Source file src/net/http/request.go

     1  // Copyright 2009 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  // HTTP Request reading and parsing.
     6  
     7  package http
     8  
     9  import (
    10  	"bufio"
    11  	"bytes"
    12  	"context"
    13  	"crypto/tls"
    14  	"encoding/base64"
    15  	"errors"
    16  	"fmt"
    17  	"io"
    18  	"mime"
    19  	"mime/multipart"
    20  	"net"
    21  	"net/http/httptrace"
    22  	"net/http/internal/ascii"
    23  	"net/textproto"
    24  	"net/url"
    25  	urlpkg "net/url"
    26  	"strconv"
    27  	"strings"
    28  	"sync"
    29  
    30  	"golang.org/x/net/idna"
    31  )
    32  
    33  const (
    34  	defaultMaxMemory = 32 << 20 // 32 MB
    35  )
    36  
    37  // ErrMissingFile is returned by FormFile when the provided file field name
    38  // is either not present in the request or not a file field.
    39  var ErrMissingFile = errors.New("http: no such file")
    40  
    41  // ProtocolError represents an HTTP protocol error.
    42  //
    43  // Deprecated: Not all errors in the http package related to protocol errors
    44  // are of type ProtocolError.
    45  type ProtocolError struct {
    46  	ErrorString string
    47  }
    48  
    49  func (pe *ProtocolError) Error() string { return pe.ErrorString }
    50  
    51  var (
    52  	// ErrNotSupported is returned by the Push method of Pusher
    53  	// implementations to indicate that HTTP/2 Push support is not
    54  	// available.
    55  	ErrNotSupported = &ProtocolError{"feature not supported"}
    56  
    57  	// Deprecated: ErrUnexpectedTrailer is no longer returned by
    58  	// anything in the net/http package. Callers should not
    59  	// compare errors against this variable.
    60  	ErrUnexpectedTrailer = &ProtocolError{"trailer header without chunked transfer encoding"}
    61  
    62  	// ErrMissingBoundary is returned by Request.MultipartReader when the
    63  	// request's Content-Type does not include a "boundary" parameter.
    64  	ErrMissingBoundary = &ProtocolError{"no multipart boundary param in Content-Type"}
    65  
    66  	// ErrNotMultipart is returned by Request.MultipartReader when the
    67  	// request's Content-Type is not multipart/form-data.
    68  	ErrNotMultipart = &ProtocolError{"request Content-Type isn't multipart/form-data"}
    69  
    70  	// Deprecated: ErrHeaderTooLong is no longer returned by
    71  	// anything in the net/http package. Callers should not
    72  	// compare errors against this variable.
    73  	ErrHeaderTooLong = &ProtocolError{"header too long"}
    74  
    75  	// Deprecated: ErrShortBody is no longer returned by
    76  	// anything in the net/http package. Callers should not
    77  	// compare errors against this variable.
    78  	ErrShortBody = &ProtocolError{"entity body too short"}
    79  
    80  	// Deprecated: ErrMissingContentLength is no longer returned by
    81  	// anything in the net/http package. Callers should not
    82  	// compare errors against this variable.
    83  	ErrMissingContentLength = &ProtocolError{"missing ContentLength in HEAD response"}
    84  )
    85  
    86  func badStringError(what, val string) error { return fmt.Errorf("%s %q", what, val) }
    87  
    88  // Headers that Request.Write handles itself and should be skipped.
    89  var reqWriteExcludeHeader = map[string]bool{
    90  	"Host":              true, // not in Header map anyway
    91  	"User-Agent":        true,
    92  	"Content-Length":    true,
    93  	"Transfer-Encoding": true,
    94  	"Trailer":           true,
    95  }
    96  
    97  // A Request represents an HTTP request received by a server
    98  // or to be sent by a client.
    99  //
   100  // The field semantics differ slightly between client and server
   101  // usage. In addition to the notes on the fields below, see the
   102  // documentation for Request.Write and RoundTripper.
   103  type Request struct {
   104  	// Method specifies the HTTP method (GET, POST, PUT, etc.).
   105  	// For client requests, an empty string means GET.
   106  	//
   107  	// Go's HTTP client does not support sending a request with
   108  	// the CONNECT method. See the documentation on Transport for
   109  	// details.
   110  	Method string
   111  
   112  	// URL specifies either the URI being requested (for server
   113  	// requests) or the URL to access (for client requests).
   114  	//
   115  	// For server requests, the URL is parsed from the URI
   116  	// supplied on the Request-Line as stored in RequestURI.  For
   117  	// most requests, fields other than Path and RawQuery will be
   118  	// empty. (See RFC 7230, Section 5.3)
   119  	//
   120  	// For client requests, the URL's Host specifies the server to
   121  	// connect to, while the Request's Host field optionally
   122  	// specifies the Host header value to send in the HTTP
   123  	// request.
   124  	URL *url.URL
   125  
   126  	// The protocol version for incoming server requests.
   127  	//
   128  	// For client requests, these fields are ignored. The HTTP
   129  	// client code always uses either HTTP/1.1 or HTTP/2.
   130  	// See the docs on Transport for details.
   131  	Proto      string // "HTTP/1.0"
   132  	ProtoMajor int    // 1
   133  	ProtoMinor int    // 0
   134  
   135  	// Header contains the request header fields either received
   136  	// by the server or to be sent by the client.
   137  	//
   138  	// If a server received a request with header lines,
   139  	//
   140  	//	Host: example.com
   141  	//	accept-encoding: gzip, deflate
   142  	//	Accept-Language: en-us
   143  	//	fOO: Bar
   144  	//	foo: two
   145  	//
   146  	// then
   147  	//
   148  	//	Header = map[string][]string{
   149  	//		"Accept-Encoding": {"gzip, deflate"},
   150  	//		"Accept-Language": {"en-us"},
   151  	//		"Foo": {"Bar", "two"},
   152  	//	}
   153  	//
   154  	// For incoming requests, the Host header is promoted to the
   155  	// Request.Host field and removed from the Header map.
   156  	//
   157  	// HTTP defines that header names are case-insensitive. The
   158  	// request parser implements this by using CanonicalHeaderKey,
   159  	// making the first character and any characters following a
   160  	// hyphen uppercase and the rest lowercase.
   161  	//
   162  	// For client requests, certain headers such as Content-Length
   163  	// and Connection are automatically written when needed and
   164  	// values in Header may be ignored. See the documentation
   165  	// for the Request.Write method.
   166  	Header Header
   167  
   168  	// Body is the request's body.
   169  	//
   170  	// For client requests, a nil body means the request has no
   171  	// body, such as a GET request. The HTTP Client's Transport
   172  	// is responsible for calling the Close method.
   173  	//
   174  	// For server requests, the Request Body is always non-nil
   175  	// but will return EOF immediately when no body is present.
   176  	// The Server will close the request body. The ServeHTTP
   177  	// Handler does not need to.
   178  	//
   179  	// Body must allow Read to be called concurrently with Close.
   180  	// In particular, calling Close should unblock a Read waiting
   181  	// for input.
   182  	Body io.ReadCloser
   183  
   184  	// GetBody defines an optional func to return a new copy of
   185  	// Body. It is used for client requests when a redirect requires
   186  	// reading the body more than once. Use of GetBody still
   187  	// requires setting Body.
