github.com/sanprasirt/go@v0.0.0-20170607001320-a027466e4b6d/src/net/http/request.go (about) 1 // Copyright 2009 The Go Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style 3 // license that can be found in the LICENSE file. 4 5 // HTTP Request reading and parsing. 6 7 package http 8 9 import ( 10 "bufio" 11 "bytes" 12 "context" 13 "crypto/tls" 14 "encoding/base64" 15 "errors" 16 "fmt" 17 "io" 18 "io/ioutil" 19 "mime" 20 "mime/multipart" 21 "net" 22 "net/http/httptrace" 23 "net/textproto" 24 "net/url" 25 "strconv" 26 "strings" 27 "sync" 28 29 "golang_org/x/net/idna" 30 ) 31 32 const ( 33 defaultMaxMemory = 32 << 20 // 32 MB 34 ) 35 36 // ErrMissingFile is returned by FormFile when the provided file field name 37 // is either not present in the request or not a file field. 38 var ErrMissingFile = errors.New("http: no such file") 39 40 // ProtocolError represents an HTTP protocol error. 41 // 42 // Deprecated: Not all errors in the http package related to protocol errors 43 // are of type ProtocolError. 44 type ProtocolError struct { 45 ErrorString string 46 } 47 48 func (pe *ProtocolError) Error() string { return pe.ErrorString } 49 50 var ( 51 // ErrNotSupported is returned by the Push method of Pusher 52 // implementations to indicate that HTTP/2 Push support is not 53 // available. 54 ErrNotSupported = &ProtocolError{"feature not supported"} 55 56 // ErrUnexpectedTrailer is returned by the Transport when a server 57 // replies with a Trailer header, but without a chunked reply. 58 ErrUnexpectedTrailer = &ProtocolError{"trailer header without chunked transfer encoding"} 59 60 // ErrMissingBoundary is returned by Request.MultipartReader when the 61 // request's Content-Type does not include a "boundary" parameter. 62 ErrMissingBoundary = &ProtocolError{"no multipart boundary param in Content-Type"} 63 64 // ErrNotMultipart is returned by Request.MultipartReader when the 65 // request's Content-Type is not multipart/form-data. 66 ErrNotMultipart = &ProtocolError{"request Content-Type isn't multipart/form-data"} 67 68 // Deprecated: ErrHeaderTooLong is not used. 69 ErrHeaderTooLong = &ProtocolError{"header too long"} 70 // Deprecated: ErrShortBody is not used. 71 ErrShortBody = &ProtocolError{"entity body too short"} 72 // Deprecated: ErrMissingContentLength is not used. 73 ErrMissingContentLength = &ProtocolError{"missing ContentLength in HEAD response"} 74 ) 75 76 type badStringError struct { 77 what string 78 str string 79 } 80 81 func (e *badStringError) Error() string { return fmt.Sprintf("%s %q", e.what, e.str) } 82 83 // Headers that Request.Write handles itself and should be skipped. 84 var reqWriteExcludeHeader = map[string]bool{ 85 "Host": true, // not in Header map anyway 86 "User-Agent": true, 87 "Content-Length": true, 88 "Transfer-Encoding": true, 89 "Trailer": true, 90 } 91 92 // A Request represents an HTTP request received by a server 93 // or to be sent by a client. 94 // 95 // The field semantics differ slightly between client and server 96 // usage. In addition to the notes on the fields below, see the 97 // documentation for Request.Write and RoundTripper. 98 type Request struct { 99 // Method specifies the HTTP method (GET, POST, PUT, etc.). 100 // For client requests an empty string means GET. 101 Method string 102 103 // URL specifies either the URI being requested (for server 104 // requests) or the URL to access (for client requests). 105 // 106 // For server requests the URL is parsed from the URI 107 // supplied on the Request-Line as stored in RequestURI. For 108 // most requests, fields other than Path and RawQuery will be 109 // empty. (See RFC 2616, Section 5.1.2) 110 // 111 // For client requests, the URL's Host specifies the server to 112 // connect to, while the Request's Host field optionally 113 // specifies the Host header value to send in the HTTP 114 // request. 115 URL *url.URL 116 117 // The protocol version for incoming server requests. 118 // 119 // For client requests these fields are ignored. The HTTP 120 // client code always uses either HTTP/1.1 or HTTP/2. 121 // See the docs on Transport for details. 122 Proto string // "HTTP/1.0" 123 ProtoMajor int // 1 124 ProtoMinor int // 0 125 126 // Header contains the request header fields either received 127 // by the server or to be sent by the client. 128 // 129 // If a server received a request with header lines, 130 // 131 // Host: example.com 132 // accept-encoding: gzip, deflate 133 // Accept-Language: en-us 134 // fOO: Bar 135 // foo: two 136 // 137 // then 138 // 139 // Header = map[string][]string{ 140 // "Accept-Encoding": {"gzip, deflate"}, 141 // "Accept-Language": {"en-us"}, 142 // "Foo": {"Bar", "two"}, 143 // } 144 // 145 // For incoming requests, the Host header is promoted to the 146 // Request.Host field and removed from the Header map. 147 // 148 // HTTP defines that header names are case-insensitive. The 149 // request parser implements this by using CanonicalHeaderKey, 150 // making the first character and any characters following a 151 // hyphen uppercase and the rest lowercase. 152 // 153 // For client requests, certain headers such as Content-Length 154 // and Connection are automatically written when needed and 155 // values in Header may be ignored. See the documentation 156 // for the Request.Write method. 157 Header Header 158 159 // Body is the request's body. 160 // 161 // For client requests a nil body means the request has no 162 // body, such as a GET request. The HTTP Client's Transport 163 // is responsible for calling the Close method. 164 // 165 // For server requests the Request Body is always non-nil 166 // but will return EOF immediately when no body is present. 