From af59742d0f6abe96eb5d68151b4d2ccb45d5ed89 Mon Sep 17 00:00:00 2001 From: Dmitri Shuralyov Date: Tue, 7 Feb 2017 10:57:33 -0500 Subject: [PATCH] net/http: don't modify Request in StripPrefix As of https://golang.org/cl/21530, rules are updated to state that Handlers shouldn't modify the provided Request. This change updates StripPrefix to follow that rule. Resolves #18952. Change-Id: I29bbb580722e871131fa75a97e6e038ec64fdfcd Reviewed-on: https://go-review.googlesource.com/36483 Reviewed-by: Matt Layher Reviewed-by: Brad Fitzpatrick Run-TryBot: Matt Layher TryBot-Result: Gobot Gobot --- src/net/http/serve_test.go | 10 ++++++++++ src/net/http/server.go | 8 ++++++-- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/src/net/http/serve_test.go b/src/net/http/serve_test.go index 1358ce8c4a..d74b1b120f 100644 --- a/src/net/http/serve_test.go +++ b/src/net/http/serve_test.go @@ -2433,6 +2433,16 @@ func TestStripPrefix(t *testing.T) { res.Body.Close() } +// https://golang.org/issue/18952. +func TestStripPrefix_notModifyRequest(t *testing.T) { + h := StripPrefix("/foo", NotFoundHandler()) + req := httptest.NewRequest("GET", "/foo/bar", nil) + h.ServeHTTP(httptest.NewRecorder(), req) + if req.URL.Path != "/foo/bar" { + t.Errorf("StripPrefix should not modify the provided Request, but it did") + } +} + func TestRequestLimit_h1(t *testing.T) { testRequestLimit(t, h1Mode) } func TestRequestLimit_h2(t *testing.T) { testRequestLimit(t, h2Mode) } func testRequestLimit(t *testing.T, h2 bool) { diff --git a/src/net/http/server.go b/src/net/http/server.go index df70a15193..25573d9594 100644 --- a/src/net/http/server.go +++ b/src/net/http/server.go @@ -1973,8 +1973,12 @@ func StripPrefix(prefix string, h Handler) Handler { } return HandlerFunc(func(w ResponseWriter, r *Request) { if p := strings.TrimPrefix(r.URL.Path, prefix); len(p) < len(r.URL.Path) { - r.URL.Path = p - h.ServeHTTP(w, r) + r2 := new(Request) + *r2 = *r + r2.URL = new(url.URL) + *r2.URL = *r.URL + r2.URL.Path = p + h.ServeHTTP(w, r2) } else { NotFound(w, r) } -- 2.50.0