...
Run Format

Source file src/net/http/request.go

     1	// Copyright 2009 The Go Authors. All rights reserved.
     2	// Use of this source code is governed by a BSD-style
     3	// license that can be found in the LICENSE file.
     4	
     5	// HTTP Request reading and parsing.
     6	
     7	package http
     8	
     9	import (
    10		"bufio"
    11		"bytes"
    12		"crypto/tls"
    13		"encoding/base64"
    14		"errors"
    15		"fmt"
    16		"io"
    17		"io/ioutil"
    18		"mime"
    19		"mime/multipart"
    20		"net/textproto"
    21		"net/url"
    22		"strconv"
    23		"strings"
    24		"sync"
    25	)
    26	
    27	const (
    28		defaultMaxMemory = 32 << 20 // 32 MB
    29	)
    30	
    31	// ErrMissingFile is returned by FormFile when the provided file field name
    32	// is either not present in the request or not a file field.
    33	var ErrMissingFile = errors.New("http: no such file")
    34	
    35	// HTTP request parsing errors.
    36	type ProtocolError struct {
    37		ErrorString string
    38	}
    39	
    40	func (err *ProtocolError) Error() string { return err.ErrorString }
    41	
    42	var (
    43		ErrHeaderTooLong        = &ProtocolError{"header too long"}
    44		ErrShortBody            = &ProtocolError{"entity body too short"}
    45		ErrNotSupported         = &ProtocolError{"feature not supported"}
    46		ErrUnexpectedTrailer    = &ProtocolError{"trailer header without chunked transfer encoding"}
    47		ErrMissingContentLength = &ProtocolError{"missing ContentLength in HEAD response"}
    48		ErrNotMultipart         = &ProtocolError{"request Content-Type isn't multipart/form-data"}
    49		ErrMissingBoundary      = &ProtocolError{"no multipart boundary param in Content-Type"}
    50	)
    51	
    52	type badStringError struct {
    53		what string
    54		str  string
    55	}
    56	
    57	func (e *badStringError) Error() string { return fmt.Sprintf("%s %q", e.what, e.str) }
    58	
    59	// Headers that Request.Write handles itself and should be skipped.
    60	var reqWriteExcludeHeader = map[string]bool{
    61		"Host":              true, // not in Header map anyway
    62		"User-Agent":        true,
    63		"Content-Length":    true,
    64		"Transfer-Encoding": true,
    65		"Trailer":           true,
    66	}
    67	
    68	// A Request represents an HTTP request received by a server
    69	// or to be sent by a client.
    70	//
    71	// The field semantics differ slightly between client and server
    72	// usage. In addition to the notes on the fields below, see the
    73	// documentation for Request.Write and RoundTripper.
    74	type Request struct {
    75		// Method specifies the HTTP method (GET, POST, PUT, etc.).
    76		// For client requests an empty string means GET.
    77		Method string
    78	
    79		// URL specifies either the URI being requested (for server
    80		// requests) or the URL to access (for client requests).
    81		//
    82		// For server requests the URL is parsed from the URI
    83		// supplied on the Request-Line as stored in RequestURI.  For
    84		// most requests, fields other than Path and RawQuery will be
    85		// empty. (See RFC 2616, Section 5.1.2)
    86		//
    87		// For client requests, the URL's Host specifies the server to
    88		// connect to, while the Request's Host field optionally
    89		// specifies the Host header value to send in the HTTP
    90		// request.
    91		URL *url.URL
    92	
    93		// The protocol version for incoming server requests.
    94		//
    95		// For client requests these fields are ignored. The HTTP
    96		// client code always uses either HTTP/1.1 or HTTP/2.
    97		// See the docs on Transport for details.
    98		Proto      string // "HTTP/1.0"
    99		ProtoMajor int    // 1
   100		ProtoMinor int    // 0
   101	
   102		// Header contains the request header fields either received
   103		// by the server or to be sent by the client.
   104		//
   105		// If a server received a request with header lines,
   106		//
   107		//	Host: example.com
   108		//	accept-encoding: gzip, deflate
   109		//	Accept-Language: en-us
   110		//	fOO: Bar
   111		//	foo: two
   112		//
   113		// then
   114		//
   115		//	Header = map[string][]string{
   116		//		"Accept-Encoding": {"gzip, deflate"},
   117		//		"Accept-Language": {"en-us"},
   118		//		"Foo": {"Bar", "two"},
   119		//	}
   120		//
   121		// For incoming requests, the Host header is promoted to the
   122		// Request.Host field and removed from the Header map.
   123		//
   124		// HTTP defines that header names are case-insensitive. The
   125		// request parser implements this by using CanonicalHeaderKey,
   126		// making the first character and any characters following a
   127		// hyphen uppercase and the rest lowercase.
   128		//
   129		// For client requests, certain headers such as Content-Length
   130		// and Connection are automatically written when needed and
   131		// values in Header may be ignored. See the documentation
   132		// for the Request.Write method.
   133		Header Header
   134	
   135		// Body is the request's body.
   136		//
   137		// For client requests a nil body means the request has no
   138		// body, such as a GET request. The HTTP Client's Transport
   139		// is responsible for calling the Close method.
   140		//
   141		// For server requests the Request Body is always non-nil
   142		// but will return EOF immediately when no body is present.
   143		// The Server will close the request body. The ServeHTTP
   144		// Handler does not need to.
   145		Body io.ReadCloser
   146	
   147		// ContentLength records the length of the associated content.
   148		// The value -1 indicates that the length is unknown.
   149		// Values >= 0 indicate that the given number of bytes may
   150		// be read from Body.
   151		// For client requests, a value of 0 means unknown if Body is not nil.