167 // The Server will close the request body. The ServeHTTP 168 // Handler does not need to. 169 Body io.ReadCloser 170 171 // GetBody defines an optional func to return a new copy of 172 // Body. It is used for client requests when a redirect requires 173 // reading the body more than once. Use of GetBody still 174 // requires setting Body. 175 // 176 // For server requests it is unused. 177 GetBody func() (io.ReadCloser, error) 178 179 // ContentLength records the length of the associated content. 180 // The value -1 indicates that the length is unknown. 181 // Values >= 0 indicate that the given number of bytes may 182 // be read from Body. 183 // For client requests, a value of 0 with a non-nil Body is 184 // also treated as unknown. 185 ContentLength int64 186 187 // TransferEncoding lists the transfer encodings from outermost to 188 // innermost. An empty list denotes the "identity" encoding. 189 // TransferEncoding can usually be ignored; chunked encoding is 190 // automatically added and removed as necessary when sending and 191 // receiving requests. 192 TransferEncoding []string 193 194 // Close indicates whether to close the connection after 195 // replying to this request (for servers) or after sending this 196 // request and reading its response (for clients). 197 // 198 // For server requests, the HTTP server handles this automatically 199 // and this field is not needed by Handlers. 200 // 201 // For client requests, setting this field prevents re-use of 202 // TCP connections between requests to the same hosts, as if 203 // Transport.DisableKeepAlives were set. 204 Close bool 205 206 // For server requests Host specifies the host on which the 207 // URL is sought. Per RFC 2616, this is either the value of 208 // the "Host" header or the host name given in the URL itself. 209 // It may be of the form "host:port". For international domain 210 // names, Host may be in Punycode or Unicode form. Use 211 // golang.org/x/net/idna to convert it to either format if 212 // needed. 213 // 214 // For client requests Host optionally overrides the Host 215 // header to send. If empty, the Request.Write method uses 216 // the value of URL.Host. Host may contain an international 217 // domain name. 218 Host string 219 220 // Form contains the parsed form data, including both the URL 221 // field's query parameters and the POST or PUT form data. 222 // This field is only available after ParseForm is called. 223 // The HTTP client ignores Form and uses Body instead. 224 Form url.Values 225 226 // PostForm contains the parsed form data from POST, PATCH, 227 // or PUT body parameters. 228 // 229 // This field is only available after ParseForm is called. 230 // The HTTP client ignores PostForm and uses Body instead. 231 PostForm url.Values 232 233 // MultipartForm is the parsed multipart form, including file uploads. 234 // This field is only available after ParseMultipartForm is called. 235 // The HTTP client ignores MultipartForm and uses Body instead. 236 MultipartForm *multipart.Form 237 238 // Trailer specifies additional headers that are sent after the request 239 // body. 240 // 241 // For server requests the Trailer map initially contains only the 242 // trailer keys, with nil values. (The client declares which trailers it 243 // will later send.) While the handler is reading from Body, it must 244 // not reference Trailer. After reading from Body returns EOF, Trailer 245 // can be read again and will contain non-nil values, if they were sent 246 // by the client. 247 // 248 // For client requests Trailer must be initialized to a map containing 249 // the trailer keys to later send. The values may be nil or their final 250 // values. The ContentLength must be 0 or -1, to send a chunked request. 251 // After the HTTP request is sent the map values can be updated while 252 // the request body is read. Once the body returns EOF, the caller must 253 // not mutate Trailer. 254 // 255 // Few HTTP clients, servers, or proxies support HTTP trailers. 256 Trailer Header 257 258 // RemoteAddr allows HTTP servers and other software to record 259 // the network address that sent the request, usually for 260 // logging. This field is not filled in by ReadRequest and 261 // has no defined format. The HTTP server in this package 262 // sets RemoteAddr to an "IP:port" address before invoking a 263 // handler. 264 // This field is ignored by the HTTP client. 265 RemoteAddr string 266 267 // RequestURI is the unmodified Request-URI of the 268 // Request-Line (RFC 2616, Section 5.1) as sent by the client 269 // to a server. Usually the URL field should be used instead. 270 // It is an error to set this field in an HTTP client request. 271 RequestURI string 272 273 // TLS allows HTTP servers and other software to record 274 // information about the TLS connection on which the request 275 // was received. This field is not filled in by ReadRequest. 276 // The HTTP server in this package sets the field for 277 // TLS-enabled connections before invoking a handler; 278 // otherwise it leaves the field nil. 279 // This field is ignored by the HTTP client. 280 TLS *tls.ConnectionState 281 282 // Cancel is an optional channel whose closure indicates that the client 283 // request should be regarded as canceled. Not all implementations of 284 // RoundTripper may support Cancel. 285 // 286 // For server requests, this field is not applicable. 287 // 288 // Deprecated: Use the Context and WithContext methods 289 // instead. If a Request's Cancel field and context are both 290 // set, it is undefined whether Cancel is respected. 291 Cancel <-chan struct{} 292 293 // Response is the redirect response which caused this request 294 // to be created. This field is only populated during client 295 // redirects. 