   188  	//
   189  	// For server requests, it is unused.
   190  	GetBody func() (io.ReadCloser, error)
   191  
   192  	// ContentLength records the length of the associated content.
   193  	// The value -1 indicates that the length is unknown.
   194  	// Values >= 0 indicate that the given number of bytes may
   195  	// be read from Body.
   196  	//
   197  	// For client requests, a value of 0 with a non-nil Body is
   198  	// also treated as unknown.
   199  	ContentLength int64
   200  
   201  	// TransferEncoding lists the transfer encodings from outermost to
   202  	// innermost. An empty list denotes the "identity" encoding.
   203  	// TransferEncoding can usually be ignored; chunked encoding is
   204  	// automatically added and removed as necessary when sending and
   205  	// receiving requests.
   206  	TransferEncoding []string
   207  
   208  	// Close indicates whether to close the connection after
   209  	// replying to this request (for servers) or after sending this
   210  	// request and reading its response (for clients).
   211  	//
   212  	// For server requests, the HTTP server handles this automatically
   213  	// and this field is not needed by Handlers.
   214  	//
   215  	// For client requests, setting this field prevents re-use of
   216  	// TCP connections between requests to the same hosts, as if
   217  	// Transport.DisableKeepAlives were set.
   218  	Close bool
   219  
   220  	// For server requests, Host specifies the host on which the
   221  	// URL is sought. For HTTP/1 (per RFC 7230, section 5.4), this
   222  	// is either the value of the "Host" header or the host name
   223  	// given in the URL itself. For HTTP/2, it is the value of the
   224  	// ":authority" pseudo-header field.
   225  	// It may be of the form "host:port". For international domain
   226  	// names, Host may be in Punycode or Unicode form. Use
   227  	// golang.org/x/net/idna to convert it to either format if
   228  	// needed.
   229  	// To prevent DNS rebinding attacks, server Handlers should
   230  	// validate that the Host header has a value for which the
   231  	// Handler considers itself authoritative. The included
   232  	// ServeMux supports patterns registered to particular host
   233  	// names and thus protects its registered Handlers.
   234  	//
   235  	// For client requests, Host optionally overrides the Host
   236  	// header to send. If empty, the Request.Write method uses
   237  	// the value of URL.Host. Host may contain an international
   238  	// domain name.
   239  	Host string
   240  
   241  	// Form contains the parsed form data, including both the URL
   242  	// field's query parameters and the PATCH, POST, or PUT form data.
   243  	// This field is only available after ParseForm is called.
   244  	// The HTTP client ignores Form and uses Body instead.
   245  	Form url.Values
   246  
   247  	// PostForm contains the parsed form data from PATCH, POST
   248  	// or PUT body parameters.
   249  	//
   250  	// This field is only available after ParseForm is called.
   251  	// The HTTP client ignores PostForm and uses Body instead.
   252  	PostForm url.Values
   253  
   254  	// MultipartForm is the parsed multipart form, including file uploads.
   255  	// This field is only available after ParseMultipartForm is called.
   256  	// The HTTP client ignores MultipartForm and uses Body instead.
   257  	MultipartForm *multipart.Form
   258  
   259  	// Trailer specifies additional headers that are sent after the request
   260  	// body.
   261  	//
   262  	// For server requests, the Trailer map initially contains only the
   263  	// trailer keys, with nil values. (The client declares which trailers it
   264  	// will later send.)  While the handler is reading from Body, it must
   265  	// not reference Trailer. After reading from Body returns EOF, Trailer
   266  	// can be read again and will contain non-nil values, if they were sent
   267  	// by the client.
   268  	//
   269  	// For client requests, Trailer must be initialized to a map containing
   270  	// the trailer keys to later send. The values may be nil or their final
   271  	// values. The ContentLength must be 0 or -1, to send a chunked request.
   272  	// After the HTTP request is sent the map values can be updated while
   273  	// the request body is read. Once the body returns EOF, the caller must
   274  	// not mutate Trailer.
   275  	//
   276  	// Few HTTP clients, servers, or proxies support HTTP trailers.
   277  	Trailer Header
   278  
   279  	// RemoteAddr allows HTTP servers and other software to record
   280  	// the network address that sent the request, usually for
   281  	// logging. This field is not filled in by ReadRequest and
   282  	// has no defined format. The HTTP server in this package
   283  	// sets RemoteAddr to an "IP:port" address before invoking a
   284  	// handler.
   285  	// This field is ignored by the HTTP client.
   286  	RemoteAddr string
   287  
   288  	// RequestURI is the unmodified request-target of the
   289  	// Request-Line (RFC 7230, Section 3.1.1) as sent by the client
   290  	// to a server. Usually the URL field should be used instead.
   291  	// It is an error to set this field in an HTTP client request.
   292  	RequestURI string
   293  
   294  	// TLS allows HTTP servers and other software to record
   295  	// information about the TLS connection on which the request
   296  	// was received. This field is not filled in by ReadRequest.
   297  	// The HTTP server in this package sets the field for
   298  	// TLS-enabled connections before invoking a handler;
   299  	// otherwise it leaves the field nil.
   300  	// This field is ignored by the HTTP client.
   301  	TLS *tls.ConnectionState
   302  
   303  	// Cancel is an optional channel whose closure indicates that the client
   304  	// request should be regarded as canceled. Not all implementations of
   305  	// RoundTripper may support Cancel.
   306  	//
   307  	// For server requests, this field is not applicable.
   308  	//
   309  	// Deprecated: Set the Request's context with NewRequestWithContext
   310  	// instead. If a Request's Cancel field and context are both
   311  	// set, it is undefined whether Cancel is respected.
   312  	Cancel <-chan struct{}
   313  
   314  	// Response is the redirect response which caused this request
   315  	// to be created. This field is only populated during client
   316  	// redirects.
   317  	Response *Response
   318  
   319  	// ctx is either the client or server context. It should only
   320  	// be modified via copying the whole Request using WithContext.
   321  	// It is unexported to prevent people from using Context wrong
   322  	// and mutating the contexts held by callers of the same request.
   323  	ctx context.Context
   324  }
   325  
   326  // Context returns the request's context. To change the context, use
   327  // WithContext.
   328  //
   329  // The returned context is always non-nil; it defaults to the
   330  // background context.
   331  //
   332  // For outgoing client requests, the context controls cancellation.
   333  //
   334  // For incoming server requests, the context is canceled when the
   335  // client's connection closes, the request is canceled (with HTTP/2),
   336  // or when the ServeHTTP method returns.
   337  func (r *Request) Context() context.Context {
   338  	if r.ctx != nil {
   339  		return r.ctx
   340  	}
   341  	return context.Background()
   342  }
   343  
   344  // WithContext returns a shallow copy of r with its context changed
   345  // to ctx. The provided ctx must be non-nil.
   346  //
   347  // For outgoing client request, the context controls the entire
   348  // lifetime of a request and its response: obtaining a connection,
   349  // sending the request, and reading the response headers and body.
   350  //
   351  // To create a new request with a context, use NewRequestWithContext.
   352  // To change the context of a request, such as an incoming request you
   353  // want to modify before sending back out, use Request.Clone. Between
   354  // those two uses, it's rare to need WithContext.
