...
Run Format

Source file src/net/http/request.go

     1	// Copyright 2009 The Go Authors. All rights reserved.
     2	// Use of this source code is governed by a BSD-style
     3	// license that can be found in the LICENSE file.
     4	
     5	// HTTP Request reading and parsing.
     6	
     7	package http
     8	
     9	import (
    10		"bufio"
    11		"bytes"
    12		"crypto/tls"
    13		"encoding/base64"
    14		"errors"
    15		"fmt"
    16		"io"
    17		"io/ioutil"
    18		"mime"
    19		"mime/multipart"
    20		"net/textproto"
    21		"net/url"
    22		"strconv"
    23		"strings"
    24		"sync"
    25	)
    26	
    27	const (
    28		defaultMaxMemory = 32 << 20 // 32 MB
    29	)
    30	
    31	// ErrMissingFile is returned by FormFile when the provided file field name
    32	// is either not present in the request or not a file field.
    33	var ErrMissingFile = errors.New("http: no such file")
    34	
    35	// HTTP request parsing errors.
    36	type ProtocolError struct {
    37		ErrorString string
    38	}
    39	
    40	func (err *ProtocolError) Error() string { return err.ErrorString }
    41	
    42	var (
    43		ErrHeaderTooLong        = &ProtocolError{"header too long"}
    44		ErrShortBody            = &ProtocolError{"entity body too short"}
    45		ErrNotSupported         = &ProtocolError{"feature not supported"}
    46		ErrUnexpectedTrailer    = &ProtocolError{"trailer header without chunked transfer encoding"}
    47		ErrMissingContentLength = &ProtocolError{"missing ContentLength in HEAD response"}
    48		ErrNotMultipart         = &ProtocolError{"request Content-Type isn't multipart/form-data"}
    49		ErrMissingBoundary      = &ProtocolError{"no multipart boundary param in Content-Type"}
    50	)
    51	
    52	type badStringError struct {
    53		what string
    54		str  string
    55	}
    56	
    57	func (e *badStringError) Error() string { return fmt.Sprintf("%s %q", e.what, e.str) }
    58	
    59	// Headers that Request.Write handles itself and should be skipped.
    60	var reqWriteExcludeHeader = map[string]bool{
    61		"Host":              true, // not in Header map anyway
    62		"User-Agent":        true,
    63		"Content-Length":    true,
    64		"Transfer-Encoding": true,
    65		"Trailer":           true,
    66	}
    67	
    68	// A Request represents an HTTP request received by a server
    69	// or to be sent by a client.
    70	//
    71	// The field semantics differ slightly between client and server
    72	// usage. In addition to the notes on the fields below, see the
    73	// documentation for Request.Write and RoundTripper.
    74	type Request struct {
    75		// Method specifies the HTTP method (GET, POST, PUT, etc.).
    76		// For client requests an empty string means GET.
    77		Method string
    78	
    79		// URL specifies either the URI being requested (for server
    80		// requests) or the URL to access (for client requests).
    81		//
    82		// For server requests the URL is parsed from the URI
    83		// supplied on the Request-Line as stored in RequestURI.  For
    84		// most requests, fields other than Path and RawQuery will be
    85		// empty. (See RFC 2616, Section 5.1.2)
    86		//
    87		// For client requests, the URL's Host specifies the server to
    88		// connect to, while the Request's Host field optionally
    89		// specifies the Host header value to send in the HTTP
    90		// request.
    91		URL *url.URL
    92	
    93		// The protocol version for incoming requests.
    94		// Client requests always use HTTP/1.1.
    95		Proto      string // "HTTP/1.0"
    96		ProtoMajor int    // 1
    97		ProtoMinor int    // 0
    98	
    99		// A header maps request lines to their values.
   100		// If the header says
   101		//
   102		//	accept-encoding: gzip, deflate
   103		//	Accept-Language: en-us
   104		//	Connection: keep-alive
   105		//
   106		// then
   107		//
   108		//	Header = map[string][]string{
   109		//		"Accept-Encoding": {"gzip, deflate"},
   110		//		"Accept-Language": {"en-us"},
   111		//		"Connection": {"keep-alive"},
   112		//	}
   113		//
   114		// HTTP defines that header names are case-insensitive.
   115		// The request parser implements this by canonicalizing the
   116		// name, making the first character and any characters
   117		// following a hyphen uppercase and the rest lowercase.
   118		//
   119		// For client requests certain headers are automatically
   120		// added and may override values in Header.
   121		//
   122		// See the documentation for the Request.Write method.
   123		Header Header
   124	
   125		// Body is the request's body.
   126		//
   127		// For client requests a nil body means the request has no
   128		// body, such as a GET request. The HTTP Client's Transport
   129		// is responsible for calling the Close method.