296 Response *Response 297 298 // ctx is either the client or server context. It should only 299 // be modified via copying the whole Request using WithContext. 300 // It is unexported to prevent people from using Context wrong 301 // and mutating the contexts held by callers of the same request. 302 ctx context.Context 303 } 304 305 // Context returns the request's context. To change the context, use 306 // WithContext. 307 // 308 // The returned context is always non-nil; it defaults to the 309 // background context. 310 // 311 // For outgoing client requests, the context controls cancelation. 312 // 313 // For incoming server requests, the context is canceled when the 314 // client's connection closes, the request is canceled (with HTTP/2), 315 // or when the ServeHTTP method returns. 316 func (r *Request) Context() context.Context { 317 if r.ctx != nil { 318 return r.ctx 319 } 320 return context.Background() 321 } 322 323 // WithContext returns a shallow copy of r with its context changed 324 // to ctx. The provided ctx must be non-nil. 325 func (r *Request) WithContext(ctx context.Context) *Request { 326 if ctx == nil { 327 panic("nil context") 328 } 329 r2 := new(Request) 330 *r2 = *r 331 r2.ctx = ctx 332 333 // Deep copy the URL because it isn't 334 // a map and the URL is mutable by users 335 // of WithContext. 336 r2URL := new(url.URL) 337 *r2URL = *r.URL 338 r2.URL = r2URL 339 340 return r2 341 } 342 343 // ProtoAtLeast reports whether the HTTP protocol used 344 // in the request is at least major.minor. 345 func (r *Request) ProtoAtLeast(major, minor int) bool { 346 return r.ProtoMajor > major || 347 r.ProtoMajor == major && r.ProtoMinor >= minor 348 } 349 350 // protoAtLeastOutgoing is like ProtoAtLeast, but is for outgoing 351 // requests (see issue 18407) where these fields aren't supposed to 352 // matter. As a minor fix for Go 1.8, at least treat (0, 0) as 353 // matching HTTP/1.1 or HTTP/1.0. Only HTTP/1.1 is used. 354 // TODO(bradfitz): ideally remove this whole method. It shouldn't be used. 355 func (r *Request) protoAtLeastOutgoing(major, minor int) bool { 356 if r.ProtoMajor == 0 && r.ProtoMinor == 0 && major == 1 && minor <= 1 { 357 return true 358 } 359 return r.ProtoAtLeast(major, minor) 360 } 361 362 // UserAgent returns the client's User-Agent, if sent in the request. 363 func (r *Request) UserAgent() string { 364 return r.Header.Get("User-Agent") 365 } 366 367 // Cookies parses and returns the HTTP cookies sent with the request. 368 func (r *Request) Cookies() []*Cookie { 369 return readCookies(r.Header, "") 370 } 371 372 // ErrNoCookie is returned by Request's Cookie method when a cookie is not found. 373 var ErrNoCookie = errors.New("http: named cookie not present") 374 375 // Cookie returns the named cookie provided in the request or 376 // ErrNoCookie if not found. 377 // If multiple cookies match the given name, only one cookie will 378 // be returned. 379 func (r *Request) Cookie(name string) (*Cookie, error) { 380 for _, c := range readCookies(r.Header, name) { 381 return c, nil 382 } 383 return nil, ErrNoCookie 384 } 385 386 // AddCookie adds a cookie to the request. Per RFC 6265 section 5.4, 387 // AddCookie does not attach more than one Cookie header field. That 388 // means all cookies, if any, are written into the same line, 389 // separated by semicolon. 390 func (r *Request) AddCookie(c *Cookie) { 391 s := fmt.Sprintf("%s=%s", sanitizeCookieName(c.Name), sanitizeCookieValue(c.Value)) 392 if c := r.Header.Get("Cookie"); c != "" { 393 r.Header.Set("Cookie", c+"; "+s) 394 } else { 395 r.Header.Set("Cookie", s) 396 } 397 } 398 399 // Referer returns the referring URL, if sent in the request. 400 // 401 // Referer is misspelled as in the request itself, a mistake from the 402 // earliest days of HTTP. This value can also be fetched from the 403 // Header map as Header["Referer"]; the benefit of making it available 404 // as a method is that the compiler can diagnose programs that use the 405 // alternate (correct English) spelling req.Referrer() but cannot 406 // diagnose programs that use Header["Referrer"]. 407 func (r *Request) Referer() string { 408 return r.Header.Get("Referer") 409 } 410 411 // multipartByReader is a sentinel value. 412 // Its presence in Request.MultipartForm indicates that parsing of the request 413 // body has been handed off to a MultipartReader instead of ParseMultipartFrom. 414 var multipartByReader = &multipart.Form{ 415 Value: make(map[string][]string), 416 File: make(map[string][]*multipart.FileHeader), 417 } 418 419 // MultipartReader returns a MIME multipart reader if this is a 420 // multipart/form-data POST request, else returns nil and an error. 421 // Use this function instead of ParseMultipartForm to 422 // process the request body as a stream. 423 func (r *Request) MultipartReader() (*multipart.Reader, error) { 424 if r.MultipartForm == multipartByReader { 425 return nil, errors.New("http: MultipartReader called twice") 426 } 427 if r.MultipartForm != nil { 428 return nil, errors.New("http: multipart handled by ParseMultipartForm") 429 } 430 r.MultipartForm = multipartByReader 431 return r.multipartReader() 432 } 433 434 func (r *Request) multipartReader() (*multipart.Reader, error) { 435 v := r.Header.Get("Content-Type") 436 if v == "" { 437 return nil, ErrNotMultipart 438 } 439 d, params, err := mime.ParseMediaType(v) 440 if err != nil || d != "multipart/form-data" { 441 return nil, ErrNotMultipart 442 } 443 boundary, ok := params["boundary"] 444 if !ok { 445 return nil, ErrMissingBoundary 446 } 447 return multipart.NewReader(r.Body, boundary), nil 448 } 449 450 // isH2Upgrade reports whether r represents the http2 "client preface" 451 // magic string. 