   355  func (r *Request) WithContext(ctx context.Context) *Request {
   356  	if ctx == nil {
   357  		panic("nil context")
   358  	}
   359  	r2 := new(Request)
   360  	*r2 = *r
   361  	r2.ctx = ctx
   362  	return r2
   363  }
   364  
   365  // Clone returns a deep copy of r with its context changed to ctx.
   366  // The provided ctx must be non-nil.
   367  //
   368  // For an outgoing client request, the context controls the entire
   369  // lifetime of a request and its response: obtaining a connection,
   370  // sending the request, and reading the response headers and body.
   371  func (r *Request) Clone(ctx context.Context) *Request {
   372  	if ctx == nil {
   373  		panic("nil context")
   374  	}
   375  	r2 := new(Request)
   376  	*r2 = *r
   377  	r2.ctx = ctx
   378  	r2.URL = cloneURL(r.URL)
   379  	if r.Header != nil {
   380  		r2.Header = r.Header.Clone()
   381  	}
   382  	if r.Trailer != nil {
   383  		r2.Trailer = r.Trailer.Clone()
   384  	}
   385  	if s := r.TransferEncoding; s != nil {
   386  		s2 := make([]string, len(s))
   387  		copy(s2, s)
   388  		r2.TransferEncoding = s2
   389  	}
   390  	r2.Form = cloneURLValues(r.Form)
   391  	r2.PostForm = cloneURLValues(r.PostForm)
   392  	r2.MultipartForm = cloneMultipartForm(r.MultipartForm)
   393  	return r2
   394  }
   395  
   396  // ProtoAtLeast reports whether the HTTP protocol used
   397  // in the request is at least major.minor.
   398  func (r *Request) ProtoAtLeast(major, minor int) bool {
   399  	return r.ProtoMajor > major ||
   400  		r.ProtoMajor == major && r.ProtoMinor >= minor
   401  }
   402  
   403  // UserAgent returns the client's User-Agent, if sent in the request.
   404  func (r *Request) UserAgent() string {
   405  	return r.Header.Get("User-Agent")
   406  }
   407  
   408  // Cookies parses and returns the HTTP cookies sent with the request.
   409  func (r *Request) Cookies() []*Cookie {
   410  	return readCookies(r.Header, "")
   411  }
   412  
   413  // ErrNoCookie is returned by Request's Cookie method when a cookie is not found.
   414  var ErrNoCookie = errors.New("http: named cookie not present")
   415  
   416  // Cookie returns the named cookie provided in the request or
   417  // ErrNoCookie if not found.
   418  // If multiple cookies match the given name, only one cookie will
   419  // be returned.
   420  func (r *Request) Cookie(name string) (*Cookie, error) {
   421  	for _, c := range readCookies(r.Header, name) {
   422  		return c, nil
   423  	}
   424  	return nil, ErrNoCookie
   425  }
   426  
   427  // AddCookie adds a cookie to the request. Per RFC 6265 section 5.4,
   428  // AddCookie does not attach more than one Cookie header field. That
   429  // means all cookies, if any, are written into the same line,
   430  // separated by semicolon.
   431  // AddCookie only sanitizes c's name and value, and does not sanitize
   432  // a Cookie header already present in the request.
   433  func (r *Request) AddCookie(c *Cookie) {
   434  	s := fmt.Sprintf("%s=%s", sanitizeCookieName(c.Name), sanitizeCookieValue(c.Value))
   435  	if c := r.Header.Get("Cookie"); c != "" {
   436  		r.Header.Set("Cookie", c+"; "+s)
   437  	} else {
   438  		r.Header.Set("Cookie", s)
   439  	}
   440  }
   441  
   442  // Referer returns the referring URL, if sent in the request.
   443  //
   444  // Referer is misspelled as in the request itself, a mistake from the
   445  // earliest days of HTTP.  This value can also be fetched from the
   446  // Header map as Header["Referer"]; the benefit of making it available
   447  // as a method is that the compiler can diagnose programs that use the
   448  // alternate (correct English) spelling req.Referrer() but cannot
   449  // diagnose programs that use Header["Referrer"].
   450  func (r *Request) Referer() string {
   451  	return r.Header.Get("Referer")
   452  }
   453  
   454  // multipartByReader is a sentinel value.
   455  // Its presence in Request.MultipartForm indicates that parsing of the request
   456  // body has been handed off to a MultipartReader instead of ParseMultipartForm.
   457  var multipartByReader = &multipart.Form{
   458  	Value: make(map[string][]string),
   459  	File:  make(map[string][]*multipart.FileHeader),
   460  }
   461  
   462  // MultipartReader returns a MIME multipart reader if this is a
   463  // multipart/form-data or a multipart/mixed POST request, else returns nil and an error.
   464  // Use this function instead of ParseMultipartForm to
   465  // process the request body as a stream.
   466  func (r *Request) MultipartReader() (*multipart.Reader, error) {
   467  	if r.MultipartForm == multipartByReader {
   468  		return nil, errors.New("http: MultipartReader called twice")
   469  	}
   470  	if r.MultipartForm != nil {
   471  		return nil, errors.New("http: multipart handled by ParseMultipartForm")
   472  	}
   473  	r.MultipartForm = multipartByReader
   474  	return r.multipartReader(true)
   475  }
   476  
   477  func (r *Request) multipartReader(allowMixed bool) (*multipart.Reader, error) {
   478  	v := r.Header.Get("Content-Type")
   479  	if v == "" {
   480  		return nil, ErrNotMultipart
   481  	}
   482  	if r.Body == nil {
   483  		return nil, errors.New("missing form body")
   484  	}
   485  	d, params, err := mime.ParseMediaType(v)
   486  	if err != nil || !(d == "multipart/form-data" || allowMixed && d == "multipart/mixed") {
   487  		return nil, ErrNotMultipart
   488  	}
   489  	boundary, ok := params["boundary"]
   490  	if !ok {
   491  		return nil, ErrMissingBoundary
   492  	}
   493  	return multipart.NewReader(r.Body, boundary), nil
   494  }
   495  
   496  // isH2Upgrade reports whether r represents the http2 "client preface"
   497  // magic string.
   498  func (r *Request) isH2Upgrade() bool {
   499  	return r.Method == "PRI" && len(r.Header) == 0 && r.URL.Path == "*" && r.Proto == "HTTP/2.0"
   500  }
   501  
   502  // Return value if nonempty, def otherwise.
   503  func valueOrDefault(value, def string) string {
   504  	if value != "" {
   505  		return value
   506  	}
   507  	return def
   508  }
   509  
   510  // NOTE: This is not intended to reflect the actual Go version being used.
   511  // It was changed at the time of Go 1.1 release because the former User-Agent
   512  // had ended up blocked by some intrusion detection systems.
   513  // See https://codereview.appspot.com/7532043.
   514  const defaultUserAgent = "Go-http-client/1.1"
   515  
   516  // Write writes an HTTP/1.1 request, which is the header and body, in wire format.
   517  // This method consults the following fields of the request:
   518  //
   519  //	Host
   520  //	URL
   521  //	Method (defaults to "GET")
   522  //	Header
   523  //	ContentLength
   524  //	TransferEncoding
   525  //	Body
   526  //
   527  // If Body is present, Content-Length is <= 0 and TransferEncoding
   528  // hasn't been set to "identity", Write adds "Transfer-Encoding:
   529  // chunked" to the header. Body is closed after it is sent.
