From 4e35e5fcabb504a14b9533692c9ae1a8c38b1139 Mon Sep 17 00:00:00 2001 From: Jakob Borg Date: Tue, 14 Mar 2017 08:21:51 +0900 Subject: [PATCH] net/http: fix ProxyFromEnvironment panic on invalid $NO_PROXY value Given an entry in $no_proxy like ":1" we would interpret it as an empty host name and a port number, then check the first character of the host name for dots. This would then cause an index out of range panic. This change simply skips these entries, as the following checks would anyway have returned false. Fixes #19536 Change-Id: Iafe9c7a77ad4a6278c8ccb00a1575b56e4bdcd79 Reviewed-on: https://go-review.googlesource.com/38067 Reviewed-by: Brad Fitzpatrick --- src/net/http/proxy_test.go | 6 ++++++ src/net/http/transport.go | 4 ++++ 2 files changed, 10 insertions(+) diff --git a/src/net/http/proxy_test.go b/src/net/http/proxy_test.go index 8d3a78b962..f59a551f0a 100644 --- a/src/net/http/proxy_test.go +++ b/src/net/http/proxy_test.go @@ -79,3 +79,9 @@ func ResetProxyEnv() { } ResetCachedEnvironment() } + +func TestInvalidNoProxy(t *testing.T) { + ResetProxyEnv() + os.Setenv("NO_PROXY", ":1") + useProxy("example.com:80") // should not panic +} diff --git a/src/net/http/transport.go b/src/net/http/transport.go index 0d4f427a57..5be7488d6d 100644 --- a/src/net/http/transport.go +++ b/src/net/http/transport.go @@ -1227,6 +1227,10 @@ func useProxy(addr string) bool { if addr == p { return false } + if len(p) == 0 { + // There is no host part, likely the entry is malformed; ignore. + continue + } if p[0] == '.' && (strings.HasSuffix(addr, p) || addr == p[1:]) { // no_proxy ".foo.com" matches "bar.foo.com" or "foo.com" return false -- 2.50.0