code review 6868095: net/http, net/url: permit Request-URI "*"

net/http, net/url: permit Request-URI "*"

Also, implement a global OPTIONS * handler, like Apache.

Permit sending "*" requests to handlers, but not path-based
(ServeMux) handlers.  That means people can go out of their
way to support SSDP or SIP or whatever, but most users will be
unaffected.

See RFC 2616 Section 5.1.2 (Request-URI)
See RFC 2616 Section 9.2 (OPTIONS)

Fixes issue 3692

[bradfitz, 2012-12-10 19:48:08]

Hello rsc@golang.org, golang-dev@googlegroups.com (cc:
golang-dev@googlegroups.com),

I'd like you to review this change to
https://go.googlecode.com/hg/

[rsc, 2012-12-11 16:16:45]

https://codereview.appspot.com/6868095/diff/3001/src/pkg/net/http/server.go
File src/pkg/net/http/server.go (right):

https://codereview.appspot.com/6868095/diff/3001/src/pkg/net/http/server.go#n...
src/pkg/net/http/server.go:776: } else if _, ok := handler.(*ServeMux); ok {
Should let the ServeMux do this.
Someone might have wrapped it.
So I think this should be

if req.RequestURI == "*" && req.Method == "OPTIONS" {
    handler = globalOptionsHandler{}
}

and then put the other logic in the ServeMux.

[bradfitz, 2012-12-11 16:58:16]

Hello rsc@golang.org (cc: golang-dev@googlegroups.com),

Please take another look.

[bradfitz, 2012-12-11 16:58:44]

Done.

I also added some DoS-prevention I forgot about earlier, and also added a
new "GET *" test, to verify it returns 400.


On Tue, Dec 11, 2012 at 11:16 AM, <rsc@golang.org> wrote:

>
> https://codereview.appspot.**com/6868095/diff/3001/src/pkg/**
>
net/http/server.go<https://codereview.appspot.com/6868095/diff/3001/src/pkg/net/http/server.go>
> File src/pkg/net/http/server.go (right):
>
> https://codereview.appspot.**com/6868095/diff/3001/src/pkg/**
>
net/http/server.go#newcode776<https://codereview.appspot.com/6868095/diff/3001/src/pkg/net/http/server.go#newcode776>
> src/pkg/net/http/server.go:**776: } else if _, ok := handler.(*ServeMux);
> ok {
> Should let the ServeMux do this.
> Someone might have wrapped it.
> So I think this should be
>
> if req.RequestURI == "*" && req.Method == "OPTIONS" {
>     handler = globalOptionsHandler{}
> }
>
> and then put the other logic in the ServeMux.
>
>
https://codereview.appspot.**com/6868095/<https://codereview.appspot.com/6868...
>

[rsc, 2012-12-11 17:01:55]

LGTM

[bradfitz, 2012-12-11 17:07:32]

*** Submitted as https://code.google.com/p/go/source/detail?r=3d0bfd549c48 ***

net/http, net/url: permit Request-URI "*"

Also, implement a global OPTIONS * handler, like Apache.

Permit sending "*" requests to handlers, but not path-based
(ServeMux) handlers.  That means people can go out of their
way to support SSDP or SIP or whatever, but most users will be
unaffected.

See RFC 2616 Section 5.1.2 (Request-URI)
See RFC 2616 Section 9.2 (OPTIONS)

Fixes issue 3692

R=rsc
CC=golang-dev
https://codereview.appspot.com/6868095