From: Dmitri Shuralyov <shurcooL@gmail.com>
Date: Tue, 7 Feb 2017 15:57:33 +0000 (-0500)
Subject: net/http: don't modify Request in StripPrefix
X-Git-Tag: go1.9beta1~1667
X-Git-Url: http://www.git.cypherpunks.su/?a=commitdiff_plain;h=af59742d0f6abe96eb5d68151b4d2ccb45d5ed89;p=gostls13.git

net/http: don't modify Request in StripPrefix

As of https://golang.org/cl/21530, rules are updated to state
that Handlers shouldn't modify the provided Request. This change
updates StripPrefix to follow that rule.

Resolves #18952.

Change-Id: I29bbb580722e871131fa75a97e6e038ec64fdfcd
Reviewed-on: https://go-review.googlesource.com/36483
Reviewed-by: Matt Layher <mdlayher@gmail.com>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Matt Layher <mdlayher@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
---

diff --git a/src/net/http/serve_test.go b/src/net/http/serve_test.go
index 1358ce8c4a..d74b1b120f 100644
--- a/src/net/http/serve_test.go
+++ b/src/net/http/serve_test.go
@@ -2433,6 +2433,16 @@ func TestStripPrefix(t *testing.T) {
 	res.Body.Close()
 }
 
+// https://golang.org/issue/18952.
+func TestStripPrefix_notModifyRequest(t *testing.T) {
+	h := StripPrefix("/foo", NotFoundHandler())
+	req := httptest.NewRequest("GET", "/foo/bar", nil)
+	h.ServeHTTP(httptest.NewRecorder(), req)
+	if req.URL.Path != "/foo/bar" {
+		t.Errorf("StripPrefix should not modify the provided Request, but it did")
+	}
+}
+
 func TestRequestLimit_h1(t *testing.T) { testRequestLimit(t, h1Mode) }
 func TestRequestLimit_h2(t *testing.T) { testRequestLimit(t, h2Mode) }
 func testRequestLimit(t *testing.T, h2 bool) {
diff --git a/src/net/http/server.go b/src/net/http/server.go
index df70a15193..25573d9594 100644
--- a/src/net/http/server.go
+++ b/src/net/http/server.go
@@ -1973,8 +1973,12 @@ func StripPrefix(prefix string, h Handler) Handler {
 	}
 	return HandlerFunc(func(w ResponseWriter, r *Request) {
 		if p := strings.TrimPrefix(r.URL.Path, prefix); len(p) < len(r.URL.Path) {
-			r.URL.Path = p
-			h.ServeHTTP(w, r)
+			r2 := new(Request)
+			*r2 = *r
+			r2.URL = new(url.URL)
+			*r2.URL = *r.URL
+			r2.URL.Path = p
+			h.ServeHTTP(w, r2)
 		} else {
 			NotFound(w, r)
 		}