   130		//
   131		// For server requests the Request Body is always non-nil
   132		// but will return EOF immediately when no body is present.
   133		// The Server will close the request body. The ServeHTTP
   134		// Handler does not need to.
   135		Body io.ReadCloser
   136	
   137		// ContentLength records the length of the associated content.
   138		// The value -1 indicates that the length is unknown.
   139		// Values >= 0 indicate that the given number of bytes may
   140		// be read from Body.
   141		// For client requests, a value of 0 means unknown if Body is not nil.
   142		ContentLength int64
   143	
   144		// TransferEncoding lists the transfer encodings from outermost to
   145		// innermost. An empty list denotes the "identity" encoding.
   146		// TransferEncoding can usually be ignored; chunked encoding is
   147		// automatically added and removed as necessary when sending and
   148		// receiving requests.
   149		TransferEncoding []string
   150	
   151		// Close indicates whether to close the connection after
   152		// replying to this request (for servers) or after sending
   153		// the request (for clients).
   154		Close bool
   155	
   156		// For server requests Host specifies the host on which the
   157		// URL is sought. Per RFC 2616, this is either the value of
   158		// the "Host" header or the host name given in the URL itself.
   159		// It may be of the form "host:port".
   160		//
   161		// For client requests Host optionally overrides the Host
   162		// header to send. If empty, the Request.Write method uses
   163		// the value of URL.Host.
   164		Host string
   165	
   166		// Form contains the parsed form data, including both the URL
   167		// field's query parameters and the POST or PUT form data.
   168		// This field is only available after ParseForm is called.
   169		// The HTTP client ignores Form and uses Body instead.
   170		Form url.Values
   171	
   172		// PostForm contains the parsed form data from POST, PATCH,
   173		// or PUT body parameters.
   174		//
   175		// This field is only available after ParseForm is called.
   176		// The HTTP client ignores PostForm and uses Body instead.
   177		PostForm url.Values
   178	
   179		// MultipartForm is the parsed multipart form, including file uploads.
   180		// This field is only available after ParseMultipartForm is called.
   181		// The HTTP client ignores MultipartForm and uses Body instead.
   182		MultipartForm *multipart.Form
   183	
   184		// Trailer specifies additional headers that are sent after the request
   185		// body.
   186		//
   187		// For server requests the Trailer map initially contains only the
   188		// trailer keys, with nil values. (The client declares which trailers it
   189		// will later send.)  While the handler is reading from Body, it must
   190		// not reference Trailer. After reading from Body returns EOF, Trailer
   191		// can be read again and will contain non-nil values, if they were sent
   192		// by the client.
   193		//
   194		// For client requests Trailer must be initialized to a map containing
   195		// the trailer keys to later send. The values may be nil or their final
   196		// values. The ContentLength must be 0 or -1, to send a chunked request.
   197		// After the HTTP request is sent the map values can be updated while
   198		// the request body is read. Once the body returns EOF, the caller must
   199		// not mutate Trailer.
   200		//
   201		// Few HTTP clients, servers, or proxies support HTTP trailers.
   202		Trailer Header
   203	
   204		// RemoteAddr allows HTTP servers and other software to record
   205		// the network address that sent the request, usually for
   206		// logging. This field is not filled in by ReadRequest and
   207		// has no defined format. The HTTP server in this package
   208		// sets RemoteAddr to an "IP:port" address before invoking a
   209		// handler.
   210		// This field is ignored by the HTTP client.
   211		RemoteAddr string
   212	
   213		// RequestURI is the unmodified Request-URI of the
   214		// Request-Line (RFC 2616, Section 5.1) as sent by the client
   215		// to a server. Usually the URL field should be used instead.
   216		// It is an error to set this field in an HTTP client request.
   217		RequestURI string
   218	
   219		// TLS allows HTTP servers and other software to record
   220		// information about the TLS connection on which the request
   221		// was received. This field is not filled in by ReadRequest.
   222		// The HTTP server in this package sets the field for
   223		// TLS-enabled connections before invoking a handler;
   224		// otherwise it leaves the field nil.
   225		// This field is ignored by the HTTP client.
   226		TLS *tls.ConnectionState
   227	
   228		// Cancel is an optional channel whose closure indicates that the client
   229		// request should be regarded as canceled. Not all implementations of
   230		// RoundTripper may support Cancel.
   231		//
   232		// For server requests, this field is not applicable.
   233		Cancel <-chan struct{}
   234	}
   235	
   236	// ProtoAtLeast reports whether the HTTP protocol used
   237	// in the request is at least major.minor.
   238	func (r *Request) ProtoAtLeast(major, minor int) bool {
   239		return r.ProtoMajor > major ||
   240			r.ProtoMajor == major && r.ProtoMinor >= minor
   241	}
   242	
   243	// UserAgent returns the client's User-Agent, if sent in the request.
