]> Cypherpunks repositories - gostls13.git/commit
net/http: close server conn after request body error
authorJed Denlea <jed@fastly.com>
Thu, 30 Jul 2015 01:10:32 +0000 (18:10 -0700)
committerBrad Fitzpatrick <bradfitz@golang.org>
Sun, 2 Aug 2015 09:34:59 +0000 (09:34 +0000)
commitc2db5f4ccc61ba7df96a747e268a277b802cbb87
tree15954dabb41a075c51ccc98b52e6552d9b280090
parentec4d06e47010ef5a7a69080046530997169e7666
net/http: close server conn after request body error

HTTP servers attempt to entirely consume a request body before sending a
response.  However, when doing so, it previously would ignore any errors
encountered.

Unfortunately, the errors triggered at this stage are indicative of at
least a couple problems: read timeouts and chunked encoding errors.
This means properly crafted and/or timed requests could lead to a
"smuggled" request.

The fix is to inspect the errors created by the response body Reader,
and treat anything other than io.EOF or ErrBodyReadAfterClose as
fatal to the connection.

Fixes #11930

Change-Id: I0bf18006d7d8f6537529823fc450f2e2bdb7c18e
Reviewed-on: https://go-review.googlesource.com/12865
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
src/net/http/serve_test.go
src/net/http/server.go