   152		ContentLength int64
   153	
   154		// TransferEncoding lists the transfer encodings from outermost to
   155		// innermost. An empty list denotes the "identity" encoding.
   156		// TransferEncoding can usually be ignored; chunked encoding is
   157		// automatically added and removed as necessary when sending and
   158		// receiving requests.
   159		TransferEncoding []string
   160	
   161		// Close indicates whether to close the connection after
   162		// replying to this request (for servers) or after sending this
   163		// request and reading its response (for clients).
   164		//
   165		// For server requests, the HTTP server handles this automatically
   166		// and this field is not needed by Handlers.
   167		//
   168		// For client requests, setting this field prevents re-use of
   169		// TCP connections between requests to the same hosts, as if
   170		// Transport.DisableKeepAlives were set.
   171		Close bool
   172	
   173		// For server requests Host specifies the host on which the
   174		// URL is sought. Per RFC 2616, this is either the value of
   175		// the "Host" header or the host name given in the URL itself.
   176		// It may be of the form "host:port".
   177		//
   178		// For client requests Host optionally overrides the Host
   179		// header to send. If empty, the Request.Write method uses
   180		// the value of URL.Host.
   181		Host string
   182	
   183		// Form contains the parsed form data, including both the URL
   184		// field's query parameters and the POST or PUT form data.
   185		// This field is only available after ParseForm is called.
   186		// The HTTP client ignores Form and uses Body instead.
   187		Form url.Values
   188	
   189		// PostForm contains the parsed form data from POST, PATCH,
   190		// or PUT body parameters.
   191		//
   192		// This field is only available after ParseForm is called.
   193		// The HTTP client ignores PostForm and uses Body instead.
   194		PostForm url.Values
   195	
   196		// MultipartForm is the parsed multipart form, including file uploads.
   197		// This field is only available after ParseMultipartForm is called.
   198		// The HTTP client ignores MultipartForm and uses Body instead.
   199		MultipartForm *multipart.Form
   200	
   201		// Trailer specifies additional headers that are sent after the request
   202		// body.
   203		//
   204		// For server requests the Trailer map initially contains only the
   205		// trailer keys, with nil values. (The client declares which trailers it
   206		// will later send.)  While the handler is reading from Body, it must
   207		// not reference Trailer. After reading from Body returns EOF, Trailer
   208		// can be read again and will contain non-nil values, if they were sent
   209		// by the client.
   210		//
   211		// For client requests Trailer must be initialized to a map containing
   212		// the trailer keys to later send. The values may be nil or their final
   213		// values. The ContentLength must be 0 or -1, to send a chunked request.
   214		// After the HTTP request is sent the map values can be updated while
   215		// the request body is read. Once the body returns EOF, the caller must
   216		// not mutate Trailer.
   217		//
   218		// Few HTTP clients, servers, or proxies support HTTP trailers.
   219		Trailer Header
   220	
   221		// RemoteAddr allows HTTP servers and other software to record
   222		// the network address that sent the request, usually for
   223		// logging. This field is not filled in by ReadRequest and
   224		// has no defined format. The HTTP server in this package
   225		// sets RemoteAddr to an "IP:port" address before invoking a
   226		// handler.
   227		// This field is ignored by the HTTP client.
   228		RemoteAddr string
   229	
   230		// RequestURI is the unmodified Request-URI of the
   231		// Request-Line (RFC 2616, Section 5.1) as sent by the client
   232		// to a server. Usually the URL field should be used instead.
   233		// It is an error to set this field in an HTTP client request.
   234		RequestURI string
   235	
   236		// TLS allows HTTP servers and other software to record
   237		// information about the TLS connection on which the request
   238		// was received. This field is not filled in by ReadRequest.
   239		// The HTTP server in this package sets the field for
   240		// TLS-enabled connections before invoking a handler;
   241		// otherwise it leaves the field nil.
   242		// This field is ignored by the HTTP client.
   243		TLS *tls.ConnectionState
   244	
   245		// Cancel is an optional channel whose closure indicates that the client
   246		// request should be regarded as canceled. Not all implementations of
   247		// RoundTripper may support Cancel.
   248		//
   249		// For server requests, this field is not applicable.
   250		Cancel <-chan struct{}
   251	}
   252	
   253	// ProtoAtLeast reports whether the HTTP protocol used
   254	// in the request is at least major.minor.
   255	func (r *Request) ProtoAtLeast(major, minor int) bool {
   256		return r.ProtoMajor > major ||
   257			r.ProtoMajor == major && r.ProtoMinor >= minor
   258	}
   259	
   260	// UserAgent returns the client's User-Agent, if sent in the request.
   261	func (r *Request) UserAgent() string {
   262		return r.Header.Get("User-Agent")
   263	}
   264	
   265	// Cookies parses and returns the HTTP cookies sent with the request.
   266	func (r *Request) Cookies() []*Cookie {
   267		return readCookies(r.Header, "")
   268	}
   269	
   270	// ErrNoCookie is returned by Request's Cookie method when a cookie is not found.
   271	var ErrNoCookie = errors.New("http: named cookie not present")
   272	
   273	// Cookie returns the named cookie provided in the request or
   274	// ErrNoCookie if not found.
   275	func (r *Request) Cookie(name string) (*Cookie, error) {
   276		for _, c := range readCookies(r.Header, name) {
   277			return c, nil
   278		}
   279		return nil, ErrNoCookie
   280	}
   281	
   282	// AddCookie adds a cookie to the request.  Per RFC 6265 section 5.4,
   283	// AddCookie does not attach more than one Cookie header field.  That
   284	// means all cookies, if any, are written into the same line,
   285	// separated by semicolon.
