github.com/rsc/go@v0.0.0-20150416155037-e040fd465409/src/net/http/request.go (about) 1 // Copyright 2009 The Go Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style 3 // license that can be found in the LICENSE file. 4 5 // HTTP Request reading and parsing. 6 7 package http 8 9 import ( 10 "bufio" 11 "bytes" 12 "crypto/tls" 13 "encoding/base64" 14 "errors" 15 "fmt" 16 "io" 17 "io/ioutil" 18 "mime" 19 "mime/multipart" 20 "net/textproto" 21 "net/url" 22 "strconv" 23 "strings" 24 "sync" 25 ) 26 27 const ( 28 defaultMaxMemory = 32 << 20 // 32 MB 29 ) 30 31 // ErrMissingFile is returned by FormFile when the provided file field name 32 // is either not present in the request or not a file field. 33 var ErrMissingFile = errors.New("http: no such file") 34 35 // HTTP request parsing errors. 36 type ProtocolError struct { 37 ErrorString string 38 } 39 40 func (err *ProtocolError) Error() string { return err.ErrorString } 41 42 var ( 43 ErrHeaderTooLong = &ProtocolError{"header too long"} 44 ErrShortBody = &ProtocolError{"entity body too short"} 45 ErrNotSupported = &ProtocolError{"feature not supported"} 46 ErrUnexpectedTrailer = &ProtocolError{"trailer header without chunked transfer encoding"} 47 ErrMissingContentLength = &ProtocolError{"missing ContentLength in HEAD response"} 48 ErrNotMultipart = &ProtocolError{"request Content-Type isn't multipart/form-data"} 49 ErrMissingBoundary = &ProtocolError{"no multipart boundary param in Content-Type"} 50 ) 51 52 type badStringError struct { 53 what string 54 str string 55 } 56 57 func (e *badStringError) Error() string { return fmt.Sprintf("%s %q", e.what, e.str) } 58 59 // Headers that Request.Write handles itself and should be skipped. 60 var reqWriteExcludeHeader = map[string]bool{ 61 "Host": true, // not in Header map anyway 62 "User-Agent": true, 63 "Content-Length": true, 64 "Transfer-Encoding": true, 65 "Trailer": true, 66 } 67 68 // A Request represents an HTTP request received by a server 69 // or to be sent by a client. 70 // 71 // The field semantics differ slightly between client and server 72 // usage. In addition to the notes on the fields below, see the 73 // documentation for Request.Write and RoundTripper. 74 type Request struct { 75 // Method specifies the HTTP method (GET, POST, PUT, etc.). 76 // For client requests an empty string means GET. 77 Method string 78 79 // URL specifies either the URI being requested (for server 80 // requests) or the URL to access (for client requests). 81 // 82 // For server requests the URL is parsed from the URI 83 // supplied on the Request-Line as stored in RequestURI. For 84 // most requests, fields other than Path and RawQuery will be 85 // empty. (See RFC 2616, Section 5.1.2) 86 // 87 // For client requests, the URL's Host specifies the server to 88 // connect to, while the Request's Host field optionally 89 // specifies the Host header value to send in the HTTP 90 // request. 91 URL *url.URL 92 93 // The protocol version for incoming requests. 94 // Client requests always use HTTP/1.1. 95 Proto string // "HTTP/1.0" 96 ProtoMajor int // 1 97 ProtoMinor int // 0 98 99 // A header maps request lines to their values. 100 // If the header says 101 // 102 // accept-encoding: gzip, deflate 103 // Accept-Language: en-us 104 // Connection: keep-alive 105 // 106 // then 107 // 108 // Header = map[string][]string{ 109 // "Accept-Encoding": {"gzip, deflate"}, 110 // "Accept-Language": {"en-us"}, 111 // "Connection": {"keep-alive"}, 112 // } 113 // 114 // HTTP defines that header names are case-insensitive. 115 // The request parser implements this by canonicalizing the 116 // name, making the first character and any characters 117 // following a hyphen uppercase and the rest lowercase. 