   530  func (r *Request) Write(w io.Writer) error {
   531  	return r.write(w, false, nil, nil)
   532  }
   533  
   534  // WriteProxy is like Write but writes the request in the form
   535  // expected by an HTTP proxy. In particular, WriteProxy writes the
   536  // initial Request-URI line of the request with an absolute URI, per
   537  // section 5.3 of RFC 7230, including the scheme and host.
   538  // In either case, WriteProxy also writes a Host header, using
   539  // either r.Host or r.URL.Host.
   540  func (r *Request) WriteProxy(w io.Writer) error {
   541  	return r.write(w, true, nil, nil)
   542  }
   543  
   544  // errMissingHost is returned by Write when there is no Host or URL present in
   545  // the Request.
   546  var errMissingHost = errors.New("http: Request.Write on Request with no Host or URL set")
   547  
   548  // extraHeaders may be nil
   549  // waitForContinue may be nil
   550  // always closes body
   551  func (r *Request) write(w io.Writer, usingProxy bool, extraHeaders Header, waitForContinue func() bool) (err error) {
   552  	trace := httptrace.ContextClientTrace(r.Context())
   553  	if trace != nil && trace.WroteRequest != nil {
   554  		defer func() {
   555  			trace.WroteRequest(httptrace.WroteRequestInfo{
   556  				Err: err,
   557  			})
   558  		}()
   559  	}
   560  	closed := false
   561  	defer func() {
   562  		if closed {
   563  			return
   564  		}
   565  		if closeErr := r.closeBody(); closeErr != nil && err == nil {
   566  			err = closeErr
   567  		}
   568  	}()
   569  
   570  	// Find the target host. Prefer the Host: header, but if that
   571  	// is not given, use the host from the request URL.
   572  	//
   573  	// Clean the host, in case it arrives with unexpected stuff in it.
   574  	host := cleanHost(r.Host)
   575  	if host == "" {
   576  		if r.URL == nil {
   577  			return errMissingHost
   578  		}
   579  		host = cleanHost(r.URL.Host)
   580  	}
   581  
   582  	// According to RFC 6874, an HTTP client, proxy, or other
   583  	// intermediary must remove any IPv6 zone identifier attached
   584  	// to an outgoing URI.
   585  	host = removeZone(host)
   586  
   587  	ruri := r.URL.RequestURI()
   588  	if usingProxy && r.URL.Scheme != "" && r.URL.Opaque == "" {
   589  		ruri = r.URL.Scheme + "://" + host + ruri
   590  	} else if r.Method == "CONNECT" && r.URL.Path == "" {
   591  		// CONNECT requests normally give just the host and port, not a full URL.
   592  		ruri = host
   593  		if r.URL.Opaque != "" {
   594  			ruri = r.URL.Opaque
   595  		}
   596  	}
   597  	if stringContainsCTLByte(ruri) {
   598  		return errors.New("net/http: can't write control character in Request.URL")
   599  	}
   600  	// TODO: validate r.Method too? At least it's less likely to
   601  	// come from an attacker (more likely to be a constant in
   602  	// code).
   603  
   604  	// Wrap the writer in a bufio Writer if it's not already buffered.
   605  	// Don't always call NewWriter, as that forces a bytes.Buffer
   606  	// and other small bufio Writers to have a minimum 4k buffer
   607  	// size.
   608  	var bw *bufio.Writer
   609  	if _, ok := w.(io.ByteWriter); !ok {
   610  		bw = bufio.NewWriter(w)
   611  		w = bw
   612  	}
   613  
   614  	_, err = fmt.Fprintf(w, "%s %s HTTP/1.1\r\n", valueOrDefault(r.Method, "GET"), ruri)
   615  	if err != nil {
   616  		return err
   617  	}
   618  
   619  	// Header lines
   620  	_, err = fmt.Fprintf(w, "Host: %s\r\n", host)
   621  	if err != nil {
   622  		return err
   623  	}
   624  	if trace != nil && trace.WroteHeaderField != nil {
   625  		trace.WroteHeaderField("Host", []string{host})
   626  	}
   627  
   628  	// Use the defaultUserAgent unless the Header contains one, which
   629  	// may be blank to not send the header.
   630  	userAgent := defaultUserAgent
   631  	if r.Header.has("User-Agent") {
   632  		userAgent = r.Header.Get("User-Agent")
   633  	}
   634  	if userAgent != "" {
   635  		_, err = fmt.Fprintf(w, "User-Agent: %s\r\n", userAgent)
   636  		if err != nil {
   637  			return err
   638  		}
   639  		if trace != nil && trace.WroteHeaderField != nil {
   640  			trace.WroteHeaderField("User-Agent", []string{userAgent})
   641  		}
   642  	}
   643  
   644  	// Process Body,ContentLength,Close,Trailer
   645  	tw, err := newTransferWriter(r)
   646  	if err != nil {
   647  		return err
   648  	}
   649  	err = tw.writeHeader(w, trace)
   650  	if err != nil {
   651  		return err
   652  	}
   653  
   654  	err = r.Header.writeSubset(w, reqWriteExcludeHeader, trace)
   655  	if err != nil {
   656  		return err
   657  	}
   658  
   659  	if extraHeaders != nil {
   660  		err = extraHeaders.write(w, trace)
   661  		if err != nil {
   662  			return err
   663  		}
   664  	}
   665  
   666  	_, err = io.WriteString(w, "\r\n")
   667  	if err != nil {
   668  		return err
   669  	}
   670  
   671  	if trace != nil && trace.WroteHeaders != nil {
   672  		trace.WroteHeaders()
   673  	}
   674  
   675  	// Flush and wait for 100-continue if expected.
   676  	if waitForContinue != nil {
   677  		if bw, ok := w.(*bufio.Writer); ok {
   678  			err = bw.Flush()
   679  			if err != nil {
   680  				return err
   681  			}
   682  		}
   683  		if trace != nil && trace.Wait100Continue != nil {
   684  			trace.Wait100Continue()
   685  		}
   686  		if !waitForContinue() {
   687  			closed = true
   688  			r.closeBody()
   689  			return nil
   690  		}
   691  	}
   692  
   693  	if bw, ok := w.(*bufio.Writer); ok && tw.FlushHeaders {
   694  		if err := bw.Flush(); err != nil {
   695  			return err
   696  		}
   697  	}
   698  
   699  	// Write body and trailer
   700  	closed = true
   701  	err = tw.writeBody(w)
   702  	if err != nil {
   703  		if tw.bodyReadError == err {
   704  			err = requestBodyReadError{err}
   705  		}
   706  		return err
   707  	}
   708  
   709  	if bw != nil {
   710  		return bw.Flush()
   711  	}
   712  	return nil
   713  }
   714  
   715  // requestBodyReadError wraps an error from (*Request).write to indicate
   716  // that the error came from a Read call on the Request.Body.
   717  // This error type should not escape the net/http package to users.
   718  type requestBodyReadError struct{ error }
   719  
   720  func idnaASCII(v string) (string, error) {
   721  	// TODO: Consider removing this check after verifying performance is okay.
