]> Cypherpunks repositories - gostls13.git/commit
net/http: close server conn after broken trailers
authorJed Denlea <jed@fastly.com>
Tue, 4 Aug 2015 01:00:44 +0000 (18:00 -0700)
committerRuss Cox <rsc@golang.org>
Wed, 5 Aug 2015 19:30:24 +0000 (19:30 +0000)
commit26049f6f9171d1190f3bbe05ec304845cfe6399f
tree53007dee2c3a1ed34d25e2a6f3c9bc2370741355
parentf51b7fbdc402716c282a2767ecc9a22e7d977316
net/http: close server conn after broken trailers

Prior to this change, broken trailers would be handled by body.Read, and
an error would be returned to its caller (likely a Handler), but that
error would go completely unnoticed by the rest of the server flow
allowing a broken connection to be reused.  This is a possible request
smuggling vector.

Fixes #12027.

Change-Id: I077eb0b8dff35c5d5534ee5f6386127c9954bd58
Reviewed-on: https://go-review.googlesource.com/13148
Reviewed-by: Russ Cox <rsc@golang.org>
src/net/http/serve_test.go
src/net/http/transfer.go