118 // 119 // For client requests certain headers are automatically 120 // added and may override values in Header. 121 // 122 // See the documentation for the Request.Write method. 123 Header Header 124 125 // Body is the request's body. 126 // 127 // For client requests a nil body means the request has no 128 // body, such as a GET request. The HTTP Client's Transport 129 // is responsible for calling the Close method. 130 // 131 // For server requests the Request Body is always non-nil 132 // but will return EOF immediately when no body is present. 133 // The Server will close the request body. The ServeHTTP 134 // Handler does not need to. 135 Body io.ReadCloser 136 137 // ContentLength records the length of the associated content. 138 // The value -1 indicates that the length is unknown. 139 // Values >= 0 indicate that the given number of bytes may 140 // be read from Body. 141 // For client requests, a value of 0 means unknown if Body is not nil. 142 ContentLength int64 143 144 // TransferEncoding lists the transfer encodings from outermost to 145 // innermost. An empty list denotes the "identity" encoding. 146 // TransferEncoding can usually be ignored; chunked encoding is 147 // automatically added and removed as necessary when sending and 148 // receiving requests. 149 TransferEncoding []string 150 151 // Close indicates whether to close the connection after 152 // replying to this request (for servers) or after sending 153 // the request (for clients). 154 Close bool 155 156 // For server requests Host specifies the host on which the 157 // URL is sought. Per RFC 2616, this is either the value of 158 // the "Host" header or the host name given in the URL itself. 159 // It may be of the form "host:port". 160 // 161 // For client requests Host optionally overrides the Host 162 // header to send. If empty, the Request.Write method uses 163 // the value of URL.Host. 164 Host string 165 166 // Form contains the parsed form data, including both the URL 167 // field's query parameters and the POST or PUT form data. 168 // This field is only available after ParseForm is called. 169 // The HTTP client ignores Form and uses Body instead. 170 Form url.Values 171 172 // PostForm contains the parsed form data from POST or PUT 173 // body parameters. 174 // This field is only available after ParseForm is called. 175 // The HTTP client ignores PostForm and uses Body instead. 176 PostForm url.Values 177 178 // MultipartForm is the parsed multipart form, including file uploads. 179 // This field is only available after ParseMultipartForm is called. 180 // The HTTP client ignores MultipartForm and uses Body instead. 181 MultipartForm *multipart.Form 182 183 // Trailer specifies additional headers that are sent after the request 184 // body. 185 // 186 // For server requests the Trailer map initially contains only the 187 // trailer keys, with nil values. (The client declares which trailers it 188 // will later send.) While the handler is reading from Body, it must 189 // not reference Trailer. After reading from Body returns EOF, Trailer 190 // can be read again and will contain non-nil values, if they were sent 191 // by the client. 192 // 193 // For client requests Trailer must be initialized to a map containing 194 // the trailer keys to later send. The values may be nil or their final 195 // values. The ContentLength must be 0 or -1, to send a chunked request. 196 // After the HTTP request is sent the map values can be updated while 197 // the request body is read. Once the body returns EOF, the caller must 198 // not mutate Trailer. 199 // 200 // Few HTTP clients, servers, or proxies support HTTP trailers. 