452 func (r *Request) isH2Upgrade() bool { 453 return r.Method == "PRI" && len(r.Header) == 0 && r.URL.Path == "*" && r.Proto == "HTTP/2.0" 454 } 455 456 // Return value if nonempty, def otherwise. 457 func valueOrDefault(value, def string) string { 458 if value != "" { 459 return value 460 } 461 return def 462 } 463 464 // NOTE: This is not intended to reflect the actual Go version being used. 465 // It was changed at the time of Go 1.1 release because the former User-Agent 466 // had ended up on a blacklist for some intrusion detection systems. 467 // See https://codereview.appspot.com/7532043. 468 const defaultUserAgent = "Go-http-client/1.1" 469 470 // Write writes an HTTP/1.1 request, which is the header and body, in wire format. 471 // This method consults the following fields of the request: 472 // Host 473 // URL 474 // Method (defaults to "GET") 475 // Header 476 // ContentLength 477 // TransferEncoding 478 // Body 479 // 480 // If Body is present, Content-Length is <= 0 and TransferEncoding 481 // hasn't been set to "identity", Write adds "Transfer-Encoding: 482 // chunked" to the header. Body is closed after it is sent. 483 func (r *Request) Write(w io.Writer) error { 484 return r.write(w, false, nil, nil) 485 } 486 487 // WriteProxy is like Write but writes the request in the form 488 // expected by an HTTP proxy. In particular, WriteProxy writes the 489 // initial Request-URI line of the request with an absolute URI, per 490 // section 5.1.2 of RFC 2616, including the scheme and host. 491 // In either case, WriteProxy also writes a Host header, using 492 // either r.Host or r.URL.Host. 493 func (r *Request) WriteProxy(w io.Writer) error { 494 return r.write(w, true, nil, nil) 495 } 496 497 // errMissingHost is returned by Write when there is no Host or URL present in 498 // the Request. 499 var errMissingHost = errors.New("http: Request.Write on Request with no Host or URL set") 500 501 // extraHeaders may be nil 502 // waitForContinue may be nil 503 func (req *Request) write(w io.Writer, usingProxy bool, extraHeaders Header, waitForContinue func() bool) (err error) { 504 trace := httptrace.ContextClientTrace(req.Context()) 505 if trace != nil && trace.WroteRequest != nil { 506 defer func() { 507 trace.WroteRequest(httptrace.WroteRequestInfo{ 508 Err: err, 509 }) 510 }() 511 } 512 513 // Find the target host. Prefer the Host: header, but if that 514 // is not given, use the host from the request URL. 515 // 516 // Clean the host, in case it arrives with unexpected stuff in it. 517 host := cleanHost(req.Host) 518 if host == "" { 519 if req.URL == nil { 520 return errMissingHost 521 } 522 host = cleanHost(req.URL.Host) 523 } 524 525 // According to RFC 6874, an HTTP client, proxy, or other 526 // intermediary must remove any IPv6 zone identifier attached 527 // to an outgoing URI. 528 host = removeZone(host) 529 530 ruri := req.URL.RequestURI() 531 if usingProxy && req.URL.Scheme != "" && req.URL.Opaque == "" { 532 ruri = req.URL.Scheme + "://" + host + ruri 533 } else if req.Method == "CONNECT" && req.URL.Path == "" { 534 // CONNECT requests normally give just the host and port, not a full URL. 535 ruri = host 536 } 537 // TODO(bradfitz): escape at least newlines in ruri? 538 539 // Wrap the writer in a bufio Writer if it's not already buffered. 540 // Don't always call NewWriter, as that forces a bytes.Buffer 541 // and other small bufio Writers to have a minimum 4k buffer 542 // size. 543 var bw *bufio.Writer 544 if _, ok := w.(io.ByteWriter); !ok { 545 bw = bufio.NewWriter(w) 546 w = bw 547 } 548 549 _, err = fmt.Fprintf(w, "%s %s HTTP/1.1\r\n", valueOrDefault(req.Method, "GET"), ruri) 550 if err != nil { 551 return err 552 } 553 554 // Header lines 555 _, err = fmt.Fprintf(w, "Host: %s\r\n", host) 556 if err != nil { 557 return err 558 } 559 560 // Use the defaultUserAgent unless the Header contains one, which 561 // may be blank to not send the header. 562 userAgent := defaultUserAgent 563 if _, ok := req.Header["User-Agent"]; ok { 564 userAgent = req.Header.Get("User-Agent") 565 } 566 if userAgent != "" { 567 _, err = fmt.Fprintf(w, "User-Agent: %s\r\n", userAgent) 568 if err != nil { 569 return err 570 } 571 } 572 573 // Process Body,ContentLength,Close,Trailer 574 tw, err := newTransferWriter(req) 575 if err != nil { 576 return err 577 } 578 err = tw.WriteHeader(w) 579 if err != nil { 580 return err 581 } 582 583 err = req.Header.WriteSubset(w, reqWriteExcludeHeader) 584 if err != nil { 585 return err 586 } 587 588 if extraHeaders != nil { 589 err = extraHeaders.Write(w) 590 if err != nil { 591 return err 592 } 593 } 594 595 _, err = io.WriteString(w, "\r\n") 596 if err != nil { 597 return err 598 } 599 600 if trace != nil && trace.WroteHeaders != nil { 601 trace.WroteHeaders() 602 } 603 604 // Flush and wait for 100-continue if expected. 605 if waitForContinue != nil { 606 if bw, ok := w.(*bufio.Writer); ok { 607 err = bw.Flush() 608 if err != nil { 609 return err 610 } 611 } 612 if trace != nil && trace.Wait100Continue != nil { 613 trace.Wait100Continue() 614 } 615 if !waitForContinue() { 616 req.closeBody() 617 return nil 618 } 619 } 620 621 if bw, ok := w.(*bufio.Writer); ok && tw.FlushHeaders { 622 if err := bw.Flush(); err != nil { 623 return err 624 } 625 } 626 627 // Write body and trailer 628 err = tw.WriteBody(w) 629 if err != nil { 630 if tw.bodyReadError == err { 631 err = requestBodyReadError{err} 632 } 633 return err 634 } 635 636 if bw != nil { 637 return bw.Flush() 638 } 639 return nil 640 } 641 642 // requestBodyReadError wraps an error from (*Request).write to indicate 643 // that the error came from a Read call on the Request.Body. 644 // This error type should not escape the net/http package to users. 