   286	func (r *Request) AddCookie(c *Cookie) {
   287		s := fmt.Sprintf("%s=%s", sanitizeCookieName(c.Name), sanitizeCookieValue(c.Value))
   288		if c := r.Header.Get("Cookie"); c != "" {
   289			r.Header.Set("Cookie", c+"; "+s)
   290		} else {
   291			r.Header.Set("Cookie", s)
   292		}
   293	}
   294	
   295	// Referer returns the referring URL, if sent in the request.
   296	//
   297	// Referer is misspelled as in the request itself, a mistake from the
   298	// earliest days of HTTP.  This value can also be fetched from the
   299	// Header map as Header["Referer"]; the benefit of making it available
   300	// as a method is that the compiler can diagnose programs that use the
   301	// alternate (correct English) spelling req.Referrer() but cannot
   302	// diagnose programs that use Header["Referrer"].
   303	func (r *Request) Referer() string {
   304		return r.Header.Get("Referer")
   305	}
   306	
   307	// multipartByReader is a sentinel value.
   308	// Its presence in Request.MultipartForm indicates that parsing of the request
   309	// body has been handed off to a MultipartReader instead of ParseMultipartFrom.
   310	var multipartByReader = &multipart.Form{
   311		Value: make(map[string][]string),
   312		File:  make(map[string][]*multipart.FileHeader),
   313	}
   314	
   315	// MultipartReader returns a MIME multipart reader if this is a
   316	// multipart/form-data POST request, else returns nil and an error.
   317	// Use this function instead of ParseMultipartForm to
   318	// process the request body as a stream.
   319	func (r *Request) MultipartReader() (*multipart.Reader, error) {
   320		if r.MultipartForm == multipartByReader {
   321			return nil, errors.New("http: MultipartReader called twice")
   322		}
   323		if r.MultipartForm != nil {
   324			return nil, errors.New("http: multipart handled by ParseMultipartForm")
   325		}
   326		r.MultipartForm = multipartByReader
   327		return r.multipartReader()
   328	}
   329	
   330	func (r *Request) multipartReader() (*multipart.Reader, error) {
   331		v := r.Header.Get("Content-Type")
   332		if v == "" {
   333			return nil, ErrNotMultipart
   334		}
   335		d, params, err := mime.ParseMediaType(v)
   336		if err != nil || d != "multipart/form-data" {
   337			return nil, ErrNotMultipart
   338		}
   339		boundary, ok := params["boundary"]
   340		if !ok {
   341			return nil, ErrMissingBoundary
   342		}
   343		return multipart.NewReader(r.Body, boundary), nil
   344	}
   345	
   346	// Return value if nonempty, def otherwise.
   347	func valueOrDefault(value, def string) string {
   348		if value != "" {
   349			return value
   350		}
   351		return def
   352	}
   353	
   354	// NOTE: This is not intended to reflect the actual Go version being used.
   355	// It was changed at the time of Go 1.1 release because the former User-Agent
   356	// had ended up on a blacklist for some intrusion detection systems.
   357	// See https://codereview.appspot.com/7532043.
   358	const defaultUserAgent = "Go-http-client/1.1"
   359	
   360	// Write writes an HTTP/1.1 request, which is the header and body, in wire format.
   361	// This method consults the following fields of the request:
   362	//	Host
   363	//	URL
   364	//	Method (defaults to "GET")
   365	//	Header
   366	//	ContentLength
   367	//	TransferEncoding
   368	//	Body
   369	//
   370	// If Body is present, Content-Length is <= 0 and TransferEncoding
   371	// hasn't been set to "identity", Write adds "Transfer-Encoding:
   372	// chunked" to the header. Body is closed after it is sent.
   373	func (r *Request) Write(w io.Writer) error {
   374		return r.write(w, false, nil, nil)
   375	}
   376	
   377	// WriteProxy is like Write but writes the request in the form
   378	// expected by an HTTP proxy.  In particular, WriteProxy writes the
   379	// initial Request-URI line of the request with an absolute URI, per
   380	// section 5.1.2 of RFC 2616, including the scheme and host.
   381	// In either case, WriteProxy also writes a Host header, using
   382	// either r.Host or r.URL.Host.
   383	func (r *Request) WriteProxy(w io.Writer) error {
   384		return r.write(w, true, nil, nil)
   385	}
   386	
   387	// errMissingHost is returned by Write when there is no Host or URL present in
   388	// the Request.
   389	var errMissingHost = errors.New("http: Request.Write on Request with no Host or URL set")
   390	
   391	// extraHeaders may be nil
   392	// waitForContinue may be nil
   393	func (req *Request) write(w io.Writer, usingProxy bool, extraHeaders Header, waitForContinue func() bool) error {
   394		// Find the target host. Prefer the Host: header, but if that
   395		// is not given, use the host from the request URL.
   396		//
   397		// Clean the host, in case it arrives with unexpected stuff in it.
   398		host := cleanHost(req.Host)
   399		if host == "" {
   400			if req.URL == nil {
   401				return errMissingHost
   402			}
   403			host = cleanHost(req.URL.Host)
   404		}
   405	
   406		// According to RFC 6874, an HTTP client, proxy, or other
   407		// intermediary must remove any IPv6 zone identifier attached
   408		// to an outgoing URI.
   409		host = removeZone(host)
   410	
   411		ruri := req.URL.RequestURI()
   412		if usingProxy && req.URL.Scheme != "" && req.URL.Opaque == "" {
   413			ruri = req.URL.Scheme + "://" + host + ruri
   414		} else if req.Method == "CONNECT" && req.URL.Path == "" {
   415			// CONNECT requests normally give just the host and port, not a full URL.
   416			ruri = host
   417		}
   418		// TODO(bradfitz): escape at least newlines in ruri?