201 Trailer Header 202 203 // RemoteAddr allows HTTP servers and other software to record 204 // the network address that sent the request, usually for 205 // logging. This field is not filled in by ReadRequest and 206 // has no defined format. The HTTP server in this package 207 // sets RemoteAddr to an "IP:port" address before invoking a 208 // handler. 209 // This field is ignored by the HTTP client. 210 RemoteAddr string 211 212 // RequestURI is the unmodified Request-URI of the 213 // Request-Line (RFC 2616, Section 5.1) as sent by the client 214 // to a server. Usually the URL field should be used instead. 215 // It is an error to set this field in an HTTP client request. 216 RequestURI string 217 218 // TLS allows HTTP servers and other software to record 219 // information about the TLS connection on which the request 220 // was received. This field is not filled in by ReadRequest. 221 // The HTTP server in this package sets the field for 222 // TLS-enabled connections before invoking a handler; 223 // otherwise it leaves the field nil. 224 // This field is ignored by the HTTP client. 225 TLS *tls.ConnectionState 226 } 227 228 // ProtoAtLeast reports whether the HTTP protocol used 229 // in the request is at least major.minor. 230 func (r *Request) ProtoAtLeast(major, minor int) bool { 231 return r.ProtoMajor > major || 232 r.ProtoMajor == major && r.ProtoMinor >= minor 233 } 234 235 // UserAgent returns the client's User-Agent, if sent in the request. 236 func (r *Request) UserAgent() string { 237 return r.Header.Get("User-Agent") 238 } 239 240 // Cookies parses and returns the HTTP cookies sent with the request. 241 func (r *Request) Cookies() []*Cookie { 242 return readCookies(r.Header, "") 243 } 244 245 var ErrNoCookie = errors.New("http: named cookie not present") 246 247 // Cookie returns the named cookie provided in the request or 248 // ErrNoCookie if not found. 249 func (r *Request) Cookie(name string) (*Cookie, error) { 250 for _, c := range readCookies(r.Header, name) { 251 return c, nil 252 } 253 return nil, ErrNoCookie 254 } 255 256 // AddCookie adds a cookie to the request. Per RFC 6265 section 5.4, 257 // AddCookie does not attach more than one Cookie header field. That 258 // means all cookies, if any, are written into the same line, 259 // separated by semicolon. 260 func (r *Request) AddCookie(c *Cookie) { 261 s := fmt.Sprintf("%s=%s", sanitizeCookieName(c.Name), sanitizeCookieValue(c.Value)) 262 if c := r.Header.Get("Cookie"); c != "" { 263 r.Header.Set("Cookie", c+"; "+s) 264 } else { 265 r.Header.Set("Cookie", s) 266 } 267 } 268 269 // Referer returns the referring URL, if sent in the request. 270 // 271 // Referer is misspelled as in the request itself, a mistake from the 272 // earliest days of HTTP. This value can also be fetched from the 273 // Header map as Header["Referer"]; the benefit of making it available 274 // as a method is that the compiler can diagnose programs that use the 275 // alternate (correct English) spelling req.Referrer() but cannot 276 // diagnose programs that use Header["Referrer"]. 277 func (r *Request) Referer() string { 278 return r.Header.Get("Referer") 279 } 280 281 // multipartByReader is a sentinel value. 282 // Its presence in Request.MultipartForm indicates that parsing of the request 283 // body has been handed off to a MultipartReader instead of ParseMultipartFrom. 284 var multipartByReader = &multipart.Form{ 285 Value: make(map[string][]string), 286 File: make(map[string][]*multipart.FileHeader), 287 } 288 289 // MultipartReader returns a MIME multipart reader if this is a 290 // multipart/form-data POST request, else returns nil and an error. 291 // Use this function instead of ParseMultipartForm to 292 // process the request body as a stream. 