645 type requestBodyReadError struct{ error } 646 647 func idnaASCII(v string) (string, error) { 648 // TODO: Consider removing this check after verifying performance is okay. 649 // Right now punycode verification, length checks, context checks, and the 650 // permissible character tests are all omitted. It also prevents the ToASCII 651 // call from salvaging an invalid IDN, when possible. As a result it may be 652 // possible to have two IDNs that appear identical to the user where the 653 // ASCII-only version causes an error downstream whereas the non-ASCII 654 // version does not. 655 // Note that for correct ASCII IDNs ToASCII will only do considerably more 656 // work, but it will not cause an allocation. 657 if isASCII(v) { 658 return v, nil 659 } 660 return idna.Lookup.ToASCII(v) 661 } 662 663 // cleanHost cleans up the host sent in request's Host header. 664 // 665 // It both strips anything after '/' or ' ', and puts the value 666 // into Punycode form, if necessary. 667 // 668 // Ideally we'd clean the Host header according to the spec: 669 // https://tools.ietf.org/html/rfc7230#section-5.4 (Host = uri-host [ ":" port ]") 670 // https://tools.ietf.org/html/rfc7230#section-2.7 (uri-host -> rfc3986's host) 671 // https://tools.ietf.org/html/rfc3986#section-3.2.2 (definition of host) 672 // But practically, what we are trying to avoid is the situation in 673 // issue 11206, where a malformed Host header used in the proxy context 674 // would create a bad request. So it is enough to just truncate at the 675 // first offending character. 676 func cleanHost(in string) string { 677 if i := strings.IndexAny(in, " /"); i != -1 { 678 in = in[:i] 679 } 680 host, port, err := net.SplitHostPort(in) 681 if err != nil { // input was just a host 682 a, err := idnaASCII(in) 683 if err != nil { 684 return in // garbage in, garbage out 685 } 686 return a 687 } 688 a, err := idnaASCII(host) 689 if err != nil { 690 return in // garbage in, garbage out 691 } 692 return net.JoinHostPort(a, port) 693 } 694 695 // removeZone removes IPv6 zone identifier from host. 696 // E.g., "[fe80::1%en0]:8080" to "[fe80::1]:8080" 697 func removeZone(host string) string { 698 if !strings.HasPrefix(host, "[") { 699 return host 700 } 701 i := strings.LastIndex(host, "]") 702 if i < 0 { 703 return host 704 } 705 j := strings.LastIndex(host[:i], "%") 706 if j < 0 { 707 return host 708 } 709 return host[:j] + host[i:] 710 } 711 712 // ParseHTTPVersion parses a HTTP version string. 713 // "HTTP/1.0" returns (1, 0, true). 714 func ParseHTTPVersion(vers string) (major, minor int, ok bool) { 715 const Big = 1000000 // arbitrary upper bound 716 switch vers { 717 case "HTTP/1.1": 718 return 1, 1, true 719 case "HTTP/1.0": 720 return 1, 0, true 721 } 722 if !strings.HasPrefix(vers, "HTTP/") { 723 return 0, 0, false 724 } 725 dot := strings.Index(vers, ".") 726 if dot < 0 { 727 return 0, 0, false 728 } 729 major, err := strconv.Atoi(vers[5:dot]) 730 if err != nil || major < 0 || major > Big { 731 return 0, 0, false 732 } 733 minor, err = strconv.Atoi(vers[dot+1:]) 734 if err != nil || minor < 0 || minor > Big { 735 return 0, 0, false 736 } 737 return major, minor, true 738 } 739 740 func validMethod(method string) bool { 741 /* 742 Method = "OPTIONS" ; Section 9.2 743 | "GET" ; Section 9.3 744 | "HEAD" ; Section 9.4 745 | "POST" ; Section 9.5 746 | "PUT" ; Section 9.6 747 | "DELETE" ; Section 9.7 748 | "TRACE" ; Section 9.8 749 | "CONNECT" ; Section 9.9 750 | extension-method 751 extension-method = token 752 token = 1*<any CHAR except CTLs or separators> 753 */ 754 return len(method) > 0 && strings.IndexFunc(method, isNotToken) == -1 755 } 756 757 // NewRequest returns a new Request given a method, URL, and optional body. 758 // 759 // If the provided body is also an io.Closer, the returned 760 // Request.Body is set to body and will be closed by the Client 761 // methods Do, Post, and PostForm, and Transport.RoundTrip. 762 // 763 // NewRequest returns a Request suitable for use with Client.Do or 764 // Transport.RoundTrip. To create a request for use with testing a 765 // Server Handler, either use the NewRequest function in the 766 // net/http/httptest package, use ReadRequest, or manually update the 767 // Request fields. See the Request type's documentation for the 768 // difference between inbound and outbound request fields. 769 // 770 // If body is of type *bytes.Buffer, *bytes.Reader, or 771 // *strings.Reader, the returned request's ContentLength is set to its 772 // exact value (instead of -1), GetBody is populated (so 307 and 308 773 // redirects can replay the body), and Body is set to NoBody if the 774 // ContentLength is 0. 775 func NewRequest(method, urlStr string, body io.Reader) (*Request, error) { 776 if method == "" { 777 // We document that "" means "GET" for Request.Method, and people have 778 // relied on that from NewRequest, so keep that working. 779 // We still enforce validMethod for non-empty methods. 780 method = "GET" 781 } 782 if !validMethod(method) { 783 return nil, fmt.Errorf("net/http: invalid method %q", method) 784 } 785 u, err := url.Parse(urlStr) 786 if err != nil { 787 return nil, err 788 } 789 rc, ok := body.(io.ReadCloser) 790 if !ok && body != nil { 791 rc = ioutil.NopCloser(body) 792 } 793 // The host's colon:port should be normalized. See Issue 14836. 794 u.Host = removeEmptyPort(u.Host) 795 req := &Request{ 796 Method: method, 797 URL: u, 798 Proto: "HTTP/1.1", 799 ProtoMajor: 1, 800 ProtoMinor: 1, 801 Header: make(Header), 802 Body: rc, 803 Host: u.Host, 804 } 805 if body != nil { 806 switch v := body.