net/http: don't modify Request in StripPrefix

As of https://golang.org/cl/21530, rules are updated to state
that Handlers shouldn't modify the provided Request. This change
updates StripPrefix to follow that rule.

Resolves #18952.

Change-Id: I29bbb580722e871131fa75a97e6e038ec64fdfcd
Reviewed-on: https://go-review.googlesource.com/36483
Reviewed-by: Matt Layher <mdlayher@gmail.com>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Matt Layher <mdlayher@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>

diff --git a/src/net/http/serve_test.go b/src/net/http/serve_test.go
index 1358ce8c4a79d3587641aeb2e5704c51f6cafbdf..d74b1b120f42b822a049266fae5ee4584cbc527c 100644 (file)
--- a/src/net/http/serve_test.go
+++ b/src/net/http/serve_test.go
@@ -2433,6 +2433,16 @@ func TestStripPrefix(t *testing.T) {
        res.Body.Close()
 }
 
+// https://golang.org/issue/18952.
+func TestStripPrefix_notModifyRequest(t *testing.T) {
+       h := StripPrefix("/foo", NotFoundHandler())
+       req := httptest.NewRequest("GET", "/foo/bar", nil)
+       h.ServeHTTP(httptest.NewRecorder(), req)
+       if req.URL.Path != "/foo/bar" {
+               t.Errorf("StripPrefix should not modify the provided Request, but it did")
+       }
+}
+
 func TestRequestLimit_h1(t *testing.T) { testRequestLimit(t, h1Mode) }
 func TestRequestLimit_h2(t *testing.T) { testRequestLimit(t, h2Mode) }
 func testRequestLimit(t *testing.T, h2 bool) {

diff --git a/src/net/http/server.go b/src/net/http/server.go
index df70a15193bc6adb0127f250d4c2e3edb033e6e2..25573d95947979c79ab110f5912e736d1df36d79 100644 (file)
--- a/src/net/http/server.go
+++ b/src/net/http/server.go
@@ -1973,8 +1973,12 @@ func StripPrefix(prefix string, h Handler) Handler {
        }
        return HandlerFunc(func(w ResponseWriter, r *Request) {
                if p := strings.TrimPrefix(r.URL.Path, prefix); len(p) < len(r.URL.Path) {
-                       r.URL.Path = p
-                       h.ServeHTTP(w, r)
+                       r2 := new(Request)
+                       *r2 = *r
+                       r2.URL = new(url.URL)
+                       *r2.URL = *r.URL
+                       r2.URL.Path = p
+                       h.ServeHTTP(w, r2)
                } else {
                        NotFound(w, r)
                }