err = extraHeaders.Write(w) 471 if err != nil { 472 return err 473 } 474 } 475 476 _, err = io.WriteString(w, "\r\n") 477 if err != nil { 478 return err 479 } 480 481 // Flush and wait for 100-continue if expected. 482 if waitForContinue != nil { 483 if bw, ok := w.(*bufio.Writer); ok { 484 err = bw.Flush() 485 if err != nil { 486 return err 487 } 488 } 489 490 if !waitForContinue() { 491 req.closeBody() 492 return nil 493 } 494 } 495 496 // Write body and trailer 497 err = tw.WriteBody(w) 498 if err != nil { 499 return err 500 } 501 502 if bw != nil { 503 return bw.Flush() 504 } 505 return nil 506 } 507 508 // cleanHost strips anything after '/' or ' '. 509 // Ideally we'd clean the Host header according to the spec: 510 // https://tools.ietf.org/html/rfc7230#section-5.4 (Host = uri-host [ ":" port ]") 511 // https://tools.ietf.org/html/rfc7230#section-2.7 (uri-host -> rfc3986's host) 512 // https://tools.ietf.org/html/rfc3986#section-3.2.2 (definition of host) 513 // But practically, what we are trying to avoid is the situation in 514 // issue 11206, where a malformed Host header used in the proxy context 515 // would create a bad request. So it is enough to just truncate at the 516 // first offending character. 517 func cleanHost(in string) string { 518 if i := strings.IndexAny(in, " /"); i != -1 { 519 return in[:i] 520 } 521 return in 522 } 523 524 // removeZone removes IPv6 zone identifer from host. 525 // E.g., "[fe80::1%en0]:8080" to "[fe80::1]:8080" 526 func removeZone(host string) string { 527 if !strings.HasPrefix(host, "[") { 528 return host 529 } 530 i := strings.LastIndex(host, "]") 531 if i < 0 { 532 return host 533 } 534 j := strings.LastIndex(host[:i], "%") 535 if j < 0 { 536 return host 537 } 538 return host[:j] + host[i:] 539 } 540 541 // ParseHTTPVersion parses a HTTP version string. 542 // "HTTP/1.0" returns (1, 0, true). 543 func ParseHTTPVersion(vers string) (major, minor int, ok bool) { 544 const Big = 1000000 // arbitrary upper bound 545 switch vers { 546 case "HTTP/1.1": 547 return 1, 1, true 548 case "HTTP/1.0": 549 return 1, 0, true 550 } 551 if !strings.HasPrefix(vers, "HTTP/") { 552 return 0, 0, false 553 } 554 dot := strings.Index(vers, ".") 555 if dot < 0 { 556 return 0, 0, false 557 } 558 major, err := strconv.Atoi(vers[5:dot]) 559 if err != nil || major < 0 || major > Big { 560 return 0, 0, false 561 } 562 minor, err = strconv.Atoi(vers[dot+1:]) 563 if err != nil || minor < 0 || minor > Big { 564 return 0, 0, false 565 } 566 return major, minor, true 567 } 568 569 func validMethod(method string) bool { 570 /* 571 Method = "OPTIONS" ; Section 9.2 572 | "GET" ; Section 9.3 573 | "HEAD" ; Section 9.4 574 | "POST" ; Section 9.5 575 | "PUT" ; Section 9.6 576 | "DELETE" ; Section 9.7 577 | "TRACE" ; Section 9.8 578 | "CONNECT" ; Section 9.9 579 | extension-method 580 extension-method = token 581 token = 1*<any CHAR except CTLs or separators> 582 */ 583 return len(method) > 0 && strings.IndexFunc(method, isNotToken) == -1 584 } 585 586 // NewRequest returns a new Request given a method, URL, and optional body. 587 // 588 // If the provided body is also an io.Closer, the returned 589 // Request.Body is set to body and will be closed by the Client 590 // methods Do, Post, and PostForm, and Transport.RoundTrip. 591 // 592 // NewRequest returns a Request suitable for use with Client.Do or 593 // Transport.RoundTrip. 594 // To create a request for use with testing a Server Handler use either 595 // ReadRequest or manually update the Request fields. See the Request 596 // type's documentation for the difference between inbound and outbound 597 // request fields. 