   244	func (r *Request) UserAgent() string {
   245		return r.Header.Get("User-Agent")
   246	}
   247	
   248	// Cookies parses and returns the HTTP cookies sent with the request.
   249	func (r *Request) Cookies() []*Cookie {
   250		return readCookies(r.Header, "")
   251	}
   252	
   253	// ErrNoCookie is returned by Request's Cookie method when a cookie is not found.
   254	var ErrNoCookie = errors.New("http: named cookie not present")
   255	
   256	// Cookie returns the named cookie provided in the request or
   257	// ErrNoCookie if not found.
   258	func (r *Request) Cookie(name string) (*Cookie, error) {
   259		for _, c := range readCookies(r.Header, name) {
   260			return c, nil
   261		}
   262		return nil, ErrNoCookie
   263	}
   264	
   265	// AddCookie adds a cookie to the request.  Per RFC 6265 section 5.4,
   266	// AddCookie does not attach more than one Cookie header field.  That
   267	// means all cookies, if any, are written into the same line,
   268	// separated by semicolon.
   269	func (r *Request) AddCookie(c *Cookie) {
   270		s := fmt.Sprintf("%s=%s", sanitizeCookieName(c.Name), sanitizeCookieValue(c.Value))
   271		if c := r.Header.Get("Cookie"); c != "" {
   272			r.Header.Set("Cookie", c+"; "+s)
   273		} else {
   274			r.Header.Set("Cookie", s)
   275		}
   276	}
   277	
   278	// Referer returns the referring URL, if sent in the request.
   279	//
   280	// Referer is misspelled as in the request itself, a mistake from the
   281	// earliest days of HTTP.  This value can also be fetched from the
   282	// Header map as Header["Referer"]; the benefit of making it available
   283	// as a method is that the compiler can diagnose programs that use the
   284	// alternate (correct English) spelling req.Referrer() but cannot
   285	// diagnose programs that use Header["Referrer"].
   286	func (r *Request) Referer() string {
   287		return r.Header.Get("Referer")
   288	}
   289	
   290	// multipartByReader is a sentinel value.
   291	// Its presence in Request.MultipartForm indicates that parsing of the request
   292	// body has been handed off to a MultipartReader instead of ParseMultipartFrom.
   293	var multipartByReader = &multipart.Form{
   294		Value: make(map[string][]string),
   295		File:  make(map[string][]*multipart.FileHeader),
   296	}
   297	
   298	// MultipartReader returns a MIME multipart reader if this is a
   299	// multipart/form-data POST request, else returns nil and an error.
   300	// Use this function instead of ParseMultipartForm to
   301	// process the request body as a stream.
   302	func (r *Request) MultipartReader() (*multipart.Reader, error) {
   303		if r.MultipartForm == multipartByReader {
   304			return nil, errors.New("http: MultipartReader called twice")
   305		}
   306		if r.MultipartForm != nil {
   307			return nil, errors.New("http: multipart handled by ParseMultipartForm")
   308		}
   309		r.MultipartForm = multipartByReader
   310		return r.multipartReader()
   311	}
   312	
   313	func (r *Request) multipartReader() (*multipart.Reader, error) {
   314		v := r.Header.Get("Content-Type")
   315		if v == "" {
   316			return nil, ErrNotMultipart
   317		}
   318		d, params, err := mime.ParseMediaType(v)
   319		if err != nil || d != "multipart/form-data" {
   320			return nil, ErrNotMultipart
   321		}
   322		boundary, ok := params["boundary"]
   323		if !ok {
   324			return nil, ErrMissingBoundary
   325		}
   326		return multipart.NewReader(r.Body, boundary), nil
   327	}
   328	
   329	// Return value if nonempty, def otherwise.
   330	func valueOrDefault(value, def string) string {
   331		if value != "" {
   332			return value
   333		}
   334		return def
   335	}
   336	
   337	// NOTE: This is not intended to reflect the actual Go version being used.
   338	// It was changed at the time of Go 1.1 release because the former User-Agent
   339	// had ended up on a blacklist for some intrusion detection systems.
   340	// See https://codereview.appspot.com/7532043.
   341	const defaultUserAgent = "Go-http-client/1.1"
   342	
   343	// Write writes an HTTP/1.1 request, which is the header and body, in wire format.
   344	// This method consults the following fields of the request:
   345	//	Host
   346	//	URL
   347	//	Method (defaults to "GET")
   348	//	Header
   349	//	ContentLength
   350	//	TransferEncoding
   351	//	Body
   352	//
   353	// If Body is present, Content-Length is <= 0 and TransferEncoding
   354	// hasn't been set to "identity", Write adds "Transfer-Encoding:
   355	// chunked" to the header. Body is closed after it is sent.