   419	
   420		// Wrap the writer in a bufio Writer if it's not already buffered.
   421		// Don't always call NewWriter, as that forces a bytes.Buffer
   422		// and other small bufio Writers to have a minimum 4k buffer
   423		// size.
   424		var bw *bufio.Writer
   425		if _, ok := w.(io.ByteWriter); !ok {
   426			bw = bufio.NewWriter(w)
   427			w = bw
   428		}
   429	
   430		_, err := fmt.Fprintf(w, "%s %s HTTP/1.1\r\n", valueOrDefault(req.Method, "GET"), ruri)
   431		if err != nil {
   432			return err
   433		}
   434	
   435		// Header lines
   436		_, err = fmt.Fprintf(w, "Host: %s\r\n", host)
   437		if err != nil {
   438			return err
   439		}
   440	
   441		// Use the defaultUserAgent unless the Header contains one, which
   442		// may be blank to not send the header.
   443		userAgent := defaultUserAgent
   444		if _, ok := req.Header["User-Agent"]; ok {
   445			userAgent = req.Header.Get("User-Agent")
   446		}
   447		if userAgent != "" {
   448			_, err = fmt.Fprintf(w, "User-Agent: %s\r\n", userAgent)
   449			if err != nil {
   450				return err
   451			}
   452		}
   453	
   454		// Process Body,ContentLength,Close,Trailer
   455		tw, err := newTransferWriter(req)
   456		if err != nil {
   457			return err
   458		}
   459		err = tw.WriteHeader(w)
   460		if err != nil {
   461			return err
   462		}
   463	
   464		err = req.Header.WriteSubset(w, reqWriteExcludeHeader)
   465		if err != nil {
   466			return err
   467		}
   468	
   469		if extraHeaders != nil {
   470			err = extraHeaders.Write(w)
   471			if err != nil {
   472				return err
   473			}
   474		}
   475	
   476		_, err = io.WriteString(w, "\r\n")
   477		if err != nil {
   478			return err
   479		}
   480	
   481		// Flush and wait for 100-continue if expected.
   482		if waitForContinue != nil {
   483			if bw, ok := w.(*bufio.Writer); ok {
   484				err = bw.Flush()
   485				if err != nil {
   486					return err
   487				}
   488			}
   489	
   490			if !waitForContinue() {
   491				req.closeBody()
   492				return nil
   493			}
   494		}
   495	
   496		// Write body and trailer
   497		err = tw.WriteBody(w)
   498		if err != nil {
   499			return err
   500		}
   501	
   502		if bw != nil {
   503			return bw.Flush()
   504		}
   505		return nil
   506	}
   507	
   508	// cleanHost strips anything after '/' or ' '.
   509	// Ideally we'd clean the Host header according to the spec:
   510	//   https://tools.ietf.org/html/rfc7230#section-5.4 (Host = uri-host [ ":" port ]")
   511	//   https://tools.ietf.org/html/rfc7230#section-2.7 (uri-host -> rfc3986's host)
   512	//   https://tools.ietf.org/html/rfc3986#section-3.2.2 (definition of host)
   513	// But practically, what we are trying to avoid is the situation in
   514	// issue 11206, where a malformed Host header used in the proxy context
   515	// would create a bad request. So it is enough to just truncate at the
   516	// first offending character.
   517	func cleanHost(in string) string {
   518		if i := strings.IndexAny(in, " /"); i != -1 {
   519			return in[:i]
   520		}
   521		return in
   522	}
   523	
   524	// removeZone removes IPv6 zone identifer from host.
   525	// E.g., "[fe80::1%en0]:8080" to "[fe80::1]:8080"
   526	func removeZone(host string) string {
   527		if !strings.HasPrefix(host, "[") {
   528			return host
   529		}
   530		i := strings.LastIndex(host, "]")
   531		if i < 0 {
   532			return host
   533		}
   534		j := strings.LastIndex(host[:i], "%")
   535		if j < 0 {
   536			return host
   537		}
   538		return host[:j] + host[i:]
   539	}
   540	
   541	// ParseHTTPVersion parses a HTTP version string.
   542	// "HTTP/1.0" returns (1, 0, true).
   543	func ParseHTTPVersion(vers string) (major, minor int, ok bool) {
   544		const Big = 1000000 // arbitrary upper bound
   545		switch vers {
   546		case "HTTP/1.1":
   547			return 1, 1, true
   548		case "HTTP/1.0":
   549			return 1, 0, true
   550		}
   551		if !strings.HasPrefix(vers, "HTTP/") {
   552			return 0, 0, false
   553		}
   554		dot := strings.Index(vers, ".")
   555		if dot < 0 {
   556			return 0, 0, false
   557		}
   558		major, err := strconv.Atoi(vers[5:dot])
   559		if err != nil || major < 0 || major > Big {
   560			return 0, 0, false
   561		}
   562		minor, err = strconv.Atoi(vers[dot+1:])
   563		if err != nil || minor < 0 || minor > Big {
   564			return 0, 0, false
   565		}
   566		return major, minor, true
   567	}
   568	
   569	func validMethod(method string) bool {
   570		/*
   571		     Method         = "OPTIONS"                ; Section 9.2
   572		                    | "GET"                    ; Section 9.3
   573		                    | "HEAD"                   ; Section 9.4
   574		                    | "POST"                   ; Section 9.5
   575		                    | "PUT"                    ; Section 9.6
   576		                    | "DELETE"                 ; Section 9.7
   577		                    | "TRACE"                  ; Section 9.8
   578		                    | "CONNECT"                ; Section 9.9
   579		                    | extension-method
   580		   extension-method = token
   581		     token          = 1*<any CHAR except CTLs or separators>
   582		*/
   583		return len(method) > 0 && strings.IndexFunc(method, isNotToken) == -1
   584	}
   585	
   586	// NewRequest returns a new Request given a method, URL, and optional body.