   722  	// Right now punycode verification, length checks, context checks, and the
   723  	// permissible character tests are all omitted. It also prevents the ToASCII
   724  	// call from salvaging an invalid IDN, when possible. As a result it may be
   725  	// possible to have two IDNs that appear identical to the user where the
   726  	// ASCII-only version causes an error downstream whereas the non-ASCII
   727  	// version does not.
   728  	// Note that for correct ASCII IDNs ToASCII will only do considerably more
   729  	// work, but it will not cause an allocation.
   730  	if ascii.Is(v) {
   731  		return v, nil
   732  	}
   733  	return idna.Lookup.ToASCII(v)
   734  }
   735  
   736  // cleanHost cleans up the host sent in request's Host header.
   737  //
   738  // It both strips anything after '/' or ' ', and puts the value
   739  // into Punycode form, if necessary.
   740  //
   741  // Ideally we'd clean the Host header according to the spec:
   742  //
   743  //	https://tools.ietf.org/html/rfc7230#section-5.4 (Host = uri-host [ ":" port ]")
   744  //	https://tools.ietf.org/html/rfc7230#section-2.7 (uri-host -> rfc3986's host)
   745  //	https://tools.ietf.org/html/rfc3986#section-3.2.2 (definition of host)
   746  //
   747  // But practically, what we are trying to avoid is the situation in
   748  // issue 11206, where a malformed Host header used in the proxy context
   749  // would create a bad request. So it is enough to just truncate at the
   750  // first offending character.
   751  func cleanHost(in string) string {
   752  	if i := strings.IndexAny(in, " /"); i != -1 {
   753  		in = in[:i]
   754  	}
   755  	host, port, err := net.SplitHostPort(in)
   756  	if err != nil { // input was just a host
   757  		a, err := idnaASCII(in)
   758  		if err != nil {
   759  			return in // garbage in, garbage out
   760  		}
   761  		return a
   762  	}
   763  	a, err := idnaASCII(host)
   764  	if err != nil {
   765  		return in // garbage in, garbage out
   766  	}
   767  	return net.JoinHostPort(a, port)
   768  }
   769  
   770  // removeZone removes IPv6 zone identifier from host.
   771  // E.g., "[fe80::1%en0]:8080" to "[fe80::1]:8080"
   772  func removeZone(host string) string {
   773  	if !strings.HasPrefix(host, "[") {
   774  		return host
   775  	}
   776  	i := strings.LastIndex(host, "]")
   777  	if i < 0 {
   778  		return host
   779  	}
   780  	j := strings.LastIndex(host[:i], "%")
   781  	if j < 0 {
   782  		return host
   783  	}
   784  	return host[:j] + host[i:]
   785  }
   786  
   787  // ParseHTTPVersion parses an HTTP version string according to RFC 7230, section 2.6.
   788  // "HTTP/1.0" returns (1, 0, true). Note that strings without
   789  // a minor version, such as "HTTP/2", are not valid.
   790  func ParseHTTPVersion(vers string) (major, minor int, ok bool) {
   791  	switch vers {
   792  	case "HTTP/1.1":
   793  		return 1, 1, true
   794  	case "HTTP/1.0":
   795  		return 1, 0, true
   796  	}
   797  	if !strings.HasPrefix(vers, "HTTP/") {
   798  		return 0, 0, false
   799  	}
   800  	if len(vers) != len("HTTP/X.Y") {
   801  		return 0, 0, false
   802  	}
   803  	if vers[6] != '.' {
   804  		return 0, 0, false
   805  	}
   806  	maj, err := strconv.ParseUint(vers[5:6], 10, 0)
   807  	if err != nil {
   808  		return 0, 0, false
   809  	}
   810  	min, err := strconv.ParseUint(vers[7:8], 10, 0)
   811  	if err != nil {
   812  		return 0, 0, false
   813  	}
   814  	return int(maj), int(min), true
   815  }
   816  
   817  func validMethod(method string) bool {
   818  	/*
   819  	     Method         = "OPTIONS"                ; Section 9.2
   820  	                    | "GET"                    ; Section 9.3
   821  	                    | "HEAD"                   ; Section 9.4
   822  	                    | "POST"                   ; Section 9.5
   823  	                    | "PUT"                    ; Section 9.6
   824  	                    | "DELETE"                 ; Section 9.7
   825  	                    | "TRACE"                  ; Section 9.8
   826  	                    | "CONNECT"                ; Section 9.9
   827  	                    | extension-method
   828  	   extension-method = token
   829  	     token          = 1*<any CHAR except CTLs or separators>
   830  	*/
   831  	return len(method) > 0 && strings.IndexFunc(method, isNotToken) == -1
   832  }
   833  
   834  // NewRequest wraps NewRequestWithContext using context.Background.
   835  func NewRequest(method, url string, body io.Reader) (*Request, error) {
   836  	return NewRequestWithContext(context.Background(), method, url, body)
   837  }
   838  
   839  // NewRequestWithContext returns a new Request given a method, URL, and
   840  // optional body.
   841  //
   842  // If the provided body is also an io.Closer, the returned
   843  // Request.Body is set to body and will be closed by the Client
   844  // methods Do, Post, and PostForm, and Transport.RoundTrip.
   845  //
   846  // NewRequestWithContext returns a Request suitable for use with
   847  // Client.Do or Transport.RoundTrip. To create a request for use with
   848  // testing a Server Handler, either use the NewRequest function in the
   849  // net/http/httptest package, use ReadRequest, or manually update the
   850  // Request fields. For an outgoing client request, the context
   851  // controls the entire lifetime of a request and its response:
   852  // obtaining a connection, sending the request, and reading the
   853  // response headers and body. See the Request type's documentation for
   854  // the difference between inbound and outbound request fields.
   855  //
   856  // If body is of type *bytes.Buffer, *bytes.Reader, or
   857  // *strings.Reader, the returned request's ContentLength is set to its
   858  // exact value (instead of -1), GetBody is populated (so 307 and 308
   859  // redirects can replay the body), and Body is set to NoBody if the
   860  // ContentLength is 0.
   861  func NewRequestWithContext(ctx context.Context, method, url string, body io.Reader) (*Request, error) {
   862  	if method == "" {
   863  		// We document that "" means "GET" for Request.Method, and people have
   864  		// relied on that from NewRequest, so keep that working.
   865  		// We still enforce validMethod for non-empty methods.
   866  		method = "GET"
   867  	}
   868  	if !validMethod(method) {
   869  		return nil, fmt.Errorf("net/http: invalid method %q", method)
   870  	}
   871  	if ctx == nil {
   872  		return nil, errors.New("net/http: nil Context")
   873  	}
   874  	u, err := urlpkg.Parse(url)
   875  	if err != nil {
   876  		return nil, err
   877  	}
   878  	rc, ok := body.(io.ReadCloser)
   879  	if !ok && body != nil {
   880  		rc = io.NopCloser(body)
   881  	}
   882  	// The host's colon:port should be normalized. See Issue 14836.