598 func NewRequest(method, urlStr string, body io.Reader) (*Request, error) { 599 if method == "" { 600 // We document that "" means "GET" for Request.Method, and people have 601 // relied on that from NewRequest, so keep that working. 602 // We still enforce validMethod for non-empty methods. 603 method = "GET" 604 } 605 if !validMethod(method) { 606 return nil, fmt.Errorf("net/http: invalid method %q", method) 607 } 608 u, err := url.Parse(urlStr) 609 if err != nil { 610 return nil, err 611 } 612 rc, ok := body.(io.ReadCloser) 613 if !ok && body != nil { 614 rc = ioutil.NopCloser(body) 615 } 616 req := &Request{ 617 Method: method, 618 URL: u, 619 Proto: "HTTP/1.1", 620 ProtoMajor: 1, 621 ProtoMinor: 1, 622 Header: make(Header), 623 Body: rc, 624 Host: u.Host, 625 } 626 if body != nil { 627 switch v := body.(type) { 628 case *bytes.Buffer: 629 req.ContentLength = int64(v.Len()) 630 case *bytes.Reader: 631 req.ContentLength = int64(v.Len()) 632 case *strings.Reader: 633 req.ContentLength = int64(v.Len()) 634 } 635 } 636 637 return req, nil 638 } 639 640 // BasicAuth returns the username and password provided in the request's 641 // Authorization header, if the request uses HTTP Basic Authentication. 642 // See RFC 2617, Section 2. 643 func (r *Request) BasicAuth() (username, password string, ok bool) { 644 auth := r.Header.Get("Authorization") 645 if auth == "" { 646 return 647 } 648 return parseBasicAuth(auth) 649 } 650 651 // parseBasicAuth parses an HTTP Basic Authentication string. 652 // "Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==" returns ("Aladdin", "open sesame", true). 653 func parseBasicAuth(auth string) (username, password string, ok bool) { 654 const prefix = "Basic " 655 if !strings.HasPrefix(auth, prefix) { 656 return 657 } 658 c, err := base64.StdEncoding.DecodeString(auth[len(prefix):]) 659 if err != nil { 660 return 661 } 662 cs := string(c) 663 s := strings.IndexByte(cs, ':') 664 if s < 0 { 665 return 666 } 667 return cs[:s], cs[s+1:], true 668 } 669 670 // SetBasicAuth sets the request's Authorization header to use HTTP 671 // Basic Authentication with the provided username and password. 672 // 673 // With HTTP Basic Authentication the provided username and password 674 // are not encrypted. 675 func (r *Request) SetBasicAuth(username, password string) { 676 r.Header.Set("Authorization", "Basic "+basicAuth(username, password)) 677 } 678 679 // parseRequestLine parses "GET /foo HTTP/1.1" into its three parts. 680 func parseRequestLine(line string) (method, requestURI, proto string, ok bool) { 681 s1 := strings.Index(line, " ") 682 s2 := strings.Index(line[s1+1:], " ") 683 if s1 < 0 || s2 < 0 { 684 return 685 } 686 s2 += s1 + 1 687 return line[:s1], line[s1+1 : s2], line[s2+1:], true 688 } 689 690 var textprotoReaderPool sync.Pool 691 692 func newTextprotoReader(br *bufio.Reader) *textproto.Reader { 693 if v := textprotoReaderPool.Get(); v != nil { 694 tr := v.(*textproto.Reader) 695 tr.R = br 696 return tr 697 } 698 return textproto.NewReader(br) 699 } 700 701 func putTextprotoReader(r *textproto.Reader) { 702 r.R = nil 703 textprotoReaderPool.Put(r) 704 } 705 706 // ReadRequest reads and parses an incoming request from b. 707 func ReadRequest(b *bufio.Reader) (req *Request, err error) { return readRequest(b, deleteHostHeader) } 708 709 // Constants for readRequest's deleteHostHeader parameter. 