   587	//
   588	// If the provided body is also an io.Closer, the returned
   589	// Request.Body is set to body and will be closed by the Client
   590	// methods Do, Post, and PostForm, and Transport.RoundTrip.
   591	//
   592	// NewRequest returns a Request suitable for use with Client.Do or
   593	// Transport.RoundTrip.
   594	// To create a request for use with testing a Server Handler use either
   595	// ReadRequest or manually update the Request fields. See the Request
   596	// type's documentation for the difference between inbound and outbound
   597	// request fields.
   598	func NewRequest(method, urlStr string, body io.Reader) (*Request, error) {
   599		if method == "" {
   600			// We document that "" means "GET" for Request.Method, and people have
   601			// relied on that from NewRequest, so keep that working.
   602			// We still enforce validMethod for non-empty methods.
   603			method = "GET"
   604		}
   605		if !validMethod(method) {
   606			return nil, fmt.Errorf("net/http: invalid method %q", method)
   607		}
   608		u, err := url.Parse(urlStr)
   609		if err != nil {
   610			return nil, err
   611		}
   612		rc, ok := body.(io.ReadCloser)
   613		if !ok && body != nil {
   614			rc = ioutil.NopCloser(body)
   615		}
   616		req := &Request{
   617			Method:     method,
   618			URL:        u,
   619			Proto:      "HTTP/1.1",
   620			ProtoMajor: 1,
   621			ProtoMinor: 1,
   622			Header:     make(Header),
   623			Body:       rc,
   624			Host:       u.Host,
   625		}
   626		if body != nil {
   627			switch v := body.(type) {
   628			case *bytes.Buffer:
   629				req.ContentLength = int64(v.Len())
   630			case *bytes.Reader:
   631				req.ContentLength = int64(v.Len())
   632			case *strings.Reader:
   633				req.ContentLength = int64(v.Len())
   634			}
   635		}
   636	
   637		return req, nil
   638	}
   639	
   640	// BasicAuth returns the username and password provided in the request's
   641	// Authorization header, if the request uses HTTP Basic Authentication.
   642	// See RFC 2617, Section 2.
   643	func (r *Request) BasicAuth() (username, password string, ok bool) {
   644		auth := r.Header.Get("Authorization")
   645		if auth == "" {
   646			return
   647		}
   648		return parseBasicAuth(auth)
   649	}
   650	
   651	// parseBasicAuth parses an HTTP Basic Authentication string.
   652	// "Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==" returns ("Aladdin", "open sesame", true).
   653	func parseBasicAuth(auth string) (username, password string, ok bool) {
   654		const prefix = "Basic "
   655		if !strings.HasPrefix(auth, prefix) {
   656			return
   657		}
   658		c, err := base64.StdEncoding.DecodeString(auth[len(prefix):])
   659		if err != nil {
   660			return
   661		}
   662		cs := string(c)
   663		s := strings.IndexByte(cs, ':')
   664		if s < 0 {
   665			return
   666		}
   667		return cs[:s], cs[s+1:], true
   668	}
   669	
   670	// SetBasicAuth sets the request's Authorization header to use HTTP
   671	// Basic Authentication with the provided username and password.
   672	//
   673	// With HTTP Basic Authentication the provided username and password
   674	// are not encrypted.
   675	func (r *Request) SetBasicAuth(username, password string) {
   676		r.Header.Set("Authorization", "Basic "+basicAuth(username, password))
   677	}
   678	
   679	// parseRequestLine parses "GET /foo HTTP/1.1" into its three parts.
   680	func parseRequestLine(line string) (method, requestURI, proto string, ok bool) {
   681		s1 := strings.Index(line, " ")
   682		s2 := strings.Index(line[s1+1:], " ")
   683		if s1 < 0 || s2 < 0 {
   684			return
   685		}
   686		s2 += s1 + 1
   687		return line[:s1], line[s1+1 : s2], line[s2+1:], true
   688	}
   689	
   690	var textprotoReaderPool sync.Pool
   691	
   692	func newTextprotoReader(br *bufio.Reader) *textproto.Reader {
   693		if v := textprotoReaderPool.Get(); v != nil {
   694			tr := v.(*textproto.Reader)
   695			tr.R = br
   696			return tr
   697		}
   698		return textproto.NewReader(br)
   699	}
   700	
   701	func putTextprotoReader(r *textproto.Reader) {
   702		r.R = nil
   703		textprotoReaderPool.Put(r)
   704	}
   705	
   706	// ReadRequest reads and parses an incoming request from b.
   707	func ReadRequest(b *bufio.Reader) (req *Request, err error) { return readRequest(b, deleteHostHeader) }
   708	
   709	// Constants for readRequest's deleteHostHeader parameter.
   710	const (
   711		deleteHostHeader = true
   712		keepHostHeader   = false
   713	)
   714	
   715	func readRequest(b *bufio.Reader, deleteHostHeader bool) (req *Request, err error) {
   716		tp := newTextprotoReader(b)
   717		req = new(Request)
   718	
   719		// First line: GET /index.html HTTP/1.0
   720		var s string
   721		if s, err = tp.ReadLine(); err != nil {
   722			return nil, err
   723		}
   724		defer func() {
   725			putTextprotoReader(tp)
   726			if err == io.EOF {
   727				err = io.ErrUnexpectedEOF
   728			}
   729		}()
   730	
   731		var ok bool
   732		req.Method, req.RequestURI, req.Proto, ok = parseRequestLine(s)
   733		if !ok {
   734			return nil, &badStringError{"malformed HTTP request", s}
   735		}
   736		rawurl := req.RequestURI
   737		if req.ProtoMajor, req.ProtoMinor, ok = ParseHTTPVersion(req.Proto); !ok {
   738			return nil, &badStringError{"malformed HTTP version", req.Proto}
   739		}
   740	
   741		// CONNECT requests are used two different ways, and neither uses a full URL:
   742		// The standard use is to tunnel HTTPS through an HTTP proxy.