293 func (r *Request) MultipartReader() (*multipart.Reader, error) { 294 if r.MultipartForm == multipartByReader { 295 return nil, errors.New("http: MultipartReader called twice") 296 } 297 if r.MultipartForm != nil { 298 return nil, errors.New("http: multipart handled by ParseMultipartForm") 299 } 300 r.MultipartForm = multipartByReader 301 return r.multipartReader() 302 } 303 304 func (r *Request) multipartReader() (*multipart.Reader, error) { 305 v := r.Header.Get("Content-Type") 306 if v == "" { 307 return nil, ErrNotMultipart 308 } 309 d, params, err := mime.ParseMediaType(v) 310 if err != nil || d != "multipart/form-data" { 311 return nil, ErrNotMultipart 312 } 313 boundary, ok := params["boundary"] 314 if !ok { 315 return nil, ErrMissingBoundary 316 } 317 return multipart.NewReader(r.Body, boundary), nil 318 } 319 320 // Return value if nonempty, def otherwise. 321 func valueOrDefault(value, def string) string { 322 if value != "" { 323 return value 324 } 325 return def 326 } 327 328 // NOTE: This is not intended to reflect the actual Go version being used. 329 // It was changed from "Go http package" to "Go 1.1 package http" at the 330 // time of the Go 1.1 release because the former User-Agent had ended up 331 // on a blacklist for some intrusion detection systems. 332 // See https://codereview.appspot.com/7532043. 333 const defaultUserAgent = "Go 1.1 package http" 334 335 // Write writes an HTTP/1.1 request -- header and body -- in wire format. 336 // This method consults the following fields of the request: 337 // Host 338 // URL 339 // Method (defaults to "GET") 340 // Header 341 // ContentLength 342 // TransferEncoding 343 // Body 344 // 345 // If Body is present, Content-Length is <= 0 and TransferEncoding 346 // hasn't been set to "identity", Write adds "Transfer-Encoding: 347 // chunked" to the header. Body is closed after it is sent. 348 func (r *Request) Write(w io.Writer) error { 349 return r.write(w, false, nil) 350 } 351 352 // WriteProxy is like Write but writes the request in the form 353 // expected by an HTTP proxy. In particular, WriteProxy writes the 354 // initial Request-URI line of the request with an absolute URI, per 355 // section 5.1.2 of RFC 2616, including the scheme and host. 356 // In either case, WriteProxy also writes a Host header, using 357 // either r.Host or r.URL.Host. 358 func (r *Request) WriteProxy(w io.Writer) error { 359 return r.write(w, true, nil) 360 } 361 362 // extraHeaders may be nil 363 func (req *Request) write(w io.Writer, usingProxy bool, extraHeaders Header) error { 364 // According to RFC 6874, an HTTP client, proxy, or other 365 // intermediary must remove any IPv6 zone identifier attached 366 // to an outgoing URI. 367 host := removeZone(req.Host) 368 if host == "" { 369 if req.URL == nil { 370 return errors.New("http: Request.Write on Request with no Host or URL set") 371 } 372 host = removeZone(req.URL.Host) 373 } 374 375 ruri := req.URL.RequestURI() 376 if usingProxy && req.URL.Scheme != "" && req.URL.Opaque == "" { 377 ruri = req.URL.Scheme + "://" + host + ruri 378 } else if req.Method == "CONNECT" && req.URL.Path == "" { 379 // CONNECT requests normally give just the host and port, not a full URL. 380 ruri = host 381 } 382 // TODO(bradfitz): escape at least newlines in ruri? 383 384 // Wrap the writer in a bufio Writer if it's not already buffered. 385 // Don't always call NewWriter, as that forces a bytes.Buffer 386 // and other small bufio Writers to have a minimum 4k buffer 387 // size. 388 var bw *bufio.Writer 389 if _, ok := w.(io.ByteWriter); !ok { 390 bw = bufio.NewWriter(w) 391 w = bw 392 } 393 394 _, err := fmt.Fprintf(w, "%s %s HTTP/1.1\r\n", valueOrDefault(req.Method, "GET"), ruri) 395 if err != nil { 396 return err 397 } 398 399 // Header lines 400 _, err = fmt.Fprintf(w, "Host: %s\r\n", host) 401 if err != nil { 402 return err 403 } 404 405 // Use the defaultUserAgent unless the Header contains one, which 406 // may be blank to not send the header. 