   356	func (r *Request) Write(w io.Writer) error {
   357		return r.write(w, false, nil)
   358	}
   359	
   360	// WriteProxy is like Write but writes the request in the form
   361	// expected by an HTTP proxy.  In particular, WriteProxy writes the
   362	// initial Request-URI line of the request with an absolute URI, per
   363	// section 5.1.2 of RFC 2616, including the scheme and host.
   364	// In either case, WriteProxy also writes a Host header, using
   365	// either r.Host or r.URL.Host.
   366	func (r *Request) WriteProxy(w io.Writer) error {
   367		return r.write(w, true, nil)
   368	}
   369	
   370	// extraHeaders may be nil
   371	func (req *Request) write(w io.Writer, usingProxy bool, extraHeaders Header) error {
   372		// Find the target host. Prefer the Host: header, but if that
   373		// is not given, use the host from the request URL.
   374		//
   375		// Clean the host, in case it arrives with unexpected stuff in it.
   376		host := cleanHost(req.Host)
   377		if host == "" {
   378			if req.URL == nil {
   379				return errors.New("http: Request.Write on Request with no Host or URL set")
   380			}
   381			host = cleanHost(req.URL.Host)
   382		}
   383	
   384		// According to RFC 6874, an HTTP client, proxy, or other
   385		// intermediary must remove any IPv6 zone identifier attached
   386		// to an outgoing URI.
   387		host = removeZone(host)
   388	
   389		ruri := req.URL.RequestURI()
   390		if usingProxy && req.URL.Scheme != "" && req.URL.Opaque == "" {
   391			ruri = req.URL.Scheme + "://" + host + ruri
   392		} else if req.Method == "CONNECT" && req.URL.Path == "" {
   393			// CONNECT requests normally give just the host and port, not a full URL.
   394			ruri = host
   395		}
   396		// TODO(bradfitz): escape at least newlines in ruri?
   397	
   398		// Wrap the writer in a bufio Writer if it's not already buffered.
   399		// Don't always call NewWriter, as that forces a bytes.Buffer
   400		// and other small bufio Writers to have a minimum 4k buffer
   401		// size.
   402		var bw *bufio.Writer
   403		if _, ok := w.(io.ByteWriter); !ok {
   404			bw = bufio.NewWriter(w)
   405			w = bw
   406		}
   407	
   408		_, err := fmt.Fprintf(w, "%s %s HTTP/1.1\r\n", valueOrDefault(req.Method, "GET"), ruri)
   409		if err != nil {
   410			return err
   411		}
   412	
   413		// Header lines
   414		_, err = fmt.Fprintf(w, "Host: %s\r\n", host)
   415		if err != nil {
   416			return err
   417		}
   418	
   419		// Use the defaultUserAgent unless the Header contains one, which
   420		// may be blank to not send the header.
   421		userAgent := defaultUserAgent
   422		if req.Header != nil {
   423			if ua := req.Header["User-Agent"]; len(ua) > 0 {
   424				userAgent = ua[0]
   425			}
   426		}
   427		if userAgent != "" {
   428			_, err = fmt.Fprintf(w, "User-Agent: %s\r\n", userAgent)
   429			if err != nil {
   430				return err
   431			}
   432		}
   433	
   434		// Process Body,ContentLength,Close,Trailer
   435		tw, err := newTransferWriter(req)
   436		if err != nil {
   437			return err
   438		}
   439		err = tw.WriteHeader(w)
   440		if err != nil {
   441			return err
   442		}
   443	
   444		err = req.Header.WriteSubset(w, reqWriteExcludeHeader)
   445		if err != nil {
   446			return err
   447		}
   448	
   449		if extraHeaders != nil {
   450			err = extraHeaders.Write(w)
   451			if err != nil {
   452				return err
   453			}
   454		}
   455	
   456		_, err = io.WriteString(w, "\r\n")
   457		if err != nil {
   458			return err
   459		}
   460	
   461		// Write body and trailer
   462		err = tw.WriteBody(w)
   463		if err != nil {
   464			return err
   465		}
   466	
   467		if bw != nil {
   468			return bw.Flush()
   469		}
   470		return nil
   471	}
   472	
   473	// cleanHost strips anything after '/' or ' '.
   474	// Ideally we'd clean the Host header according to the spec:
   475	//   https://tools.ietf.org/html/rfc7230#section-5.4 (Host = uri-host [ ":" port ]")
   476	//   https://tools.ietf.org/html/rfc7230#section-2.7 (uri-host -> rfc3986's host)
   477	//   https://tools.ietf.org/html/rfc3986#section-3.2.2 (definition of host)
   478	// But practically, what we are trying to avoid is the situation in
   479	// issue 11206, where a malformed Host header used in the proxy context
   480	// would create a bad request. So it is enough to just truncate at the
   481	// first offending character.