   743		// It looks like "CONNECT www.google.com:443 HTTP/1.1", and the parameter is
   744		// just the authority section of a URL. This information should go in req.URL.Host.
   745		//
   746		// The net/rpc package also uses CONNECT, but there the parameter is a path
   747		// that starts with a slash. It can be parsed with the regular URL parser,
   748		// and the path will end up in req.URL.Path, where it needs to be in order for
   749		// RPC to work.
   750		justAuthority := req.Method == "CONNECT" && !strings.HasPrefix(rawurl, "/")
   751		if justAuthority {
   752			rawurl = "http://" + rawurl
   753		}
   754	
   755		if req.URL, err = url.ParseRequestURI(rawurl); err != nil {
   756			return nil, err
   757		}
   758	
   759		if justAuthority {
   760			// Strip the bogus "http://" back off.
   761			req.URL.Scheme = ""
   762		}
   763	
   764		// Subsequent lines: Key: value.
   765		mimeHeader, err := tp.ReadMIMEHeader()
   766		if err != nil {
   767			return nil, err
   768		}
   769		req.Header = Header(mimeHeader)
   770	
   771		// RFC2616: Must treat
   772		//	GET /index.html HTTP/1.1
   773		//	Host: www.google.com
   774		// and
   775		//	GET http://www.google.com/index.html HTTP/1.1
   776		//	Host: doesntmatter
   777		// the same.  In the second case, any Host line is ignored.
   778		req.Host = req.URL.Host
   779		if req.Host == "" {
   780			req.Host = req.Header.get("Host")
   781		}
   782		if deleteHostHeader {
   783			delete(req.Header, "Host")
   784		}
   785	
   786		fixPragmaCacheControl(req.Header)
   787	
   788		req.Close = shouldClose(req.ProtoMajor, req.ProtoMinor, req.Header, false)
   789	
   790		err = readTransfer(req, b)
   791		if err != nil {
   792			return nil, err
   793		}
   794	
   795		return req, nil
   796	}
   797	
   798	// MaxBytesReader is similar to io.LimitReader but is intended for
   799	// limiting the size of incoming request bodies. In contrast to
   800	// io.LimitReader, MaxBytesReader's result is a ReadCloser, returns a
   801	// non-EOF error for a Read beyond the limit, and closes the
   802	// underlying reader when its Close method is called.
   803	//
   804	// MaxBytesReader prevents clients from accidentally or maliciously
   805	// sending a large request and wasting server resources.
   806	func MaxBytesReader(w ResponseWriter, r io.ReadCloser, n int64) io.ReadCloser {
   807		return &maxBytesReader{w: w, r: r, n: n}
   808	}
   809	
   810	type maxBytesReader struct {
   811		w       ResponseWriter
   812		r       io.ReadCloser // underlying reader
   813		n       int64         // max bytes remaining
   814		stopped bool
   815		sawEOF  bool
   816	}
   817	
   818	func (l *maxBytesReader) tooLarge() (n int, err error) {
   819		if !l.stopped {
   820			l.stopped = true
   821			if res, ok := l.w.(*response); ok {
   822				res.requestTooLarge()
   823			}
   824		}
   825		return 0, errors.New("http: request body too large")
   826	}
   827	
   828	func (l *maxBytesReader) Read(p []byte) (n int, err error) {
   829		toRead := l.n
   830		if l.n == 0 {
   831			if l.sawEOF {
   832				return l.tooLarge()
   833			}
   834			// The underlying io.Reader may not return (0, io.EOF)
   835			// at EOF if the requested size is 0, so read 1 byte
   836			// instead. The io.Reader docs are a bit ambiguous
   837			// about the return value of Read when 0 bytes are
   838			// requested, and {bytes,strings}.Reader gets it wrong
   839			// too (it returns (0, nil) even at EOF).
   840			toRead = 1
   841		}
   842		if int64(len(p)) > toRead {
   843			p = p[:toRead]
   844		}
   845		n, err = l.r.Read(p)
   846		if err == io.EOF {
   847			l.sawEOF = true
   848		}
   849		if l.n == 0 {
   850			// If we had zero bytes to read remaining (but hadn't seen EOF)
   851			// and we get a byte here, that means we went over our limit.
   852			if n > 0 {
   853				return l.tooLarge()
   854			}
   855			return 0, err
   856		}
   857		l.n -= int64(n)
   858		if l.n < 0 {
   859			l.n = 0
   860		}
   861		return
   862	}
   863	
   864	func (l *maxBytesReader) Close() error {
   865		return l.r.Close()
   866	}
   867	
   868	func copyValues(dst, src url.Values) {
   869		for k, vs := range src {
   870			for _, value := range vs {
   871				dst.Add(k, value)
   872			}
   873		}
   874	}
   875	
   876	func parsePostForm(r *Request) (vs url.Values, err error) {
   877		if r.Body == nil {
   878			err = errors.New("missing form body")
   879			return
   880		}
   881		ct := r.Header.Get("Content-Type")
   882		// RFC 2616, section 7.2.1 - empty type
   883		//   SHOULD be treated as application/octet-stream
   884		if ct == "" {
   885			ct = "application/octet-stream"
   886		}
   887		ct, _, err = mime.ParseMediaType(ct)
   888		switch {
   889		case ct == "application/x-www-form-urlencoded":
   890			var reader io.Reader = r.Body
   891			maxFormSize := int64(1<<63 - 1)
   892			if _, ok := r.Body.(*maxBytesReader); !ok {
   893				maxFormSize = int64(10 << 20) // 10 MB is a lot of text.