(type) { 807 case *bytes.Buffer: 808 req.ContentLength = int64(v.Len()) 809 buf := v.Bytes() 810 req.GetBody = func() (io.ReadCloser, error) { 811 r := bytes.NewReader(buf) 812 return ioutil.NopCloser(r), nil 813 } 814 case *bytes.Reader: 815 req.ContentLength = int64(v.Len()) 816 snapshot := *v 817 req.GetBody = func() (io.ReadCloser, error) { 818 r := snapshot 819 return ioutil.NopCloser(&r), nil 820 } 821 case *strings.Reader: 822 req.ContentLength = int64(v.Len()) 823 snapshot := *v 824 req.GetBody = func() (io.ReadCloser, error) { 825 r := snapshot 826 return ioutil.NopCloser(&r), nil 827 } 828 default: 829 // This is where we'd set it to -1 (at least 830 // if body != NoBody) to mean unknown, but 831 // that broke people during the Go 1.8 testing 832 // period. People depend on it being 0 I 833 // guess. Maybe retry later. See Issue 18117. 834 } 835 // For client requests, Request.ContentLength of 0 836 // means either actually 0, or unknown. The only way 837 // to explicitly say that the ContentLength is zero is 838 // to set the Body to nil. But turns out too much code 839 // depends on NewRequest returning a non-nil Body, 840 // so we use a well-known ReadCloser variable instead 841 // and have the http package also treat that sentinel 842 // variable to mean explicitly zero. 843 if req.GetBody != nil && req.ContentLength == 0 { 844 req.Body = NoBody 845 req.GetBody = func() (io.ReadCloser, error) { return NoBody, nil } 846 } 847 } 848 849 return req, nil 850 } 851 852 // BasicAuth returns the username and password provided in the request's 853 // Authorization header, if the request uses HTTP Basic Authentication. 854 // See RFC 2617, Section 2. 855 func (r *Request) BasicAuth() (username, password string, ok bool) { 856 auth := r.Header.Get("Authorization") 857 if auth == "" { 858 return 859 } 860 return parseBasicAuth(auth) 861 } 862 863 // parseBasicAuth parses an HTTP Basic Authentication string. 864 // "Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==" returns ("Aladdin", "open sesame", true). 865 func parseBasicAuth(auth string) (username, password string, ok bool) { 866 const prefix = "Basic " 867 if !strings.HasPrefix(auth, prefix) { 868 return 869 } 870 c, err := base64.StdEncoding.DecodeString(auth[len(prefix):]) 871 if err != nil { 872 return 873 } 874 cs := string(c) 875 s := strings.IndexByte(cs, ':') 876 if s < 0 { 877 return 878 } 879 return cs[:s], cs[s+1:], true 880 } 881 882 // SetBasicAuth sets the request's Authorization header to use HTTP 883 // Basic Authentication with the provided username and password. 884 // 885 // With HTTP Basic Authentication the provided username and password 886 // are not encrypted. 887 func (r *Request) SetBasicAuth(username, password string) { 888 r.Header.Set("Authorization", "Basic "+basicAuth(username, password)) 889 } 890 891 // parseRequestLine parses "GET /foo HTTP/1.1" into its three parts. 892 func parseRequestLine(line string) (method, requestURI, proto string, ok bool) { 893 s1 := strings.Index(line, " ") 894 s2 := strings.Index(line[s1+1:], " ") 895 if s1 < 0 || s2 < 0 { 896 return 897 } 898 s2 += s1 + 1 899 return line[:s1], line[s1+1 : s2], line[s2+1:], true 900 } 901 902 var textprotoReaderPool sync.Pool 903 904 func newTextprotoReader(br *bufio.Reader) *textproto.Reader { 905 if v := textprotoReaderPool.Get(); v != nil { 906 tr := v.(*textproto.Reader) 907 tr.R = br 908 return tr 909 } 910 return textproto.NewReader(br) 911 } 912 913 func putTextprotoReader(r *textproto.Reader) { 914 r.R = nil 915 textprotoReaderPool.Put(r) 916 } 917 918 // ReadRequest reads and parses an incoming request from b. 919 func ReadRequest(b *bufio.Reader) (*Request, error) { 920 return readRequest(b, deleteHostHeader) 921 } 922 923 // Constants for readRequest's deleteHostHeader parameter. 924 const ( 925 deleteHostHeader = true 926 keepHostHeader = false 927 ) 928 929 func readRequest(b *bufio.Reader, deleteHostHeader bool) (req *Request, err error) { 930 tp := newTextprotoReader(b) 931 req = new(Request) 932 933 // First line: GET /index.html HTTP/1.0 934 var s string 935 if s, err = tp.ReadLine(); err != nil { 936 return nil, err 937 } 938 defer func() { 939 putTextprotoReader(tp) 940 if err == io.EOF { 941 err = io.ErrUnexpectedEOF 942 } 943 }() 944 945 var ok bool 946 req.Method, req.RequestURI, req.Proto, ok = parseRequestLine(s) 947 if !ok { 948 return nil, &badStringError{"malformed HTTP request", s} 949 } 950 if !validMethod(req.Method) { 951 return nil, &badStringError{"invalid method", req.Method} 952 } 953 rawurl := req.RequestURI 954 if req.ProtoMajor, req.ProtoMinor, ok = ParseHTTPVersion(req.Proto); !ok { 955 return nil, &badStringError{"malformed HTTP version", req.Proto} 956 } 957 958 // CONNECT requests are used two different ways, and neither uses a full URL: 959 // The standard use is to tunnel HTTPS through an HTTP proxy. 960 // It looks like "CONNECT www.google.com:443 HTTP/1.1", and the parameter is 961 // just the authority section of a URL. This information should go in req.URL.Host. 962 // 963 // The net/rpc package also uses CONNECT, but there the parameter is a path 964 // that starts with a slash. It can be parsed with the regular URL parser, 965 // and the path will end up in req.URL.Path, where it needs to be in order for 966 // RPC to work. 967 justAuthority := req.Method == "CONNECT" && !strings.HasPrefix(rawurl, "/") 968 if justAuthority { 969 rawurl = "http://" + rawurl 970 } 971 972 if req.URL, err = url.ParseRequestURI(rawurl); err != nil { 973 return nil, err 974 } 975 976 if justAuthority { 977 // Strip the bogus "http://" back off. 978 req.URL.Scheme = "" 979 } 980 981 // Subsequent lines: Key: value. 