   482	func cleanHost(in string) string {
   483		if i := strings.IndexAny(in, " /"); i != -1 {
   484			return in[:i]
   485		}
   486		return in
   487	}
   488	
   489	// removeZone removes IPv6 zone identifer from host.
   490	// E.g., "[fe80::1%en0]:8080" to "[fe80::1]:8080"
   491	func removeZone(host string) string {
   492		if !strings.HasPrefix(host, "[") {
   493			return host
   494		}
   495		i := strings.LastIndex(host, "]")
   496		if i < 0 {
   497			return host
   498		}
   499		j := strings.LastIndex(host[:i], "%")
   500		if j < 0 {
   501			return host
   502		}
   503		return host[:j] + host[i:]
   504	}
   505	
   506	// ParseHTTPVersion parses a HTTP version string.
   507	// "HTTP/1.0" returns (1, 0, true).
   508	func ParseHTTPVersion(vers string) (major, minor int, ok bool) {
   509		const Big = 1000000 // arbitrary upper bound
   510		switch vers {
   511		case "HTTP/1.1":
   512			return 1, 1, true
   513		case "HTTP/1.0":
   514			return 1, 0, true
   515		}
   516		if !strings.HasPrefix(vers, "HTTP/") {
   517			return 0, 0, false
   518		}
   519		dot := strings.Index(vers, ".")
   520		if dot < 0 {
   521			return 0, 0, false
   522		}
   523		major, err := strconv.Atoi(vers[5:dot])
   524		if err != nil || major < 0 || major > Big {
   525			return 0, 0, false
   526		}
   527		minor, err = strconv.Atoi(vers[dot+1:])
   528		if err != nil || minor < 0 || minor > Big {
   529			return 0, 0, false
   530		}
   531		return major, minor, true
   532	}
   533	
   534	// NewRequest returns a new Request given a method, URL, and optional body.
   535	//
   536	// If the provided body is also an io.Closer, the returned
   537	// Request.Body is set to body and will be closed by the Client
   538	// methods Do, Post, and PostForm, and Transport.RoundTrip.
   539	//
   540	// NewRequest returns a Request suitable for use with Client.Do or
   541	// Transport.RoundTrip.
   542	// To create a request for use with testing a Server Handler use either
   543	// ReadRequest or manually update the Request fields. See the Request
   544	// type's documentation for the difference between inbound and outbound
   545	// request fields.
   546	func NewRequest(method, urlStr string, body io.Reader) (*Request, error) {
   547		u, err := url.Parse(urlStr)
   548		if err != nil {
   549			return nil, err
   550		}
   551		rc, ok := body.(io.ReadCloser)
   552		if !ok && body != nil {
   553			rc = ioutil.NopCloser(body)
   554		}
   555		req := &Request{
   556			Method:     method,
   557			URL:        u,
   558			Proto:      "HTTP/1.1",
   559			ProtoMajor: 1,
   560			ProtoMinor: 1,
   561			Header:     make(Header),
   562			Body:       rc,
   563			Host:       u.Host,
   564		}
   565		if body != nil {
   566			switch v := body.(type) {
   567			case *bytes.Buffer:
   568				req.ContentLength = int64(v.Len())
   569			case *bytes.Reader:
   570				req.ContentLength = int64(v.Len())
   571			case *strings.Reader:
   572				req.ContentLength = int64(v.Len())
   573			}
   574		}
   575	
   576		return req, nil
   577	}
   578	
   579	// BasicAuth returns the username and password provided in the request's
   580	// Authorization header, if the request uses HTTP Basic Authentication.
   581	// See RFC 2617, Section 2.
   582	func (r *Request) BasicAuth() (username, password string, ok bool) {
   583		auth := r.Header.Get("Authorization")
   584		if auth == "" {
   585			return
   586		}
   587		return parseBasicAuth(auth)
   588	}
   589	
   590	// parseBasicAuth parses an HTTP Basic Authentication string.
   591	// "Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==" returns ("Aladdin", "open sesame", true).
   592	func parseBasicAuth(auth string) (username, password string, ok bool) {
   593		const prefix = "Basic "
   594		if !strings.HasPrefix(auth, prefix) {
   595			return
   596		}
   597		c, err := base64.StdEncoding.DecodeString(auth[len(prefix):])
   598		if err != nil {
   599			return
   600		}
   601		cs := string(c)
   602		s := strings.IndexByte(cs, ':')
   603		if s < 0 {
   604			return
   605		}
   606		return cs[:s], cs[s+1:], true
   607	}
   608	
   609	// SetBasicAuth sets the request's Authorization header to use HTTP
   610	// Basic Authentication with the provided username and password.
   611	//
   612	// With HTTP Basic Authentication the provided username and password
   613	// are not encrypted.
   614	func (r *Request) SetBasicAuth(username, password string) {
   615		r.Header.Set("Authorization", "Basic "+basicAuth(username, password))
   616	}
   617	
   618	// parseRequestLine parses "GET /foo HTTP/1.1" into its three parts.