   883  	u.Host = removeEmptyPort(u.Host)
   884  	req := &Request{
   885  		ctx:        ctx,
   886  		Method:     method,
   887  		URL:        u,
   888  		Proto:      "HTTP/1.1",
   889  		ProtoMajor: 1,
   890  		ProtoMinor: 1,
   891  		Header:     make(Header),
   892  		Body:       rc,
   893  		Host:       u.Host,
   894  	}
   895  	if body != nil {
   896  		switch v := body.(type) {
   897  		case *bytes.Buffer:
   898  			req.ContentLength = int64(v.Len())
   899  			buf := v.Bytes()
   900  			req.GetBody = func() (io.ReadCloser, error) {
   901  				r := bytes.NewReader(buf)
   902  				return io.NopCloser(r), nil
   903  			}
   904  		case *bytes.Reader:
   905  			req.ContentLength = int64(v.Len())
   906  			snapshot := *v
   907  			req.GetBody = func() (io.ReadCloser, error) {
   908  				r := snapshot
   909  				return io.NopCloser(&r), nil
   910  			}
   911  		case *strings.Reader:
   912  			req.ContentLength = int64(v.Len())
   913  			snapshot := *v
   914  			req.GetBody = func() (io.ReadCloser, error) {
   915  				r := snapshot
   916  				return io.NopCloser(&r), nil
   917  			}
   918  		default:
   919  			// This is where we'd set it to -1 (at least
   920  			// if body != NoBody) to mean unknown, but
   921  			// that broke people during the Go 1.8 testing
   922  			// period. People depend on it being 0 I
   923  			// guess. Maybe retry later. See Issue 18117.
   924  		}
   925  		// For client requests, Request.ContentLength of 0
   926  		// means either actually 0, or unknown. The only way
   927  		// to explicitly say that the ContentLength is zero is
   928  		// to set the Body to nil. But turns out too much code
   929  		// depends on NewRequest returning a non-nil Body,
   930  		// so we use a well-known ReadCloser variable instead
   931  		// and have the http package also treat that sentinel
   932  		// variable to mean explicitly zero.
   933  		if req.GetBody != nil && req.ContentLength == 0 {
   934  			req.Body = NoBody
   935  			req.GetBody = func() (io.ReadCloser, error) { return NoBody, nil }
   936  		}
   937  	}
   938  
   939  	return req, nil
   940  }
   941  
   942  // BasicAuth returns the username and password provided in the request's
   943  // Authorization header, if the request uses HTTP Basic Authentication.
   944  // See RFC 2617, Section 2.
   945  func (r *Request) BasicAuth() (username, password string, ok bool) {
   946  	auth := r.Header.Get("Authorization")
   947  	if auth == "" {
   948  		return "", "", false
   949  	}
   950  	return parseBasicAuth(auth)
   951  }
   952  
   953  // parseBasicAuth parses an HTTP Basic Authentication string.
   954  // "Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==" returns ("Aladdin", "open sesame", true).
   955  func parseBasicAuth(auth string) (username, password string, ok bool) {
   956  	const prefix = "Basic "
   957  	// Case insensitive prefix match. See Issue 22736.
   958  	if len(auth) < len(prefix) || !ascii.EqualFold(auth[:len(prefix)], prefix) {
   959  		return "", "", false
   960  	}
   961  	c, err := base64.StdEncoding.DecodeString(auth[len(prefix):])
   962  	if err != nil {
   963  		return "", "", false
   964  	}
   965  	cs := string(c)
   966  	username, password, ok = strings.Cut(cs, ":")
   967  	if !ok {
   968  		return "", "", false
   969  	}
   970  	return username, password, true
   971  }
   972  
   973  // SetBasicAuth sets the request's Authorization header to use HTTP
   974  // Basic Authentication with the provided username and password.
   975  //
   976  // With HTTP Basic Authentication the provided username and password
   977  // are not encrypted. It should generally only be used in an HTTPS
   978  // request.
   979  //
   980  // The username may not contain a colon. Some protocols may impose
   981  // additional requirements on pre-escaping the username and
   982  // password. For instance, when used with OAuth2, both arguments must
   983  // be URL encoded first with url.QueryEscape.
   984  func (r *Request) SetBasicAuth(username, password string) {
   985  	r.Header.Set("Authorization", "Basic "+basicAuth(username, password))
   986  }
   987  
   988  // parseRequestLine parses "GET /foo HTTP/1.1" into its three parts.
   989  func parseRequestLine(line string) (method, requestURI, proto string, ok bool) {
   990  	method, rest, ok1 := strings.Cut(line, " ")
   991  	requestURI, proto, ok2 := strings.Cut(rest, " ")
   992  	if !ok1 || !ok2 {
   993  		return "", "", "", false
   994  	}
   995  	return method, requestURI, proto, true
   996  }
   997  
   998  var textprotoReaderPool sync.Pool
   999  
  1000  func newTextprotoReader(br *bufio.Reader) *textproto.Reader {
  1001  	if v := textprotoReaderPool.Get(); v != nil {
  1002  		tr := v.(*textproto.Reader)
  1003  		tr.R = br
  1004  		return tr
  1005  	}
  1006  	return textproto.NewReader(br)
  1007  }
  1008  
  1009  func putTextprotoReader(r *textproto.Reader) {
  1010  	r.R = nil
  1011  	textprotoReaderPool.Put(r)
  1012  }
  1013  
  1014  // ReadRequest reads and parses an incoming request from b.
  1015  //
  1016  // ReadRequest is a low-level function and should only be used for
  1017  // specialized applications; most code should use the Server to read
  1018  // requests and handle them via the Handler interface. ReadRequest
  1019  // only supports HTTP/1.x requests. For HTTP/2, use golang.org/x/net/http2.
  1020  func ReadRequest(b *bufio.Reader) (*Request, error) {
  1021  	req, err := readRequest(b)
  1022  	if err != nil {
  1023  		return nil, err
  1024  	}
  1025  
  1026  	delete(req.Header, "Host")
  1027  	return req, err
  1028  }
  1029  
  1030  func readRequest(b *bufio.Reader) (req *Request, err error) {
  1031  	tp := newTextprotoReader(b)
  1032  	req = new(Request)
  1033  
  1034  	// First line: GET /index.html HTTP/1.0
  1035  	var s string
  1036  	if s, err = tp.ReadLine(); err != nil {
  1037  		return nil, err
  1038  	}
  1039  	defer func() {
  1040  		putTextprotoReader(tp)
  1041  		if err == io.EOF {
  1042  			err = io.ErrUnexpectedEOF
  1043  		}
  1044  	}()
  1045  
  1046  	var ok bool
  1047  	req.Method, req.RequestURI, req.Proto, ok = parseRequestLine(s)
  1048  	if !ok {
  1049  		return nil, badStringError("malformed HTTP request", s)
  1050  	}
  1051  	if !validMethod(req.Method) {
  1052  		return nil, badStringError("invalid method", req.Method)
  1053  	}
  1054  	rawurl := req.RequestURI
  1055  	if req.ProtoMajor, req.ProtoMinor, ok = ParseHTTPVersion(req.Proto); !ok {
  1056  		return nil, badStringError("malformed HTTP version", req.Proto)
  1057  	}
  1058  
  1059  	// CONNECT requests are used two different ways, and neither uses a full URL:
  1060  	// The standard use is to tunnel HTTPS through an HTTP proxy.
  1061  	// It looks like "CONNECT www.google.com:443 HTTP/1.1", and the parameter is
  1062  	// just the authority section of a URL. This information should go in req.URL.Host.
