net/http: clean the path of the stripped URL by StripPrefix

The path of the new stripped URL should also be cleaned. Since an empty path
may cause unexpected errors in some HTTP handlers, e.g. http.ServeFile.

Fixes #30165

Change-Id: Ib44fdce6388b5d62ffbcab5266925ef8f13f26e2
Reviewed-on: https://go-review.googlesource.com/c/161738
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>

diff --git a/src/net/http/serve_test.go b/src/net/http/serve_test.go
index 6eb0088a96375f80f1e4a5edc61d4d580e1cabfa..86cdb34ebb0abe2a87176b3e03a9dc5ae6590cf8 100644 (file)
--- a/src/net/http/serve_test.go
+++ b/src/net/http/serve_test.go
@@ -2900,6 +2900,15 @@ func TestStripPrefix(t *testing.T) {
                t.Errorf("test 2: got status %v, want %v", g, e)
        }
        res.Body.Close()
+
+       res, err = c.Get(ts.URL + "/foo")
+       if err != nil {
+               t.Fatal(err)
+       }
+       if g, e := res.Header.Get("X-Path"), "/"; g != e {
+               t.Errorf("test 3: got %s, want %s", g, e)
+       }
+       res.Body.Close()
 }
 
 // https://golang.org/issue/18952.

diff --git a/src/net/http/server.go b/src/net/http/server.go
index aa9c3f5d2ebd50c61e5c44cc424667456260283c..e68ec2f01efe991f57110cb4e426c1638db7d625 100644 (file)
--- a/src/net/http/server.go
+++ b/src/net/http/server.go
@@ -2030,7 +2030,7 @@ func StripPrefix(prefix string, h Handler) Handler {
                        *r2 = *r
                        r2.URL = new(url.URL)
                        *r2.URL = *r.URL
-                       r2.URL.Path = p
+                       r2.URL.Path = cleanPath(p)
                        h.ServeHTTP(w, r2)
                } else {
                        NotFound(w, r)