   619	func parseRequestLine(line string) (method, requestURI, proto string, ok bool) {
   620		s1 := strings.Index(line, " ")
   621		s2 := strings.Index(line[s1+1:], " ")
   622		if s1 < 0 || s2 < 0 {
   623			return
   624		}
   625		s2 += s1 + 1
   626		return line[:s1], line[s1+1 : s2], line[s2+1:], true
   627	}
   628	
   629	var textprotoReaderPool sync.Pool
   630	
   631	func newTextprotoReader(br *bufio.Reader) *textproto.Reader {
   632		if v := textprotoReaderPool.Get(); v != nil {
   633			tr := v.(*textproto.Reader)
   634			tr.R = br
   635			return tr
   636		}
   637		return textproto.NewReader(br)
   638	}
   639	
   640	func putTextprotoReader(r *textproto.Reader) {
   641		r.R = nil
   642		textprotoReaderPool.Put(r)
   643	}
   644	
   645	// ReadRequest reads and parses an incoming request from b.
   646	func ReadRequest(b *bufio.Reader) (req *Request, err error) {
   647	
   648		tp := newTextprotoReader(b)
   649		req = new(Request)
   650	
   651		// First line: GET /index.html HTTP/1.0
   652		var s string
   653		if s, err = tp.ReadLine(); err != nil {
   654			return nil, err
   655		}
   656		defer func() {
   657			putTextprotoReader(tp)
   658			if err == io.EOF {
   659				err = io.ErrUnexpectedEOF
   660			}
   661		}()
   662	
   663		var ok bool
   664		req.Method, req.RequestURI, req.Proto, ok = parseRequestLine(s)
   665		if !ok {
   666			return nil, &badStringError{"malformed HTTP request", s}
   667		}
   668		rawurl := req.RequestURI
   669		if req.ProtoMajor, req.ProtoMinor, ok = ParseHTTPVersion(req.Proto); !ok {
   670			return nil, &badStringError{"malformed HTTP version", req.Proto}
   671		}
   672	
   673		// CONNECT requests are used two different ways, and neither uses a full URL:
   674		// The standard use is to tunnel HTTPS through an HTTP proxy.
   675		// It looks like "CONNECT www.google.com:443 HTTP/1.1", and the parameter is
   676		// just the authority section of a URL. This information should go in req.URL.Host.
   677		//
   678		// The net/rpc package also uses CONNECT, but there the parameter is a path
   679		// that starts with a slash. It can be parsed with the regular URL parser,
   680		// and the path will end up in req.URL.Path, where it needs to be in order for
   681		// RPC to work.
   682		justAuthority := req.Method == "CONNECT" && !strings.HasPrefix(rawurl, "/")
   683		if justAuthority {
   684			rawurl = "http://" + rawurl
   685		}
   686	
   687		if req.URL, err = url.ParseRequestURI(rawurl); err != nil {
   688			return nil, err
   689		}
   690	
   691		if justAuthority {
   692			// Strip the bogus "http://" back off.
   693			req.URL.Scheme = ""
   694		}
   695	
   696		// Subsequent lines: Key: value.
   697		mimeHeader, err := tp.ReadMIMEHeader()
   698		if err != nil {
   699			return nil, err
   700		}
   701		req.Header = Header(mimeHeader)
   702	
   703		// RFC2616: Must treat
   704		//	GET /index.html HTTP/1.1
   705		//	Host: www.google.com
   706		// and
   707		//	GET http://www.google.com/index.html HTTP/1.1
   708		//	Host: doesntmatter
   709		// the same.  In the second case, any Host line is ignored.
   710		req.Host = req.URL.Host
   711		if req.Host == "" {
   712			req.Host = req.Header.get("Host")
   713		}
   714		delete(req.Header, "Host")
   715	
   716		fixPragmaCacheControl(req.Header)
   717	
   718		req.Close = shouldClose(req.ProtoMajor, req.ProtoMinor, req.Header, false)
   719	
   720		err = readTransfer(req, b)
   721		if err != nil {
   722			return nil, err
   723		}
   724	
   725		return req, nil
   726	}
   727	
   728	// MaxBytesReader is similar to io.LimitReader but is intended for
   729	// limiting the size of incoming request bodies. In contrast to
   730	// io.LimitReader, MaxBytesReader's result is a ReadCloser, returns a
   731	// non-EOF error for a Read beyond the limit, and closes the
   732	// underlying reader when its Close method is called.
   733	//
   734	// MaxBytesReader prevents clients from accidentally or maliciously
   735	// sending a large request and wasting server resources.