407 userAgent := defaultUserAgent 408 if req.Header != nil { 409 if ua := req.Header["User-Agent"]; len(ua) > 0 { 410 userAgent = ua[0] 411 } 412 } 413 if userAgent != "" { 414 _, err = fmt.Fprintf(w, "User-Agent: %s\r\n", userAgent) 415 if err != nil { 416 return err 417 } 418 } 419 420 // Process Body,ContentLength,Close,Trailer 421 tw, err := newTransferWriter(req) 422 if err != nil { 423 return err 424 } 425 err = tw.WriteHeader(w) 426 if err != nil { 427 return err 428 } 429 430 err = req.Header.WriteSubset(w, reqWriteExcludeHeader) 431 if err != nil { 432 return err 433 } 434 435 if extraHeaders != nil { 436 err = extraHeaders.Write(w) 437 if err != nil { 438 return err 439 } 440 } 441 442 _, err = io.WriteString(w, "\r\n") 443 if err != nil { 444 return err 445 } 446 447 // Write body and trailer 448 err = tw.WriteBody(w) 449 if err != nil { 450 return err 451 } 452 453 if bw != nil { 454 return bw.Flush() 455 } 456 return nil 457 } 458 459 // removeZone removes IPv6 zone identifer from host. 460 // E.g., "[fe80::1%en0]:8080" to "[fe80::1]:8080" 461 func removeZone(host string) string { 462 if !strings.HasPrefix(host, "[") { 463 return host 464 } 465 i := strings.LastIndex(host, "]") 466 if i < 0 { 467 return host 468 } 469 j := strings.LastIndex(host[:i], "%") 470 if j < 0 { 471 return host 472 } 473 return host[:j] + host[i:] 474 } 475 476 // ParseHTTPVersion parses a HTTP version string. 477 // "HTTP/1.0" returns (1, 0, true). 478 func ParseHTTPVersion(vers string) (major, minor int, ok bool) { 479 const Big = 1000000 // arbitrary upper bound 480 switch vers { 481 case "HTTP/1.1": 482 return 1, 1, true 483 case "HTTP/1.0": 484 return 1, 0, true 485 } 486 if !strings.HasPrefix(vers, "HTTP/") { 487 return 0, 0, false 488 } 489 dot := strings.Index(vers, ".") 490 if dot < 0 { 491 return 0, 0, false 492 } 493 major, err := strconv.Atoi(vers[5:dot]) 494 if err != nil || major < 0 || major > Big { 495 return 0, 0, false 496 } 497 minor, err = strconv.Atoi(vers[dot+1:]) 498 if err != nil || minor < 0 || minor > Big { 499 return 0, 0, false 500 } 501 return major, minor, true 502 } 503 504 // NewRequest returns a new Request given a method, URL, and optional body. 505 // 506 // If the provided body is also an io.Closer, the returned 507 // Request.Body is set to body and will be closed by the Client 508 // methods Do, Post, and PostForm, and Transport.RoundTrip. 509 func NewRequest(method, urlStr string, body io.Reader) (*Request, error) { 510 u, err := url.Parse(urlStr) 511 if err != nil { 512 return nil, err 513 } 514 rc, ok := body.(io.ReadCloser) 515 if !ok && body != nil { 516 rc = ioutil.NopCloser(body) 517 } 518 req := &Request{ 519 Method: method, 520 URL: u, 521 Proto: "HTTP/1.1", 522 ProtoMajor: 1, 523 ProtoMinor: 1, 524 Header: make(Header), 525 Body: rc, 526 Host: u.Host, 527 } 528 if body != nil { 529 switch v := body.(type) { 530 case *bytes.Buffer: 531 req.ContentLength = int64(v.Len()) 532 case *bytes.Reader: 533 req.ContentLength = int64(v.Len()) 534 case *strings.Reader: 535 req.ContentLength = int64(v.Len()) 536 } 537 } 538 539 return req, nil 540 } 541 542 // BasicAuth returns the username and password provided in the request's 543 // Authorization header, if the request uses HTTP Basic Authentication. 544 // See RFC 2617, Section 2. 545 func (r *Request) BasicAuth() (username, password string, ok bool) { 546 auth := r.Header.Get("Authorization") 547 if auth == "" { 548 return 549 } 550 return parseBasicAuth(auth) 551 } 552 553 // parseBasicAuth parses an HTTP Basic Authentication string. 554 // "Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==" returns ("Aladdin", "open sesame", true). 