982 mimeHeader, err := tp.ReadMIMEHeader() 983 if err != nil { 984 return nil, err 985 } 986 req.Header = Header(mimeHeader) 987 988 // RFC 2616: Must treat 989 // GET /index.html HTTP/1.1 990 // Host: www.google.com 991 // and 992 // GET http://www.google.com/index.html HTTP/1.1 993 // Host: doesntmatter 994 // the same. In the second case, any Host line is ignored. 995 req.Host = req.URL.Host 996 if req.Host == "" { 997 req.Host = req.Header.get("Host") 998 } 999 if deleteHostHeader { 1000 delete(req.Header, "Host") 1001 } 1002 1003 fixPragmaCacheControl(req.Header) 1004 1005 req.Close = shouldClose(req.ProtoMajor, req.ProtoMinor, req.Header, false) 1006 1007 err = readTransfer(req, b) 1008 if err != nil { 1009 return nil, err 1010 } 1011 1012 if req.isH2Upgrade() { 1013 // Because it's neither chunked, nor declared: 1014 req.ContentLength = -1 1015 1016 // We want to give handlers a chance to hijack the 1017 // connection, but we need to prevent the Server from 1018 // dealing with the connection further if it's not 1019 // hijacked. Set Close to ensure that: 1020 req.Close = true 1021 } 1022 return req, nil 1023 } 1024 1025 // MaxBytesReader is similar to io.LimitReader but is intended for 1026 // limiting the size of incoming request bodies. In contrast to 1027 // io.LimitReader, MaxBytesReader's result is a ReadCloser, returns a 1028 // non-EOF error for a Read beyond the limit, and closes the 1029 // underlying reader when its Close method is called. 1030 // 1031 // MaxBytesReader prevents clients from accidentally or maliciously 1032 // sending a large request and wasting server resources. 1033 func MaxBytesReader(w ResponseWriter, r io.ReadCloser, n int64) io.ReadCloser { 1034 return &maxBytesReader{w: w, r: r, n: n} 1035 } 1036 1037 type maxBytesReader struct { 1038 w ResponseWriter 1039 r io.ReadCloser // underlying reader 1040 n int64 // max bytes remaining 1041 err error // sticky error 1042 } 1043 1044 func (l *maxBytesReader) tooLarge() (n int, err error) { 1045 l.err = errors.New("http: request body too large") 1046 return 0, l.err 1047 } 1048 1049 func (l *maxBytesReader) Read(p []byte) (n int, err error) { 1050 if l.err != nil { 1051 return 0, l.err 1052 } 1053 if len(p) == 0 { 1054 return 0, nil 1055 } 1056 // If they asked for a 32KB byte read but only 5 bytes are 1057 // remaining, no need to read 32KB. 6 bytes will answer the 1058 // question of the whether we hit the limit or go past it. 1059 if int64(len(p)) > l.n+1 { 1060 p = p[:l.n+1] 1061 } 1062 n, err = l.r.Read(p) 1063 1064 if int64(n) <= l.n { 1065 l.n -= int64(n) 1066 l.err = err 1067 return n, err 1068 } 1069 1070 n = int(l.n) 1071 l.n = 0 1072 1073 // The server code and client code both use 1074 // maxBytesReader. This "requestTooLarge" check is 1075 // only used by the server code. To prevent binaries 1076 // which only using the HTTP Client code (such as 1077 // cmd/go) from also linking in the HTTP server, don't 1078 // use a static type assertion to the server 1079 // "*response" type. Check this interface instead: 1080 type requestTooLarger interface { 1081 requestTooLarge() 1082 } 1083 if res, ok := l.w.(requestTooLarger); ok { 1084 res.requestTooLarge() 1085 } 1086 l.err = errors.New("http: request body too large") 1087 return n, l.err 1088 } 1089 1090 func (l *maxBytesReader) Close() error { 1091 return l.r.Close() 1092 } 1093 1094 func copyValues(dst, src url.Values) { 1095 for k, vs := range src { 1096 for _, value := range vs { 1097 dst.Add(k, value) 1098 } 1099 } 1100 } 1101 1102 func parsePostForm(r *Request) (vs url.Values, err error) { 1103 if r.Body == nil { 1104 err = errors.New("missing form body") 1105 return 1106 } 1107 ct := r.Header.Get("Content-Type") 1108 // RFC 2616, section 7.2.1 - empty type 1109 // SHOULD be treated as application/octet-stream 1110 if ct == "" { 1111 ct = "application/octet-stream" 1112 } 1113 ct, _, err = mime.ParseMediaType(ct) 1114 switch { 1115 case ct == "application/x-www-form-urlencoded": 1116 var reader io.Reader = r.Body 1117 maxFormSize := int64(1<<63 - 1) 1118 if _, ok := r.Body.(*maxBytesReader); !ok { 1119 maxFormSize = int64(10 << 20) // 10 MB is a lot of text. 1120 reader = io.LimitReader(r.Body, maxFormSize+1) 1121 } 1122 b, e := ioutil.ReadAll(reader) 1123 if e != nil { 1124 if err == nil { 1125 err = e 1126 } 1127 break 1128 } 1129 if int64(len(b)) > maxFormSize { 1130 err = errors.New("http: POST too large") 1131 return 1132 } 1133 vs, e = url.ParseQuery(string(b)) 1134 if err == nil { 1135 err = e 1136 } 1137 case ct == "multipart/form-data": 1138 // handled by ParseMultipartForm (which is calling us, or should be) 1139 // TODO(bradfitz): there are too many possible 1140 // orders to call too many functions here. 1141 // Clean this up and write more tests. 1142 // request_test.go contains the start of this, 1143 // in TestParseMultipartFormOrder and others. 1144 } 1145 return 1146 } 1147 1148 // ParseForm populates r.Form and r.PostForm. 1149 // 1150 // For all requests, ParseForm parses the raw query from the URL and updates 1151 // r.Form. 1152 // 1153 // For POST, PUT, and PATCH requests, it also parses the request body as a form 1154 // and puts the results into both r.PostForm and r.Form. Request body parameters 1155 // take precedence over URL query string values in r.Form. 1156 // 1157 // For other HTTP methods, or when the Content-Type is not 1158 // application/x-www-form-urlencoded, the request Body is not read, and 1159 // r.PostForm is initialized to a non-nil, empty value. 1160 // 1161 // If the request Body's size has not already been limited by MaxBytesReader, 1162 // the size is capped at 10MB. 1163 // 1164 // ParseMultipartForm calls ParseForm automatically. 1165 // ParseForm is idempotent. 