Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

net/http: Redirect unresponding for URL containing Unicode #4385

Closed
gopherbot opened this issue Nov 14, 2012 · 19 comments
Closed

net/http: Redirect unresponding for URL containing Unicode #4385

gopherbot opened this issue Nov 14, 2012 · 19 comments
Labels
FrozenDueToAge help wanted NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. Suggested Issues that may be good for new contributors looking for work to do.
Milestone

Comments

@gopherbot
Copy link

by hip80763:

What steps will reproduce the problem?

for the http.redirect function
func Redirect(w ResponseWriter, r *Request, urlStr string, code int)

I confirmed that this works fine:
http.Redirect(w,r,"http://www.google.com/";,302)

But when the URL contain Unicode Characters, the redirect never works
e.g.
http.Redirect(w,r,"http://www.example.com/中文字/",302)

I tried this both locally and on GAE
@gopherbot
Copy link
Author

Comment 1 by hip80763:

a temporary way to solve this is to use url.QueryEscape to process the Unicode text
before including them to the URL

@minux
Copy link
Member

minux commented Nov 15, 2012

Comment 2:

what makes you think that it doesn't work?
or put it another way, what do you mean by "unresponding"?
please give some details and make sure to provide
a reproducible test case as small as possible.

Status changed to WaitingForReply.

@rsc
Copy link
Contributor

rsc commented Dec 9, 2012

Comment 3:

Still waiting for a reply. What web browser are you using?
It is likely we should escape UTF-8 bytes in the redirect header though.

Labels changed: added priority-later, removed priority-triage.

@rsc
Copy link
Contributor

rsc commented Dec 10, 2012

Comment 4:

Labels changed: added size-m.

@rsc
Copy link
Contributor

rsc commented Dec 10, 2012

Comment 5:

Labels changed: added suggested.

@gopherbot
Copy link
Author

Comment 6 by rick@boat-rockers.com:

I did some investigation on this issue:
https://groups.google.com/forum/?fromgroups=#!topic/golang-dev/Ml2QNDq9ElM
tl;dr - I couldn't reproduce it but escaping chars > 0x7F is required by the spec.
I can think of 3 options to fix this issue:
1) Handle encoding of the redirect Location header only
2) Automatically encode/decode all HTTP headers (to enforce the spec consistently)
3) Don't change code but document that users should make sure to encode/decode if
necessary
What is your preference?

@bradfitz
Copy link
Contributor

Comment 7:

Probably option 2).  Unless that breaks something, but I can't imagine what.
Automatically encoding (when writing) at least seems safe.  Decoding seems riskier, but
probably(?) also fine.

Status changed to Accepted.

@rsc
Copy link
Contributor

rsc commented Mar 12, 2013

Comment 8:

Labels changed: added go1.1maybe, removed go1.1.

@robpike
Copy link
Contributor

robpike commented May 18, 2013

Comment 9:

Labels changed: added go1.2maybe, removed go1.1maybe.

@rsc
Copy link
Contributor

rsc commented Sep 10, 2013

Comment 10:

Labels changed: added go1.3, removed go1.2maybe.

@rsc
Copy link
Contributor

rsc commented Dec 4, 2013

Comment 11:

Labels changed: added release-go1.3.

@rsc
Copy link
Contributor

rsc commented Dec 4, 2013

Comment 12:

Labels changed: removed go1.3.

@rsc
Copy link
Contributor

rsc commented Dec 4, 2013

Comment 13:

Labels changed: added repo-main.

@rsc
Copy link
Contributor

rsc commented May 9, 2014

Comment 14:

Labels changed: added release-none, removed release-go1.3.

@gopherbot gopherbot added accepted Suggested Issues that may be good for new contributors looking for work to do. labels May 9, 2014
@rsc rsc added this to the Unplanned milestone Apr 10, 2015
@harshavardhana
Copy link
Contributor

With the latest tip this seems to be working fine, unicode or not doesn't seem to be a problem anymore.

package main

import (
    "fmt"
    "log"
    "net/http"
)

func main() {
    http.HandleFunc("/中文字", func(w http.ResponseWriter, r *http.Request) {
        msg := fmt.Sprintf("Successful redirect. for method %s", r.Method)
        w.Write([]byte(msg))
    })
    http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
        http.Redirect(w, r, "http://localhost:8080/中文字", 302)
    })

    log.Fatal(http.ListenAndServe(":8080", nil))
}
 cat ~/bugs-golang/client.go
package main

import (
    "bytes"
    "fmt"
    "log"
    "net/http"
)

func main() {
    clnt := &http.Client{}

    req, err := http.NewRequest("GET", "http://localhost:8080/", nil)
    if err != nil {
        log.Fatalln(err)
    }

    resp, err := clnt.Do(req)
    if err != nil {
        log.Fatalln(err)
    }

    // Write response.
    var bufferGet bytes.Buffer
    resp.Write(&bufferGet)

    fmt.Println("--- GET RESPONSE ---")
    fmt.Println(string(bufferGet.Bytes()))
    fmt.Println("")
}

$ go run ~/bugs-golang/client.go
--- GET RESPONSE ---
HTTP/1.1 200 OK
Content-Length: 35
Content-Type: text/plain; charset=utf-8
Date: Mon, 18 Jan 2016 23:20:29 GMT

Successful redirect. for method GET

Will just add a test case to make sure that its validated all the time.

@gopherbot
Copy link
Author

CL https://golang.org/cl/18732 mentions this issue.

@bradfitz bradfitz modified the milestones: Go1.8, Unplanned May 11, 2016
@bradfitz bradfitz self-assigned this May 11, 2016
@bradfitz
Copy link
Contributor

I'm not sure https://golang.org/cl/18732 is correct. It seems like there should be some escaping happening. I don't think UTF-8 is allowed in headers.

Even if this "works" right now, it's just us testing our own misbehavior probably.

Any change needs to cite relevant parts of specs.

@harshavardhana
Copy link
Contributor

harshavardhana commented May 18, 2016

I'm not sure https://golang.org/cl/18732 is correct. It seems like there should be some escaping happening. I don't think UTF-8 is allowed in headers.

Even if this "works" right now, it's just us testing our own misbehavior probably.

Any change needs to cite relevant parts of specs.

You are right UTF-8 is not allowed.

The "Location" header field is used in some responses to refer to a
   specific resource in relation to the response.  The type of
   relationship is defined by the combination of request method and
   status code semantics.

     Location = URI-reference

From what i can read they should be escaped while doing a redirect since Location header is a URI. Not sure why it isn't happening though. Will see why this is not happening.

@bradfitz bradfitz added help wanted NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. labels Sep 26, 2016
@gopherbot
Copy link
Author

CL https://golang.org/cl/31732 mentions this issue.

@golang golang locked and limited conversation to collaborators Oct 21, 2017
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
FrozenDueToAge help wanted NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. Suggested Issues that may be good for new contributors looking for work to do.
Projects
None yet
Development

No branches or pull requests

6 participants