555 func parseBasicAuth(auth string) (username, password string, ok bool) { 556 const prefix = "Basic " 557 if !strings.HasPrefix(auth, prefix) { 558 return 559 } 560 c, err := base64.StdEncoding.DecodeString(auth[len(prefix):]) 561 if err != nil { 562 return 563 } 564 cs := string(c) 565 s := strings.IndexByte(cs, ':') 566 if s < 0 { 567 return 568 } 569 return cs[:s], cs[s+1:], true 570 } 571 572 // SetBasicAuth sets the request's Authorization header to use HTTP 573 // Basic Authentication with the provided username and password. 574 // 575 // With HTTP Basic Authentication the provided username and password 576 // are not encrypted. 577 func (r *Request) SetBasicAuth(username, password string) { 578 r.Header.Set("Authorization", "Basic "+basicAuth(username, password)) 579 } 580 581 // parseRequestLine parses "GET /foo HTTP/1.1" into its three parts. 582 func parseRequestLine(line string) (method, requestURI, proto string, ok bool) { 583 s1 := strings.Index(line, " ") 584 s2 := strings.Index(line[s1+1:], " ") 585 if s1 < 0 || s2 < 0 { 586 return 587 } 588 s2 += s1 + 1 589 return line[:s1], line[s1+1 : s2], line[s2+1:], true 590 } 591 592 var textprotoReaderPool sync.Pool 593 594 func newTextprotoReader(br *bufio.Reader) *textproto.Reader { 595 if v := textprotoReaderPool.Get(); v != nil { 596 tr := v.(*textproto.Reader) 597 tr.R = br 598 return tr 599 } 600 return textproto.NewReader(br) 601 } 602 603 func putTextprotoReader(r *textproto.Reader) { 604 r.R = nil 605 textprotoReaderPool.Put(r) 606 } 607 608 // ReadRequest reads and parses a request from b. 609 func ReadRequest(b *bufio.Reader) (req *Request, err error) { 610 611 tp := newTextprotoReader(b) 612 req = new(Request) 613 614 // First line: GET /index.html HTTP/1.0 615 var s string 616 if s, err = tp.ReadLine(); err != nil { 617 return nil, err 618 } 619 defer func() { 620 putTextprotoReader(tp) 621 if err == io.EOF { 622 err = io.ErrUnexpectedEOF 623 } 624 }() 625 626 var ok bool 627 req.Method, req.RequestURI, req.Proto, ok = parseRequestLine(s) 628 if !ok { 629 return nil, &badStringError{"malformed HTTP request", s} 630 } 631 rawurl := req.RequestURI 632 if req.ProtoMajor, req.ProtoMinor, ok = ParseHTTPVersion(req.Proto); !ok { 633 return nil, &badStringError{"malformed HTTP version", req.Proto} 634 } 635 636 // CONNECT requests are used two different ways, and neither uses a full URL: 637 // The standard use is to tunnel HTTPS through an HTTP proxy. 638 // It looks like "CONNECT www.google.com:443 HTTP/1.1", and the parameter is 639 // just the authority section of a URL. This information should go in req.URL.Host. 640 // 641 // The net/rpc package also uses CONNECT, but there the parameter is a path 642 // that starts with a slash. It can be parsed with the regular URL parser, 643 // and the path will end up in req.URL.Path, where it needs to be in order for 644 // RPC to work. 645 justAuthority := req.Method == "CONNECT" && !strings.HasPrefix(rawurl, "/") 646 if justAuthority { 647 rawurl = "http://" + rawurl 648 } 649 650 if req.URL, err = url.ParseRequestURI(rawurl); err != nil { 651 return nil, err 652 } 653 654 if justAuthority { 655 // Strip the bogus "http://" back off. 656 req.URL.Scheme = "" 657 } 658 659 // Subsequent lines: Key: value. 660 mimeHeader, err := tp.ReadMIMEHeader() 661 if err != nil { 662 return nil, err 663 } 664 req.Header = Header(mimeHeader) 665 666 // RFC2616: Must treat 667 // GET /index.html HTTP/1.1 668 // Host: www.google.com 669 // and 670 // GET http://www.google.com/index.html HTTP/1.1 671 // Host: doesntmatter 672 // the same. In the second case, any Host line is ignored. 