710 const ( 711 deleteHostHeader = true 712 keepHostHeader = false 713 ) 714 715 func readRequest(b *bufio.Reader, deleteHostHeader bool) (req *Request, err error) { 716 tp := newTextprotoReader(b) 717 req = new(Request) 718 719 // First line: GET /index.html HTTP/1.0 720 var s string 721 if s, err = tp.ReadLine(); err != nil { 722 return nil, err 723 } 724 defer func() { 725 putTextprotoReader(tp) 726 if err == io.EOF { 727 err = io.ErrUnexpectedEOF 728 } 729 }() 730 731 var ok bool 732 req.Method, req.RequestURI, req.Proto, ok = parseRequestLine(s) 733 if !ok { 734 return nil, &badStringError{"malformed HTTP request", s} 735 } 736 rawurl := req.RequestURI 737 if req.ProtoMajor, req.ProtoMinor, ok = ParseHTTPVersion(req.Proto); !ok { 738 return nil, &badStringError{"malformed HTTP version", req.Proto} 739 } 740 741 // CONNECT requests are used two different ways, and neither uses a full URL: 742 // The standard use is to tunnel HTTPS through an HTTP proxy. 743 // It looks like "CONNECT www.google.com:443 HTTP/1.1", and the parameter is 744 // just the authority section of a URL. This information should go in req.URL.Host. 745 // 746 // The net/rpc package also uses CONNECT, but there the parameter is a path 747 // that starts with a slash. It can be parsed with the regular URL parser, 748 // and the path will end up in req.URL.Path, where it needs to be in order for 749 // RPC to work. 750 justAuthority := req.Method == "CONNECT" && !strings.HasPrefix(rawurl, "/") 751 if justAuthority { 752 rawurl = "http://" + rawurl 753 } 754 755 if req.URL, err = url.ParseRequestURI(rawurl); err != nil { 756 return nil, err 757 } 758 759 if justAuthority { 760 // Strip the bogus "http://" back off. 761 req.URL.Scheme = "" 762 } 763 764 // Subsequent lines: Key: value. 765 mimeHeader, err := tp.ReadMIMEHeader() 766 if err != nil { 767 return nil, err 768 } 769 req.Header = Header(mimeHeader) 770 771 // RFC2616: Must treat 772 // GET /index.html HTTP/1.1 773 // Host: www.google.com 774 // and 775 // GET http://www.google.com/index.html HTTP/1.1 776 // Host: doesntmatter 777 // the same. In the second case, any Host line is ignored. 778 req.Host = req.URL.Host 779 if req.Host == "" { 780 req.Host = req.Header.get("Host") 781 } 782 if deleteHostHeader { 783 delete(req.Header, "Host") 784 } 785 786 fixPragmaCacheControl(req.Header) 787 788 req.Close = shouldClose(req.ProtoMajor, req.ProtoMinor, req.Header, false) 789 790 err = readTransfer(req, b) 791 if err != nil { 792 return nil, err 793 } 794 795 return req, nil 796 } 797 798 // MaxBytesReader is similar to io.LimitReader but is intended for 799 // limiting the size of incoming request bodies. In contrast to 800 // io.LimitReader, MaxBytesReader's result is a ReadCloser, returns a 801 // non-EOF error for a Read beyond the limit, and closes the 802 // underlying reader when its Close method is called. 803 // 804 // MaxBytesReader prevents clients from accidentally or maliciously 805 // sending a large request and wasting server resources. 806 func MaxBytesReader(w ResponseWriter, r io.ReadCloser, n int64) io.ReadCloser { 807 return &maxBytesReader{w: w, r: r, n: n} 808 } 809 810 type maxBytesReader struct { 811 w ResponseWriter 812 r io.ReadCloser // underlying reader 813 n int64 // max bytes remaining 814 stopped bool 815 sawEOF bool 816 } 817 818 func (l *maxBytesReader) tooLarge() (n int, err error) { 819 if !l.stopped { 820 l.stopped = true 821 if res, ok := l.w.