1166 func (r *Request) ParseForm() error { 1167 var err error 1168 if r.PostForm == nil { 1169 if r.Method == "POST" || r.Method == "PUT" || r.Method == "PATCH" { 1170 r.PostForm, err = parsePostForm(r) 1171 } 1172 if r.PostForm == nil { 1173 r.PostForm = make(url.Values) 1174 } 1175 } 1176 if r.Form == nil { 1177 if len(r.PostForm) > 0 { 1178 r.Form = make(url.Values) 1179 copyValues(r.Form, r.PostForm) 1180 } 1181 var newValues url.Values 1182 if r.URL != nil { 1183 var e error 1184 newValues, e = url.ParseQuery(r.URL.RawQuery) 1185 if err == nil { 1186 err = e 1187 } 1188 } 1189 if newValues == nil { 1190 newValues = make(url.Values) 1191 } 1192 if r.Form == nil { 1193 r.Form = newValues 1194 } else { 1195 copyValues(r.Form, newValues) 1196 } 1197 } 1198 return err 1199 } 1200 1201 // ParseMultipartForm parses a request body as multipart/form-data. 1202 // The whole request body is parsed and up to a total of maxMemory bytes of 1203 // its file parts are stored in memory, with the remainder stored on 1204 // disk in temporary files. 1205 // ParseMultipartForm calls ParseForm if necessary. 1206 // After one call to ParseMultipartForm, subsequent calls have no effect. 1207 func (r *Request) ParseMultipartForm(maxMemory int64) error { 1208 if r.MultipartForm == multipartByReader { 1209 return errors.New("http: multipart handled by MultipartReader") 1210 } 1211 if r.Form == nil { 1212 err := r.ParseForm() 1213 if err != nil { 1214 return err 1215 } 1216 } 1217 if r.MultipartForm != nil { 1218 return nil 1219 } 1220 1221 mr, err := r.multipartReader() 1222 if err != nil { 1223 return err 1224 } 1225 1226 f, err := mr.ReadForm(maxMemory) 1227 if err != nil { 1228 return err 1229 } 1230 1231 if r.PostForm == nil { 1232 r.PostForm = make(url.Values) 1233 } 1234 for k, v := range f.Value { 1235 r.Form[k] = append(r.Form[k], v...) 1236 // r.PostForm should also be populated. See Issue 9305. 1237 r.PostForm[k] = append(r.PostForm[k], v...) 1238 } 1239 1240 r.MultipartForm = f 1241 1242 return nil 1243 } 1244 1245 // FormValue returns the first value for the named component of the query. 1246 // POST and PUT body parameters take precedence over URL query string values. 1247 // FormValue calls ParseMultipartForm and ParseForm if necessary and ignores 1248 // any errors returned by these functions. 1249 // If key is not present, FormValue returns the empty string. 1250 // To access multiple values of the same key, call ParseForm and 1251 // then inspect Request.Form directly. 1252 func (r *Request) FormValue(key string) string { 1253 if r.Form == nil { 1254 r.ParseMultipartForm(defaultMaxMemory) 1255 } 1256 if vs := r.Form[key]; len(vs) > 0 { 1257 return vs[0] 1258 } 1259 return "" 1260 } 1261 1262 // PostFormValue returns the first value for the named component of the POST 1263 // or PUT request body. URL query parameters are ignored. 1264 // PostFormValue calls ParseMultipartForm and ParseForm if necessary and ignores 1265 // any errors returned by these functions. 1266 // If key is not present, PostFormValue returns the empty string. 1267 func (r *Request) PostFormValue(key string) string { 1268 if r.PostForm == nil { 1269 r.ParseMultipartForm(defaultMaxMemory) 1270 } 1271 if vs := r.PostForm[key]; len(vs) > 0 { 1272 return vs[0] 1273 } 1274 return "" 1275 } 1276 1277 // FormFile returns the first file for the provided form key. 1278 // FormFile calls ParseMultipartForm and ParseForm if necessary. 1279 func (r *Request) FormFile(key string) (multipart.File, *multipart.FileHeader, error) { 1280 if r.MultipartForm == multipartByReader { 1281 return nil, nil, errors.New("http: multipart handled by MultipartReader") 1282 } 1283 if r.MultipartForm == nil { 1284 err := r.ParseMultipartForm(defaultMaxMemory) 1285 if err != nil { 1286 return nil, nil, err 1287 } 1288 } 1289 if r.MultipartForm != nil && r.MultipartForm.File != nil { 1290 if fhs := r.MultipartForm.File[key]; len(fhs) > 0 { 1291 f, err := fhs[0].Open() 1292 return f, fhs[0], err 1293 } 1294 } 1295 return nil, nil, ErrMissingFile 1296 } 1297 1298 func (r *Request) expectsContinue() bool { 1299 return hasToken(r.Header.get("Expect"), "100-continue") 1300 } 1301 1302 func (r *Request) wantsHttp10KeepAlive() bool { 1303 if r.ProtoMajor != 1 || r.ProtoMinor != 0 { 1304 return false 1305 } 1306 return hasToken(r.Header.get("Connection"), "keep-alive") 1307 } 1308 1309 func (r *Request) wantsClose() bool { 1310 return hasToken(r.Header.get("Connection"), "close") 1311 } 1312 1313 func (r *Request) closeBody() { 1314 if r.Body != nil { 1315 r.Body.Close() 1316 } 1317 } 1318 1319 func (r *Request) isReplayable() bool { 1320 if r.Body == nil || r.Body == NoBody || r.GetBody != nil { 1321 switch valueOrDefault(r.Method, "GET") { 1322 case "GET", "HEAD", "OPTIONS", "TRACE": 1323 return true 1324 } 1325 } 1326 return false 1327 } 1328 1329 // outgoingLength reports the Content-Length of this outgoing (Client) request. 1330 // It maps 0 into -1 (unknown) when the Body is non-nil. 1331 func (r *Request) outgoingLength() int64 { 1332 if r.Body == nil || r.Body == NoBody { 1333 return 0 1334 } 1335 if r.ContentLength != 0 { 1336 return r.ContentLength 1337 } 1338 return -1 1339 } 1340 1341 // requestMethodUsuallyLacksBody reports whether the given request 1342 // method is one that typically does not involve a request body. 1343 // This is used by the Transport (via 1344 // transferWriter.shouldSendChunkedRequestBody) to determine whether 1345 // we try to test-read a byte from a non-nil Request.Body when 1346 // Request.outgoingLength() returns -1. See the comments in 1347 // shouldSendChunkedRequestBody. 1348 func requestMethodUsuallyLacksBody(method string) bool { 1349 switch method { 1350 case "GET", "HEAD", "DELETE", "OPTIONS", "PROPFIND", "SEARCH": 1351 return true 1352 } 1353 return false 1354 }