   894				reader = io.LimitReader(r.Body, maxFormSize+1)
   895			}
   896			b, e := ioutil.ReadAll(reader)
   897			if e != nil {
   898				if err == nil {
   899					err = e
   900				}
   901				break
   902			}
   903			if int64(len(b)) > maxFormSize {
   904				err = errors.New("http: POST too large")
   905				return
   906			}
   907			vs, e = url.ParseQuery(string(b))
   908			if err == nil {
   909				err = e
   910			}
   911		case ct == "multipart/form-data":
   912			// handled by ParseMultipartForm (which is calling us, or should be)
   913			// TODO(bradfitz): there are too many possible
   914			// orders to call too many functions here.
   915			// Clean this up and write more tests.
   916			// request_test.go contains the start of this,
   917			// in TestParseMultipartFormOrder and others.
   918		}
   919		return
   920	}
   921	
   922	// ParseForm parses the raw query from the URL and updates r.Form.
   923	//
   924	// For POST or PUT requests, it also parses the request body as a form and
   925	// put the results into both r.PostForm and r.Form.
   926	// POST and PUT body parameters take precedence over URL query string values
   927	// in r.Form.
   928	//
   929	// If the request Body's size has not already been limited by MaxBytesReader,
   930	// the size is capped at 10MB.
   931	//
   932	// ParseMultipartForm calls ParseForm automatically.
   933	// It is idempotent.
   934	func (r *Request) ParseForm() error {
   935		var err error
   936		if r.PostForm == nil {
   937			if r.Method == "POST" || r.Method == "PUT" || r.Method == "PATCH" {
   938				r.PostForm, err = parsePostForm(r)
   939			}
   940			if r.PostForm == nil {
   941				r.PostForm = make(url.Values)
   942			}
   943		}
   944		if r.Form == nil {
   945			if len(r.PostForm) > 0 {
   946				r.Form = make(url.Values)
   947				copyValues(r.Form, r.PostForm)
   948			}
   949			var newValues url.Values
   950			if r.URL != nil {
   951				var e error
   952				newValues, e = url.ParseQuery(r.URL.RawQuery)
   953				if err == nil {
   954					err = e
   955				}
   956			}
   957			if newValues == nil {
   958				newValues = make(url.Values)
   959			}
   960			if r.Form == nil {
   961				r.Form = newValues
   962			} else {
   963				copyValues(r.Form, newValues)
   964			}
   965		}
   966		return err
   967	}
   968	
   969	// ParseMultipartForm parses a request body as multipart/form-data.
   970	// The whole request body is parsed and up to a total of maxMemory bytes of
   971	// its file parts are stored in memory, with the remainder stored on
   972	// disk in temporary files.
   973	// ParseMultipartForm calls ParseForm if necessary.
   974	// After one call to ParseMultipartForm, subsequent calls have no effect.
   975	func (r *Request) ParseMultipartForm(maxMemory int64) error {
   976		if r.MultipartForm == multipartByReader {
   977			return errors.New("http: multipart handled by MultipartReader")
   978		}
   979		if r.Form == nil {
   980			err := r.ParseForm()
   981			if err != nil {
   982				return err
   983			}
   984		}
   985		if r.MultipartForm != nil {
   986			return nil
   987		}
   988	
   989		mr, err := r.multipartReader()
   990		if err != nil {
   991			return err
   992		}
   993	
   994		f, err := mr.ReadForm(maxMemory)
   995		if err != nil {
   996			return err
   997		}
   998		for k, v := range f.Value {
   999			r.Form[k] = append(r.Form[k], v...)
  1000		}
  1001		r.MultipartForm = f
  1002	
  1003		return nil
  1004	}
  1005	
  1006	// FormValue returns the first value for the named component of the query.
  1007	// POST and PUT body parameters take precedence over URL query string values.
  1008	// FormValue calls ParseMultipartForm and ParseForm if necessary and ignores
  1009	// any errors returned by these functions.
  1010	// If key is not present, FormValue returns the empty string.
  1011	// To access multiple values of the same key, call ParseForm and
  1012	// then inspect Request.Form directly.
  1013	func (r *Request) FormValue(key string) string {
  1014		if r.Form == nil {
  1015			r.ParseMultipartForm(defaultMaxMemory)
  1016		}
  1017		if vs := r.Form[key]; len(vs) > 0 {
  1018			return vs[0]
  1019		}
  1020		return ""
  1021	}
  1022	
  1023	// PostFormValue returns the first value for the named component of the POST
  1024	// or PUT request body. URL query parameters are ignored.
  1025	// PostFormValue calls ParseMultipartForm and ParseForm if necessary and ignores
  1026	// any errors returned by these functions.
  1027	// If key is not present, PostFormValue returns the empty string.
  1028	func (r *Request) PostFormValue(key string) string {
  1029		if r.PostForm == nil {
  1030			r.ParseMultipartForm(defaultMaxMemory)
  1031		}
  1032		if vs := r.PostForm[key]; len(vs) > 0 {
  1033			return vs[0]
  1034		}
  1035		return ""
  1036	}
  1037	
  1038	// FormFile returns the first file for the provided form key.
  1039	// FormFile calls ParseMultipartForm and ParseForm if necessary.