   736	func MaxBytesReader(w ResponseWriter, r io.ReadCloser, n int64) io.ReadCloser {
   737		return &maxBytesReader{w: w, r: r, n: n}
   738	}
   739	
   740	type maxBytesReader struct {
   741		w       ResponseWriter
   742		r       io.ReadCloser // underlying reader
   743		n       int64         // max bytes remaining
   744		stopped bool
   745		sawEOF  bool
   746	}
   747	
   748	func (l *maxBytesReader) tooLarge() (n int, err error) {
   749		if !l.stopped {
   750			l.stopped = true
   751			if res, ok := l.w.(*response); ok {
   752				res.requestTooLarge()
   753			}
   754		}
   755		return 0, errors.New("http: request body too large")
   756	}
   757	
   758	func (l *maxBytesReader) Read(p []byte) (n int, err error) {
   759		toRead := l.n
   760		if l.n == 0 {
   761			if l.sawEOF {
   762				return l.tooLarge()
   763			}
   764			// The underlying io.Reader may not return (0, io.EOF)
   765			// at EOF if the requested size is 0, so read 1 byte
   766			// instead. The io.Reader docs are a bit ambiguous
   767			// about the return value of Read when 0 bytes are
   768			// requested, and {bytes,strings}.Reader gets it wrong
   769			// too (it returns (0, nil) even at EOF).
   770			toRead = 1
   771		}
   772		if int64(len(p)) > toRead {
   773			p = p[:toRead]
   774		}
   775		n, err = l.r.Read(p)
   776		if err == io.EOF {
   777			l.sawEOF = true
   778		}
   779		if l.n == 0 {
   780			// If we had zero bytes to read remaining (but hadn't seen EOF)
   781			// and we get a byte here, that means we went over our limit.
   782			if n > 0 {
   783				return l.tooLarge()
   784			}
   785			return 0, err
   786		}
   787		l.n -= int64(n)
   788		if l.n < 0 {
   789			l.n = 0
   790		}
   791		return
   792	}
   793	
   794	func (l *maxBytesReader) Close() error {
   795		return l.r.Close()
   796	}
   797	
   798	func copyValues(dst, src url.Values) {
   799		for k, vs := range src {
   800			for _, value := range vs {
   801				dst.Add(k, value)
   802			}
   803		}
   804	}
   805	
   806	func parsePostForm(r *Request) (vs url.Values, err error) {
   807		if r.Body == nil {
   808			err = errors.New("missing form body")
   809			return
   810		}
   811		ct := r.Header.Get("Content-Type")
   812		// RFC 2616, section 7.2.1 - empty type
   813		//   SHOULD be treated as application/octet-stream
   814		if ct == "" {
   815			ct = "application/octet-stream"
   816		}
   817		ct, _, err = mime.ParseMediaType(ct)
   818		switch {
   819		case ct == "application/x-www-form-urlencoded":
   820			var reader io.Reader = r.Body
   821			maxFormSize := int64(1<<63 - 1)
   822			if _, ok := r.Body.(*maxBytesReader); !ok {
   823				maxFormSize = int64(10 << 20) // 10 MB is a lot of text.
   824				reader = io.LimitReader(r.Body, maxFormSize+1)
   825			}
   826			b, e := ioutil.ReadAll(reader)
   827			if e != nil {
   828				if err == nil {
   829					err = e
   830				}
   831				break
   832			}
   833			if int64(len(b)) > maxFormSize {
   834				err = errors.New("http: POST too large")
   835				return
   836			}
   837			vs, e = url.ParseQuery(string(b))
   838			if err == nil {
   839				err = e
   840			}
   841		case ct == "multipart/form-data":
   842			// handled by ParseMultipartForm (which is calling us, or should be)
   843			// TODO(bradfitz): there are too many possible
   844			// orders to call too many functions here.
   845			// Clean this up and write more tests.
   846			// request_test.go contains the start of this,
   847			// in TestParseMultipartFormOrder and others.
   848		}
   849		return
   850	}
   851	
   852	// ParseForm parses the raw query from the URL and updates r.Form.
   853	//
   854	// For POST or PUT requests, it also parses the request body as a form and
   855	// put the results into both r.PostForm and r.Form.
   856	// POST and PUT body parameters take precedence over URL query string values
   857	// in r.Form.
   858	//
   859	// If the request Body's size has not already been limited by MaxBytesReader,
   860	// the size is capped at 10MB.
   861	//
   862	// ParseMultipartForm calls ParseForm automatically.
   863	// It is idempotent.