(*response); ok { 822 res.requestTooLarge() 823 } 824 } 825 return 0, errors.New("http: request body too large") 826 } 827 828 func (l *maxBytesReader) Read(p []byte) (n int, err error) { 829 toRead := l.n 830 if l.n == 0 { 831 if l.sawEOF { 832 return l.tooLarge() 833 } 834 // The underlying io.Reader may not return (0, io.EOF) 835 // at EOF if the requested size is 0, so read 1 byte 836 // instead. The io.Reader docs are a bit ambiguous 837 // about the return value of Read when 0 bytes are 838 // requested, and {bytes,strings}.Reader gets it wrong 839 // too (it returns (0, nil) even at EOF). 840 toRead = 1 841 } 842 if int64(len(p)) > toRead { 843 p = p[:toRead] 844 } 845 n, err = l.r.Read(p) 846 if err == io.EOF { 847 l.sawEOF = true 848 } 849 if l.n == 0 { 850 // If we had zero bytes to read remaining (but hadn't seen EOF) 851 // and we get a byte here, that means we went over our limit. 852 if n > 0 { 853 return l.tooLarge() 854 } 855 return 0, err 856 } 857 l.n -= int64(n) 858 if l.n < 0 { 859 l.n = 0 860 } 861 return 862 } 863 864 func (l *maxBytesReader) Close() error { 865 return l.r.Close() 866 } 867 868 func copyValues(dst, src url.Values) { 869 for k, vs := range src { 870 for _, value := range vs { 871 dst.Add(k, value) 872 } 873 } 874 } 875 876 func parsePostForm(r *Request) (vs url.Values, err error) { 877 if r.Body == nil { 878 err = errors.New("missing form body") 879 return 880 } 881 ct := r.Header.Get("Content-Type") 882 // RFC 2616, section 7.2.1 - empty type 883 // SHOULD be treated as application/octet-stream 884 if ct == "" { 885 ct = "application/octet-stream" 886 } 887 ct, _, err = mime.ParseMediaType(ct) 888 switch { 889 case ct == "application/x-www-form-urlencoded": 890 var reader io.Reader = r.Body 891 maxFormSize := int64(1<<63 - 1) 892 if _, ok := r.Body.(*maxBytesReader); !ok { 893 maxFormSize = int64(10 << 20) // 10 MB is a lot of text. 894 reader = io.LimitReader(r.Body, maxFormSize+1) 895 } 896 b, e := ioutil.ReadAll(reader) 897 if e != nil { 898 if err == nil { 899 err = e 900 } 901 break 902 } 903 if int64(len(b)) > maxFormSize { 904 err = errors.New("http: POST too large") 905 return 906 } 907 vs, e = url.ParseQuery(string(b)) 908 if err == nil { 909 err = e 910 } 911 case ct == "multipart/form-data": 912 // handled by ParseMultipartForm (which is calling us, or should be) 913 // TODO(bradfitz): there are too many possible 914 // orders to call too many functions here. 915 // Clean this up and write more tests. 916 // request_test.go contains the start of this, 917 // in TestParseMultipartFormOrder and others. 918 } 919 return 920 } 921 922 // ParseForm parses the raw query from the URL and updates r.Form. 923 // 924 // For POST or PUT requests, it also parses the request body as a form and 925 // put the results into both r.PostForm and r.Form. 926 // POST and PUT body parameters take precedence over URL query string values 927 // in r.Form. 928 // 929 // If the request Body's size has not already been limited by MaxBytesReader, 930 // the size is capped at 10MB. 931 // 932 // ParseMultipartForm calls ParseForm automatically. 933 // It is idempotent. 934 func (r *Request) ParseForm() error { 935 var err error 936 if r.PostForm == nil { 937 if r.Method == "POST" || r.Method == "PUT" || r.Method == "PATCH" { 938 r.PostForm, err = parsePostForm(r) 939 } 940 if r.PostForm == nil { 941 r.PostForm = make(url.Values) 942 } 943 } 944 if r.Form == nil { 945 if len(r.PostForm) > 0 { 946 r.Form = make(url.Values) 947 copyValues(r.Form, r.PostForm) 948 } 949 var newValues url.Values 950 if r.URL != nil { 951 var e error 952 newValues, e = url.ParseQuery(r.URL.RawQuery) 953 if err == nil { 954 err = e 955 } 956 } 957 if newValues == nil { 958 newValues = make(url.Values) 959 } 960 if r.Form == nil { 961 r.Form = newValues 962 } else { 963 copyValues(r.Form, newValues) 964 } 965 } 966 return err 967 } 968 969 // ParseMultipartForm parses a request body as multipart/form-data. 970 // The whole request body is parsed and up to a total of maxMemory bytes of 971 // its file parts are stored in memory, with the remainder stored on 972 // disk in temporary files. 