  1040	func (r *Request) FormFile(key string) (multipart.File, *multipart.FileHeader, error) {
  1041		if r.MultipartForm == multipartByReader {
  1042			return nil, nil, errors.New("http: multipart handled by MultipartReader")
  1043		}
  1044		if r.MultipartForm == nil {
  1045			err := r.ParseMultipartForm(defaultMaxMemory)
  1046			if err != nil {
  1047				return nil, nil, err
  1048			}
  1049		}
  1050		if r.MultipartForm != nil && r.MultipartForm.File != nil {
  1051			if fhs := r.MultipartForm.File[key]; len(fhs) > 0 {
  1052				f, err := fhs[0].Open()
  1053				return f, fhs[0], err
  1054			}
  1055		}
  1056		return nil, nil, ErrMissingFile
  1057	}
  1058	
  1059	func (r *Request) expectsContinue() bool {
  1060		return hasToken(r.Header.get("Expect"), "100-continue")
  1061	}
  1062	
  1063	func (r *Request) wantsHttp10KeepAlive() bool {
  1064		if r.ProtoMajor != 1 || r.ProtoMinor != 0 {
  1065			return false
  1066		}
  1067		return hasToken(r.Header.get("Connection"), "keep-alive")
  1068	}
  1069	
  1070	func (r *Request) wantsClose() bool {
  1071		return hasToken(r.Header.get("Connection"), "close")
  1072	}
  1073	
  1074	func (r *Request) closeBody() {
  1075		if r.Body != nil {
  1076			r.Body.Close()
  1077		}
  1078	}
  1079	
  1080	func (r *Request) isReplayable() bool {
  1081		if r.Body == nil {
  1082			switch valueOrDefault(r.Method, "GET") {
  1083			case "GET", "HEAD", "OPTIONS", "TRACE":
  1084				return true
  1085			}
  1086		}
  1087		return false
  1088	}
  1089	
  1090	func validHostHeader(h string) bool {
  1091		// The latests spec is actually this:
  1092		//
  1093		// http://tools.ietf.org/html/rfc7230#section-5.4
  1094		//     Host = uri-host [ ":" port ]
  1095		//
  1096		// Where uri-host is:
  1097		//     http://tools.ietf.org/html/rfc3986#section-3.2.2
  1098		//
  1099		// But we're going to be much more lenient for now and just
  1100		// search for any byte that's not a valid byte in any of those
  1101		// expressions.
  1102		for i := 0; i < len(h); i++ {
  1103			if !validHostByte[h[i]] {
  1104				return false
  1105			}
  1106		}
  1107		return true
  1108	}
  1109	
  1110	// See the validHostHeader comment.
  1111	var validHostByte = [256]bool{
  1112		'0': true, '1': true, '2': true, '3': true, '4': true, '5': true, '6': true, '7': true,
  1113		'8': true, '9': true,
  1114	
  1115		'a': true, 'b': true, 'c': true, 'd': true, 'e': true, 'f': true, 'g': true, 'h': true,
  1116		'i': true, 'j': true, 'k': true, 'l': true, 'm': true, 'n': true, 'o': true, 'p': true,
  1117		'q': true, 'r': true, 's': true, 't': true, 'u': true, 'v': true, 'w': true, 'x': true,
  1118		'y': true, 'z': true,
  1119	
  1120		'A': true, 'B': true, 'C': true, 'D': true, 'E': true, 'F': true, 'G': true, 'H': true,
  1121		'I': true, 'J': true, 'K': true, 'L': true, 'M': true, 'N': true, 'O': true, 'P': true,
  1122		'Q': true, 'R': true, 'S': true, 'T': true, 'U': true, 'V': true, 'W': true, 'X': true,
  1123		'Y': true, 'Z': true,
  1124	
  1125		'!':  true, // sub-delims
  1126		'$':  true, // sub-delims
  1127		'%':  true, // pct-encoded (and used in IPv6 zones)
  1128		'&':  true, // sub-delims
  1129		'(':  true, // sub-delims
  1130		')':  true, // sub-delims
  1131		'*':  true, // sub-delims
  1132		'+':  true, // sub-delims
  1133		',':  true, // sub-delims
  1134		'-':  true, // unreserved
  1135		'.':  true, // unreserved
  1136		':':  true, // IPv6address + Host expression's optional port
  1137		';':  true, // sub-delims
  1138		'=':  true, // sub-delims
  1139		'[':  true,
  1140		'\'': true, // sub-delims
  1141		']':  true,
  1142		'_':  true, // unreserved
  1143		'~':  true, // unreserved
  1144	}
  1145	
  1146	func validHeaderName(v string) bool {
  1147		if len(v) == 0 {
  1148			return false
  1149		}
  1150		return strings.IndexFunc(v, isNotToken) == -1
  1151	}
  1152	
  1153	// validHeaderValue reports whether v is a valid "field-value" according to
  1154	// http://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html#sec4.2 :
  1155	//
  1156	//        message-header = field-name ":" [ field-value ]
  1157	//        field-value    = *( field-content | LWS )
  1158	//        field-content  = <the OCTETs making up the field-value
  1159	//                         and consisting of either *TEXT or combinations
  1160	//                         of token, separators, and quoted-string>
  1161	//
  1162	// http://www.w3.org/Protocols/rfc2616/rfc2616-sec2.html#sec2.2 :
  1163	//
  1164	//        TEXT           = <any OCTET except CTLs,
  1165	//                          but including LWS>
  1166	//        LWS            = [CRLF] 1*( SP | HT )
  1167	//        CTL            = <any US-ASCII control character
  1168	//                         (octets 0 - 31) and DEL (127)>
  1169	func validHeaderValue(v string) bool {
  1170		for i := 0; i < len(v); i++ {
  1171			b := v[i]
  1172			if isCTL(b) && !isLWS(b) {
  1173				return false
  1174			}
  1175		}
  1176		return true
  1177	}
  1178	

View as plain text