   864	func (r *Request) ParseForm() error {
   865		var err error
   866		if r.PostForm == nil {
   867			if r.Method == "POST" || r.Method == "PUT" || r.Method == "PATCH" {
   868				r.PostForm, err = parsePostForm(r)
   869			}
   870			if r.PostForm == nil {
   871				r.PostForm = make(url.Values)
   872			}
   873		}
   874		if r.Form == nil {
   875			if len(r.PostForm) > 0 {
   876				r.Form = make(url.Values)
   877				copyValues(r.Form, r.PostForm)
   878			}
   879			var newValues url.Values
   880			if r.URL != nil {
   881				var e error
   882				newValues, e = url.ParseQuery(r.URL.RawQuery)
   883				if err == nil {
   884					err = e
   885				}
   886			}
   887			if newValues == nil {
   888				newValues = make(url.Values)
   889			}
   890			if r.Form == nil {
   891				r.Form = newValues
   892			} else {
   893				copyValues(r.Form, newValues)
   894			}
   895		}
   896		return err
   897	}
   898	
   899	// ParseMultipartForm parses a request body as multipart/form-data.
   900	// The whole request body is parsed and up to a total of maxMemory bytes of
   901	// its file parts are stored in memory, with the remainder stored on
   902	// disk in temporary files.
   903	// ParseMultipartForm calls ParseForm if necessary.
   904	// After one call to ParseMultipartForm, subsequent calls have no effect.
   905	func (r *Request) ParseMultipartForm(maxMemory int64) error {
   906		if r.MultipartForm == multipartByReader {
   907			return errors.New("http: multipart handled by MultipartReader")
   908		}
   909		if r.Form == nil {
   910			err := r.ParseForm()
   911			if err != nil {
   912				return err
   913			}
   914		}
   915		if r.MultipartForm != nil {
   916			return nil
   917		}
   918	
   919		mr, err := r.multipartReader()
   920		if err != nil {
   921			return err
   922		}
   923	
   924		f, err := mr.ReadForm(maxMemory)
   925		if err != nil {
   926			return err
   927		}
   928		for k, v := range f.Value {
   929			r.Form[k] = append(r.Form[k], v...)
   930		}
   931		r.MultipartForm = f
   932	
   933		return nil
   934	}
   935	
   936	// FormValue returns the first value for the named component of the query.
   937	// POST and PUT body parameters take precedence over URL query string values.
   938	// FormValue calls ParseMultipartForm and ParseForm if necessary and ignores
   939	// any errors returned by these functions.
   940	// If key is not present, FormValue returns the empty string.
   941	// To access multiple values of the same key, call ParseForm and
   942	// then inspect Request.Form directly.
   943	func (r *Request) FormValue(key string) string {
   944		if r.Form == nil {
   945			r.ParseMultipartForm(defaultMaxMemory)
   946		}
   947		if vs := r.Form[key]; len(vs) > 0 {
   948			return vs[0]
   949		}
   950		return ""
   951	}
   952	
   953	// PostFormValue returns the first value for the named component of the POST
   954	// or PUT request body. URL query parameters are ignored.
   955	// PostFormValue calls ParseMultipartForm and ParseForm if necessary and ignores
   956	// any errors returned by these functions.
   957	// If key is not present, PostFormValue returns the empty string.
   958	func (r *Request) PostFormValue(key string) string {
   959		if r.PostForm == nil {
   960			r.ParseMultipartForm(defaultMaxMemory)
   961		}
   962		if vs := r.PostForm[key]; len(vs) > 0 {
   963			return vs[0]
   964		}
   965		return ""
   966	}
   967	
   968	// FormFile returns the first file for the provided form key.
   969	// FormFile calls ParseMultipartForm and ParseForm if necessary.
   970	func (r *Request) FormFile(key string) (multipart.File, *multipart.FileHeader, error) {
   971		if r.MultipartForm == multipartByReader {
   972			return nil, nil, errors.New("http: multipart handled by MultipartReader")
   973		}
   974		if r.MultipartForm == nil {
   975			err := r.ParseMultipartForm(defaultMaxMemory)
   976			if err != nil {
   977				return nil, nil, err
   978			}
   979		}
   980		if r.MultipartForm != nil && r.MultipartForm.File != nil {
   981			if fhs := r.MultipartForm.File[key]; len(fhs) > 0 {
   982				f, err := fhs[0].Open()
   983				return f, fhs[0], err
   984			}
   985		}
   986		return nil, nil, ErrMissingFile
   987	}
   988	
   989	func (r *Request) expectsContinue() bool {
   990		return hasToken(r.Header.get("Expect"), "100-continue")
   991	}
   992	
   993	func (r *Request) wantsHttp10KeepAlive() bool {
   994		if r.ProtoMajor != 1 || r.ProtoMinor != 0 {
   995			return false
   996		}
   997		return hasToken(r.Header.get("Connection"), "keep-alive")
   998	}
   999	
  1000	func (r *Request) wantsClose() bool {
  1001		return hasToken(r.Header.get("Connection"), "close")
  1002	}
  1003	
  1004	func (r *Request) closeBody() {
  1005		if r.Body != nil {
  1006			r.Body.Close()
  1007		}
  1008	}
  1009	

View as plain text