973 // ParseMultipartForm calls ParseForm if necessary. 974 // After one call to ParseMultipartForm, subsequent calls have no effect. 975 func (r *Request) ParseMultipartForm(maxMemory int64) error { 976 if r.MultipartForm == multipartByReader { 977 return errors.New("http: multipart handled by MultipartReader") 978 } 979 if r.Form == nil { 980 err := r.ParseForm() 981 if err != nil { 982 return err 983 } 984 } 985 if r.MultipartForm != nil { 986 return nil 987 } 988 989 mr, err := r.multipartReader() 990 if err != nil { 991 return err 992 } 993 994 f, err := mr.ReadForm(maxMemory) 995 if err != nil { 996 return err 997 } 998 for k, v := range f.Value { 999 r.Form[k] = append(r.Form[k], v...) 1000 } 1001 r.MultipartForm = f 1002 1003 return nil 1004 } 1005 1006 // FormValue returns the first value for the named component of the query. 1007 // POST and PUT body parameters take precedence over URL query string values. 1008 // FormValue calls ParseMultipartForm and ParseForm if necessary and ignores 1009 // any errors returned by these functions. 1010 // If key is not present, FormValue returns the empty string. 1011 // To access multiple values of the same key, call ParseForm and 1012 // then inspect Request.Form directly. 1013 func (r *Request) FormValue(key string) string { 1014 if r.Form == nil { 1015 r.ParseMultipartForm(defaultMaxMemory) 1016 } 1017 if vs := r.Form[key]; len(vs) > 0 { 1018 return vs[0] 1019 } 1020 return "" 1021 } 1022 1023 // PostFormValue returns the first value for the named component of the POST 1024 // or PUT request body. URL query parameters are ignored. 1025 // PostFormValue calls ParseMultipartForm and ParseForm if necessary and ignores 1026 // any errors returned by these functions. 1027 // If key is not present, PostFormValue returns the empty string. 1028 func (r *Request) PostFormValue(key string) string { 1029 if r.PostForm == nil { 1030 r.ParseMultipartForm(defaultMaxMemory) 1031 } 1032 if vs := r.PostForm[key]; len(vs) > 0 { 1033 return vs[0] 1034 } 1035 return "" 1036 } 1037 1038 // FormFile returns the first file for the provided form key. 1039 // FormFile calls ParseMultipartForm and ParseForm if necessary. 1040 func (r *Request) FormFile(key string) (multipart.File, *multipart.FileHeader, error) { 1041 if r.MultipartForm == multipartByReader { 1042 return nil, nil, errors.New("http: multipart handled by MultipartReader") 1043 } 1044 if r.MultipartForm == nil { 1045 err := r.ParseMultipartForm(defaultMaxMemory) 1046 if err != nil { 1047 return nil, nil, err 1048 } 1049 } 1050 if r.MultipartForm != nil && r.MultipartForm.File != nil { 1051 if fhs := r.MultipartForm.File[key]; len(fhs) > 0 { 1052 f, err := fhs[0].Open() 1053 return f, fhs[0], err 1054 } 1055 } 1056 return nil, nil, ErrMissingFile 1057 } 1058 1059 func (r *Request) expectsContinue() bool { 1060 return hasToken(r.Header.get("Expect"), "100-continue") 1061 } 1062 1063 func (r *Request) wantsHttp10KeepAlive() bool { 1064 if r.ProtoMajor != 1 || r.ProtoMinor != 0 { 1065 return false 1066 } 1067 return