]> Cypherpunks repositories - gostls13.git/commit
net/textproto: reject HTTP requests with empty header keys
authorAndy Pan <panjf2000@gmail.com>
Wed, 24 Jan 2024 03:22:14 +0000 (11:22 +0800)
committerDamien Neil <dneil@google.com>
Tue, 30 Jan 2024 23:37:12 +0000 (23:37 +0000)
commitae457e811d44261801bda261731b5006d629930d
tree285f2773a984e5c8ee7338a19934f5e7a34394fa
parent41d6687084f1837311021a134968479cb40f9021
net/textproto: reject HTTP requests with empty header keys

According to RFC 7230, empty field names in HTTP header are invalid.
However, there are no specific instructions for developers to deal
with that kind of case in the specification. CL 11242 chose to skip
it and do nothing about it, which now seems like a bad idea because
it has led `net/http` to behave inconsistently with the most widely-used
HTTP implementations: Apache, Nginx, Node with llhttp, H2O, Lighttpd, etc.
in the case of empty header keys.

There is a very small chance that this CL will break a few existing HTTP clients.

Fixes #65244

Change-Id: Ie01e9a6693d27caea4d81d1539345cf42b225535
Reviewed-on: https://go-review.googlesource.com/c/go/+/558095
Reviewed-by: Bryan Mills <bcmills@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
src/net/http/serve_test.go
src/net/textproto/reader.go
src/net/textproto/reader_test.go