673 req.Host = req.URL.Host 674 if req.Host == "" { 675 req.Host = req.Header.get("Host") 676 } 677 delete(req.Header, "Host") 678 679 fixPragmaCacheControl(req.Header) 680 681 err = readTransfer(req, b) 682 if err != nil { 683 return nil, err 684 } 685 686 req.Close = shouldClose(req.ProtoMajor, req.ProtoMinor, req.Header, false) 687 return req, nil 688 } 689 690 // MaxBytesReader is similar to io.LimitReader but is intended for 691 // limiting the size of incoming request bodies. In contrast to 692 // io.LimitReader, MaxBytesReader's result is a ReadCloser, returns a 693 // non-EOF error for a Read beyond the limit, and closes the 694 // underlying reader when its Close method is called. 695 // 696 // MaxBytesReader prevents clients from accidentally or maliciously 697 // sending a large request and wasting server resources. 698 func MaxBytesReader(w ResponseWriter, r io.ReadCloser, n int64) io.ReadCloser { 699 return &maxBytesReader{w: w, r: r, n: n} 700 } 701 702 type maxBytesReader struct { 703 w ResponseWriter 704 r io.ReadCloser // underlying reader 705 n int64 // max bytes remaining 706 stopped bool 707 } 708 709 func (l *maxBytesReader) Read(p []byte) (n int, err error) { 710 if l.n <= 0 { 711 if !l.stopped { 712 l.stopped = true 713 if res, ok := l.w.(*response); ok { 714 res.requestTooLarge() 715 } 716 } 717 return 0, errors.New("http: request body too large") 718 } 719 if int64(len(p)) > l.n { 720 p = p[:l.n] 721 } 722 n, err = l.r.Read(p) 723 l.n -= int64(n) 724 return 725 } 726 727 func (l *maxBytesReader) Close() error { 728 return l.r.Close() 729 } 730 731 func copyValues(dst, src url.Values) { 732 for k, vs := range src { 733 for _, value := range vs { 734 dst.Add(k, value) 735 } 736 } 737 } 738 739 func parsePostForm(r *Request) (vs url.Values, err error) { 740 if r.Body == nil { 741 err = errors.New("missing form body") 742 return 743 } 744 ct := r.Header.Get("Content-Type") 745 // RFC 2616, section 7.2.1 - empty type 746 // SHOULD be treated as application/octet-stream 747 if ct == "" { 748 ct = "application/octet-stream" 749 } 750 ct, _, err = mime.ParseMediaType(ct) 751 switch { 752 case ct == "application/x-www-form-urlencoded": 753 var reader io.Reader = r.Body 754 maxFormSize := int64(1<<63 - 1) 755 if _, ok := r.Body.(*maxBytesReader); !ok { 756 maxFormSize = int64(10 << 20) // 10 MB is a lot of text. 757 reader = io.LimitReader(r.Body, maxFormSize+1) 758 } 759 b, e := ioutil.ReadAll(reader) 760 if e != nil { 761 if err == nil { 762 err = e 763 } 764 break 765 } 766 if int64(len(b)) > maxFormSize { 767 err = errors.New("http: POST too large") 768 return 769 } 770 vs, e = url.ParseQuery(string(b)) 771 if err == nil { 772 err = e 773 } 774 case ct == "multipart/form-data": 775 // handled by ParseMultipartForm (which is calling us, or should be) 776 // TODO(bradfitz): there are too many possible 777 // orders to call too many functions here. 778 // Clean this up and write more tests. 779 // request_test.go contains the start of this, 780 // in TestParseMultipartFormOrder and others. 781 } 782 return 783 } 784 785 // ParseForm parses the raw query from the URL and updates r.Form. 786 // 787 // For POST or PUT requests, it also parses the request body as a form and 788 // put the results into both r.PostForm and r.Form. 789 // POST and PUT body parameters take precedence over URL query string values 790 // in r.Form. 791 // 792 // If the request Body's size has not already been limited by MaxBytesReader, 793 // the size is capped at 10MB. 794 // 795 // ParseMultipartForm calls ParseForm automatically. 796 // It is idempotent. 