hasToken(r.Header.get("Connection"), "keep-alive") 1068 } 1069 1070 func (r *Request) wantsClose() bool { 1071 return hasToken(r.Header.get("Connection"), "close") 1072 } 1073 1074 func (r *Request) closeBody() { 1075 if r.Body != nil { 1076 r.Body.Close() 1077 } 1078 } 1079 1080 func (r *Request) isReplayable() bool { 1081 if r.Body == nil { 1082 switch valueOrDefault(r.Method, "GET") { 1083 case "GET", "HEAD", "OPTIONS", "TRACE": 1084 return true 1085 } 1086 } 1087 return false 1088 } 1089 1090 func validHostHeader(h string) bool { 1091 // The latests spec is actually this: 1092 // 1093 // http://tools.ietf.org/html/rfc7230#section-5.4 1094 // Host = uri-host [ ":" port ] 1095 // 1096 // Where uri-host is: 1097 // http://tools.ietf.org/html/rfc3986#section-3.2.2 1098 // 1099 // But we're going to be much more lenient for now and just 1100 // search for any byte that's not a valid byte in any of those 1101 // expressions. 1102 for i := 0; i < len(h); i++ { 1103 if !validHostByte[h[i]] { 1104 return false 1105 } 1106 } 1107 return true 1108 } 1109 1110 // See the validHostHeader comment. 1111 var validHostByte = [256]bool{ 1112 '0': true, '1': true, '2': true, '3': true, '4': true, '5': true, '6': true, '7': true, 1113 '8': true, '9': true, 1114 1115 'a': true, 'b': true, 'c': true, 'd': true, 'e': true, 'f': true, 'g': true, 'h': true, 1116 'i': true, 'j': true, 'k': true, 'l': true, 'm': true, 'n': true, 'o': true, 'p': true, 1117 'q': true, 'r': true, 's': true, 't': true, 'u': true, 'v': true, 'w': true, 'x': true, 1118 'y': true, 'z': true, 1119 1120 'A': true, 'B': true, 'C': true, 'D': true, 'E': true, 'F': true, 'G': true, 'H': true, 1121 'I': true, 'J': true, 'K': true, 'L': true, 'M': true, 'N': true, 'O': true, 'P': true, 1122 'Q': true, 'R': true, 'S': true, 'T': true, 'U': true, 'V': true, 'W': true, 'X': true, 1123 'Y': true, 'Z': true, 1124 1125 '!': true, // sub-delims 1126 '$': true, // sub-delims 1127 '%': true, // pct-encoded (and used in IPv6 zones) 1128 '&': true, // sub-delims 1129 '(': true, // sub-delims 1130 ')': true, // sub-delims 1131 '*': true, // sub-delims 1132 '+': true, // sub-delims 1133 ',': true, // sub-delims 1134 '-': true, // unreserved 1135 '.': true, // unreserved 1136 ':': true, // IPv6address + Host expression's optional port 1137 ';': true, // sub-delims 1138 '=': true, // sub-delims 1139 '[': true, 1140 '\'': true, // sub-delims 1141 ']': true, 1142 '_': true, // unreserved 1143 '~': true, // unreserved 1144 } 1145 1146 func validHeaderName(v string) bool { 1147 if len(v) == 0 { 1148 return false 1149 } 1150 return strings.IndexFunc(v, isNotToken) == -1 1151 } 1152 1153 // validHeaderValue reports whether v is a valid "field-value" according to 1154 // http://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html#sec4.2 : 1155 // 1156 // message-header = field-name ":" [ field-value ] 1157 // field-value = *( field-content | LWS ) 1158 // field-content = <the OCTETs making up the field-value 1159 // and consisting of either *TEXT or combinations 1160 // of token, separators, and quoted-string> 1161 // 1162 // http://www.w3.org/Protocols/rfc2616/rfc2616-sec2.html#sec2.2 : 1163 // 1164 // TEXT = <any OCTET except CTLs, 1165 // but including LWS> 1166 // LWS = [CRLF] 1*( SP | HT ) 1167 // CTL = <any US-ASCII control character 1168 // (octets 0 - 31) and DEL (127)> 1169 func validHeaderValue(v string) bool { 1170 for i := 0; i < len(v); i++ { 1171 b := v[i] 1172 if isCTL(b) && !isLWS(b) { 1173 return false 1174 } 1175 } 1176 return true 1177 }