  1063  	//
  1064  	// The net/rpc package also uses CONNECT, but there the parameter is a path
  1065  	// that starts with a slash. It can be parsed with the regular URL parser,
  1066  	// and the path will end up in req.URL.Path, where it needs to be in order for
  1067  	// RPC to work.
  1068  	justAuthority := req.Method == "CONNECT" && !strings.HasPrefix(rawurl, "/")
  1069  	if justAuthority {
  1070  		rawurl = "http://" + rawurl
  1071  	}
  1072  
  1073  	if req.URL, err = url.ParseRequestURI(rawurl); err != nil {
  1074  		return nil, err
  1075  	}
  1076  
  1077  	if justAuthority {
  1078  		// Strip the bogus "http://" back off.
  1079  		req.URL.Scheme = ""
  1080  	}
  1081  
  1082  	// Subsequent lines: Key: value.
  1083  	mimeHeader, err := tp.ReadMIMEHeader()
  1084  	if err != nil {
  1085  		return nil, err
  1086  	}
  1087  	req.Header = Header(mimeHeader)
  1088  	if len(req.Header["Host"]) > 1 {
  1089  		return nil, fmt.Errorf("too many Host headers")
  1090  	}
  1091  
  1092  	// RFC 7230, section 5.3: Must treat
  1093  	//	GET /index.html HTTP/1.1
  1094  	//	Host: www.google.com
  1095  	// and
  1096  	//	GET http://www.google.com/index.html HTTP/1.1
  1097  	//	Host: doesntmatter
  1098  	// the same. In the second case, any Host line is ignored.
  1099  	req.Host = req.URL.Host
  1100  	if req.Host == "" {
  1101  		req.Host = req.Header.get("Host")
  1102  	}
  1103  
  1104  	fixPragmaCacheControl(req.Header)
  1105  
  1106  	req.Close = shouldClose(req.ProtoMajor, req.ProtoMinor, req.Header, false)
  1107  
  1108  	err = readTransfer(req, b)
  1109  	if err != nil {
  1110  		return nil, err
  1111  	}
  1112  
  1113  	if req.isH2Upgrade() {
  1114  		// Because it's neither chunked, nor declared:
  1115  		req.ContentLength = -1
  1116  
  1117  		// We want to give handlers a chance to hijack the
  1118  		// connection, but we need to prevent the Server from
  1119  		// dealing with the connection further if it's not
  1120  		// hijacked. Set Close to ensure that:
  1121  		req.Close = true
  1122  	}
  1123  	return req, nil
  1124  }
  1125  
  1126  // MaxBytesReader is similar to io.LimitReader but is intended for
  1127  // limiting the size of incoming request bodies. In contrast to
  1128  // io.LimitReader, MaxBytesReader's result is a ReadCloser, returns a
  1129  // non-nil error of type *MaxBytesError for a Read beyond the limit,
  1130  // and closes the underlying reader when its Close method is called.
  1131  //
  1132  // MaxBytesReader prevents clients from accidentally or maliciously
  1133  // sending a large request and wasting server resources. If possible,
  1134  // it tells the ResponseWriter to close the connection after the limit
  1135  // has been reached.
  1136  func MaxBytesReader(w ResponseWriter, r io.ReadCloser, n int64) io.ReadCloser {
  1137  	if n < 0 { // Treat negative limits as equivalent to 0.
  1138  		n = 0
  1139  	}
  1140  	return &maxBytesReader{w: w, r: r, i: n, n: n}
  1141  }
  1142  
  1143  // MaxBytesError is returned by MaxBytesReader when its read limit is exceeded.
  1144  type MaxBytesError struct {
  1145  	Limit int64
  1146  }
  1147  
  1148  func (e *MaxBytesError) Error() string {
  1149  	// Due to Hyrum's law, this text cannot be changed.
  1150  	return "http: request body too large"
  1151  }
  1152  
  1153  type maxBytesReader struct {
  1154  	w   ResponseWriter
  1155  	r   io.ReadCloser // underlying reader
  1156  	i   int64         // max bytes initially, for MaxBytesError
  1157  	n   int64         // max bytes remaining
  1158  	err error         // sticky error
  1159  }
  1160  
  1161  func (l *maxBytesReader) Read(p []byte) (n int, err error) {
  1162  	if l.err != nil {
  1163  		return 0, l.err
  1164  	}
  1165  	if len(p) == 0 {
  1166  		return 0, nil
  1167  	}
  1168  	// If they asked for a 32KB byte read but only 5 bytes are
  1169  	// remaining, no need to read 32KB. 6 bytes will answer the
  1170  	// question of the whether we hit the limit or go past it.
  1171  	if int64(len(p)) > l.n+1 {
  1172  		p = p[:l.n+1]
  1173  	}
  1174  	n, err = l.r.Read(p)
  1175  
  1176  	if int64(n) <= l.n {
  1177  		l.n -= int64(n)
  1178  		l.err = err
  1179  		return n, err
  1180  	}
  1181  
  1182  	n = int(l.n)
  1183  	l.n = 0
  1184  
  1185  	// The server code and client code both use
  1186  	// maxBytesReader. This "requestTooLarge" check is
  1187  	// only used by the server code. To prevent binaries
  1188  	// which only using the HTTP Client code (such as
  1189  	// cmd/go) from also linking in the HTTP server, don't
  1190  	// use a static type assertion to the server
  1191  	// "*response" type. Check this interface instead:
  1192  	type requestTooLarger interface {
  1193  		requestTooLarge()
  1194  	}
  1195  	if res, ok := l.w.(requestTooLarger); ok {
  1196  		res.requestTooLarge()
  1197  	}
  1198  	l.err = &MaxBytesError{l.i}
  1199  	return n, l.err
  1200  }
  1201  
  1202  func (l *maxBytesReader) Close() error {
  1203  	return l.r.Close()
  1204  }
  1205  
  1206  func copyValues(dst, src url.Values) {
  1207  	for k, vs := range src {
  1208  		dst[k] = append(dst[k], vs...)
  1209  	}
  1210  }
  1211  
  1212  func parsePostForm(r *Request) (vs url.Values, err error) {
  1213  	if r.Body == nil {
  1214  		err = errors.New("missing form body")
  1215  		return
  1216  	}
  1217  	ct := r.Header.Get("Content-Type")
  1218  	// RFC 7231, section 3.1.1.5 - empty type
  1219  	//   MAY be treated as application/octet-stream
  1220  	if ct == "" {
  1221  		ct = "application/octet-stream"
  1222  	}
  1223  	ct, _, err = mime.ParseMediaType(ct)
  1224  	switch {
  1225  	case ct == "application/x-www-form-urlencoded":
  1226  		var reader io.Reader = r.Body
  1227  		maxFormSize := int64(1<<63 - 1)
  1228  		if _, ok := r.Body.(*maxBytesReader); !ok {
  1229  			maxFormSize = int64(10 << 20) // 10 MB is a lot of text.
  1230  			reader = io.LimitReader(r.Body, maxFormSize+1)
  1231  		}
  1232  		b, e := io.ReadAll(reader)
  1233  		if e != nil {
  1234  			if err == nil {
  1235  				err = e
  1236  			}
  1237  			break
  1238  		}
  1239  		if int64(len(b)) > maxFormSize {
  1240  			err = errors.New("http: POST too large")
  1241  			return
  1242  		}
  1243  		vs, e = url.ParseQuery(string(b))
  1244  		if err == nil {
  1245  			err = e
  1246  		}
  1247  	case ct == "multipart/form-data":
  1248  		// handled by ParseMultipartForm (which is calling us, or should be)
  1249  		// TODO(bradfitz): there are too many possible
  1250  		// orders to call too many functions here.
