From: Johan Brandhorst <johan.brandhorst@gmail.com>
Date: Fri, 24 Aug 2018 11:10:01 +0000 (+0100)
Subject: net/http: ensure null body in Fetch response is not read
X-Git-Tag: go1.12beta1~1036
X-Git-Url: http://www.git.cypherpunks.su/?a=commitdiff_plain;h=ce536837d8e53f1bf0c7ef450d4580d19f7d6f52;p=gostls13.git

net/http: ensure null body in Fetch response is not read

The Fetch API returns a null body if there is no response body,
on browsers that support streaming the response body. This
change ensures we check for both undefined and null bodies
before attempting to read the body.

Fixes #27196

Change-Id: I0da86b61284fe394418b4b431495e715a037f335
Reviewed-on: https://go-review.googlesource.com/131236
Reviewed-by: Richard Musiol <neelance@gmail.com>
Run-TryBot: Richard Musiol <neelance@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
---

diff --git a/src/net/http/roundtrip_js.go b/src/net/http/roundtrip_js.go
index 16b7b891c8..38e4f5573e 100644
--- a/src/net/http/roundtrip_js.go
+++ b/src/net/http/roundtrip_js.go
@@ -116,7 +116,9 @@ func (t *Transport) RoundTrip(req *Request) (*Response, error) {
 
 		b := result.Get("body")
 		var body io.ReadCloser
-		if b != js.Undefined() {
+		// The body is undefined when the browser does not support streaming response bodies (Firefox),
+		// and null in certain error cases, i.e. when the request is blocked because of CORS settings.
+		if b != js.Undefined() && b != js.Null() {
 			body = &streamReader{stream: b.Call("getReader")}
 		} else {
 			// Fall back to using ArrayBuffer