797 func (r *Request) ParseForm() error { 798 var err error 799 if r.PostForm == nil { 800 if r.Method == "POST" || r.Method == "PUT" || r.Method == "PATCH" { 801 r.PostForm, err = parsePostForm(r) 802 } 803 if r.PostForm == nil { 804 r.PostForm = make(url.Values) 805 } 806 } 807 if r.Form == nil { 808 if len(r.PostForm) > 0 { 809 r.Form = make(url.Values) 810 copyValues(r.Form, r.PostForm) 811 } 812 var newValues url.Values 813 if r.URL != nil { 814 var e error 815 newValues, e = url.ParseQuery(r.URL.RawQuery) 816 if err == nil { 817 err = e 818 } 819 } 820 if newValues == nil { 821 newValues = make(url.Values) 822 } 823 if r.Form == nil { 824 r.Form = newValues 825 } else { 826 copyValues(r.Form, newValues) 827 } 828 } 829 return err 830 } 831 832 // ParseMultipartForm parses a request body as multipart/form-data. 833 // The whole request body is parsed and up to a total of maxMemory bytes of 834 // its file parts are stored in memory, with the remainder stored on 835 // disk in temporary files. 836 // ParseMultipartForm calls ParseForm if necessary. 837 // After one call to ParseMultipartForm, subsequent calls have no effect. 838 func (r *Request) ParseMultipartForm(maxMemory int64) error { 839 if r.MultipartForm == multipartByReader { 840 return errors.New("http: multipart handled by MultipartReader") 841 } 842 if r.Form == nil { 843 err := r.ParseForm() 844 if err != nil { 845 return err 846 } 847 } 848 if r.MultipartForm != nil { 849 return nil 850 } 851 852 mr, err := r.multipartReader() 853 if err != nil { 854 return err 855 } 856 857 f, err := mr.ReadForm(maxMemory) 858 if err != nil { 859 return err 860 } 861 for k, v := range f.Value { 862 r.Form[k] = append(r.Form[k], v...) 863 } 864 r.MultipartForm = f 865 866 return nil 867 } 868 869 // FormValue returns the first value for the named component of the query. 870 // POST and PUT body parameters take precedence over URL query string values. 871 // FormValue calls ParseMultipartForm and ParseForm if necessary and ignores 872 // any errors returned by these functions. 873 // To access multiple values of the same key, call ParseForm and 874 // then inspect Request.Form directly. 875 func (r *Request) FormValue(key string) string { 876 if r.Form == nil { 877 r.ParseMultipartForm(defaultMaxMemory) 878 } 879 if vs := r.Form[key]; len(vs) > 0 { 880 return vs[0] 881 } 882 return "" 883 } 884 885 // PostFormValue returns the first value for the named component of the POST 886 // or PUT request body. URL query parameters are ignored. 887 // PostFormValue calls ParseMultipartForm and ParseForm if necessary and ignores 888 // any errors returned by these functions. 889 func (r *Request) PostFormValue(key string) string { 890 if r.PostForm == nil { 891 r.ParseMultipartForm(defaultMaxMemory) 892 } 893 if vs := r.PostForm[key]; len(vs) > 0 { 894 return vs[0] 895 } 896 return "" 897 } 898 899 // FormFile returns the first file for the provided form key. 900 // FormFile calls ParseMultipartForm and ParseForm if necessary. 901 func (r *Request) FormFile(key string) (multipart.File, *multipart.FileHeader, error) { 902 if r.MultipartForm == multipartByReader { 903 return nil, nil, errors.New("http: multipart handled by MultipartReader") 904 } 905 if r.MultipartForm == nil { 906 err := r.ParseMultipartForm(defaultMaxMemory) 907 if err != nil { 908 return nil, nil, err 909 } 910 } 911 if r.MultipartForm != nil && r.MultipartForm.File != nil { 912 if fhs := r.MultipartForm.File[key]; len(fhs) > 0 { 913 f, err := fhs[0].Open() 914 return f, fhs[0], err 915 } 916 } 917 return nil, nil, ErrMissingFile 918 } 919 920 func (r *Request) expectsContinue() bool { 921 return hasToken(r.Header.get("Expect"), "100-continue") 922 } 923 924 func (r *Request) wantsHttp10KeepAlive() bool { 925 if r.ProtoMajor != 1 || r.ProtoMinor != 0 { 926 return false 927 } 928 return hasToken(r.Header.get("Connection"), "keep-alive") 929 } 930 931 func (r *Request) wantsClose() bool { 932 return hasToken(r.Header.get("Connection"), "close") 933 } 934 935 func (r *Request) closeBody() { 936 if r.Body != nil { 937 r.Body.Close() 938 } 939 }