]> Cypherpunks repositories - gostls13.git/commit
net/http/httputil: close incoming ReverseProxy request body
authorDamien Neil <dneil@google.com>
Wed, 7 Jul 2021 23:34:34 +0000 (16:34 -0700)
committerFilippo Valsorda <filippo@golang.org>
Fri, 30 Jul 2021 14:01:30 +0000 (14:01 +0000)
commitb7a85e0003cedb1b48a1fd3ae5b746ec6330102e
treefe86fc80397496bbb065a7a1ae55799111b240b2
parent70fd4e47d73b92fe90e44ac785e2f98f9df0ab67
net/http/httputil: close incoming ReverseProxy request body

Reading from an incoming request body after the request handler aborts
with a panic can cause a panic, becuse http.Server does not (contrary
to its documentation) close the request body in this case.

Always close the incoming request body in ReverseProxy.ServeHTTP to
ensure that any in-flight outgoing requests using the body do not
read from it.

Updates #46866
Fixes CVE-2021-36221

Change-Id: I310df269200ad8732c5d9f1a2b00de68725831df
Reviewed-on: https://go-review.googlesource.com/c/go/+/333191
Trust: Damien Neil <dneil@google.com>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
src/net/http/httputil/reverseproxy.go
src/net/http/httputil/reverseproxy_test.go