  1251  		// Clean this up and write more tests.
  1252  		// request_test.go contains the start of this,
  1253  		// in TestParseMultipartFormOrder and others.
  1254  	}
  1255  	return
  1256  }
  1257  
  1258  // ParseForm populates r.Form and r.PostForm.
  1259  //
  1260  // For all requests, ParseForm parses the raw query from the URL and updates
  1261  // r.Form.
  1262  //
  1263  // For POST, PUT, and PATCH requests, it also reads the request body, parses it
  1264  // as a form and puts the results into both r.PostForm and r.Form. Request body
  1265  // parameters take precedence over URL query string values in r.Form.
  1266  //
  1267  // If the request Body's size has not already been limited by MaxBytesReader,
  1268  // the size is capped at 10MB.
  1269  //
  1270  // For other HTTP methods, or when the Content-Type is not
  1271  // application/x-www-form-urlencoded, the request Body is not read, and
  1272  // r.PostForm is initialized to a non-nil, empty value.
  1273  //
  1274  // ParseMultipartForm calls ParseForm automatically.
  1275  // ParseForm is idempotent.
  1276  func (r *Request) ParseForm() error {
  1277  	var err error
  1278  	if r.PostForm == nil {
  1279  		if r.Method == "POST" || r.Method == "PUT" || r.Method == "PATCH" {
  1280  			r.PostForm, err = parsePostForm(r)
  1281  		}
  1282  		if r.PostForm == nil {
  1283  			r.PostForm = make(url.Values)
  1284  		}
  1285  	}
  1286  	if r.Form == nil {
  1287  		if len(r.PostForm) > 0 {
  1288  			r.Form = make(url.Values)
  1289  			copyValues(r.Form, r.PostForm)
  1290  		}
  1291  		var newValues url.Values
  1292  		if r.URL != nil {
  1293  			var e error
  1294  			newValues, e = url.ParseQuery(r.URL.RawQuery)
  1295  			if err == nil {
  1296  				err = e
  1297  			}
  1298  		}
  1299  		if newValues == nil {
  1300  			newValues = make(url.Values)
  1301  		}
  1302  		if r.Form == nil {
  1303  			r.Form = newValues
  1304  		} else {
  1305  			copyValues(r.Form, newValues)
  1306  		}
  1307  	}
  1308  	return err
  1309  }
  1310  
  1311  // ParseMultipartForm parses a request body as multipart/form-data.
  1312  // The whole request body is parsed and up to a total of maxMemory bytes of
  1313  // its file parts are stored in memory, with the remainder stored on
  1314  // disk in temporary files.
  1315  // ParseMultipartForm calls ParseForm if necessary.
  1316  // If ParseForm returns an error, ParseMultipartForm returns it but also
  1317  // continues parsing the request body.
  1318  // After one call to ParseMultipartForm, subsequent calls have no effect.
  1319  func (r *Request) ParseMultipartForm(maxMemory int64) error {
  1320  	if r.MultipartForm == multipartByReader {
  1321  		return errors.New("http: multipart handled by MultipartReader")
  1322  	}
  1323  	var parseFormErr error
  1324  	if r.Form == nil {
  1325  		// Let errors in ParseForm fall through, and just
  1326  		// return it at the end.
  1327  		parseFormErr = r.ParseForm()
  1328  	}
  1329  	if r.MultipartForm != nil {
  1330  		return nil
  1331  	}
  1332  
  1333  	mr, err := r.multipartReader(false)
  1334  	if err != nil {
  1335  		return err
  1336  	}
  1337  
  1338  	f, err := mr.ReadForm(maxMemory)
  1339  	if err != nil {
  1340  		return err
  1341  	}
  1342  
  1343  	if r.PostForm == nil {
  1344  		r.PostForm = make(url.Values)
  1345  	}
  1346  	for k, v := range f.Value {
  1347  		r.Form[k] = append(r.Form[k], v...)
  1348  		// r.PostForm should also be populated. See Issue 9305.
  1349  		r.PostForm[k] = append(r.PostForm[k], v...)
  1350  	}
  1351  
  1352  	r.MultipartForm = f
  1353  
  1354  	return parseFormErr
  1355  }
  1356  
  1357  // FormValue returns the first value for the named component of the query.
  1358  // POST and PUT body parameters take precedence over URL query string values.
  1359  // FormValue calls ParseMultipartForm and ParseForm if necessary and ignores
  1360  // any errors returned by these functions.
  1361  // If key is not present, FormValue returns the empty string.
  1362  // To access multiple values of the same key, call ParseForm and
  1363  // then inspect Request.Form directly.
  1364  func (r *Request) FormValue(key string) string {
  1365  	if r.Form == nil {
  1366  		r.ParseMultipartForm(defaultMaxMemory)
  1367  	}
  1368  	if vs := r.Form[key]; len(vs) > 0 {
  1369  		return vs[0]
  1370  	}
  1371  	return ""
  1372  }
  1373  
  1374  // PostFormValue returns the first value for the named component of the POST,
  1375  // PATCH, or PUT request body. URL query parameters are ignored.
  1376  // PostFormValue calls ParseMultipartForm and ParseForm if necessary and ignores
  1377  // any errors returned by these functions.
  1378  // If key is not present, PostFormValue returns the empty string.
  1379  func (r *Request) PostFormValue(key string) string {
  1380  	if r.PostForm == nil {
  1381  		r.ParseMultipartForm(defaultMaxMemory)
  1382  	}
  1383  	if vs := r.PostForm[key]; len(vs) > 0 {
  1384  		return vs[0]
  1385  	}
  1386  	return ""
  1387  }
  1388  
  1389  // FormFile returns the first file for the provided form key.
  1390  // FormFile calls ParseMultipartForm and ParseForm if necessary.
  1391  func (r *Request) FormFile(key string) (multipart.File, *multipart.FileHeader, error) {
  1392  	if r.MultipartForm == multipartByReader {
  1393  		return nil, nil, errors.New("http: multipart handled by MultipartReader")
  1394  	}
  1395  	if r.MultipartForm == nil {
  1396  		err := r.ParseMultipartForm(defaultMaxMemory)
  1397  		if err != nil {
  1398  			return nil, nil, err
  1399  		}
  1400  	}
  1401  	if r.MultipartForm != nil && r.MultipartForm.File != nil {
  1402  		if fhs := r.MultipartForm.File[key]; len(fhs) > 0 {
  1403  			f, err := fhs[0].Open()
  1404  			return f, fhs[0], err
  1405  		}
  1406  	}
  1407  	return nil, nil, ErrMissingFile
  1408  }
  1409  
  1410  func (r *Request) expectsContinue() bool {
  1411  	return hasToken(r.Header.get("Expect"), "100-continue")
  1412  }
  1413  
  1414  func (r *Request) wantsHttp10KeepAlive() bool {
  1415  	if r.ProtoMajor != 1 || r.ProtoMinor != 0 {
  1416  		return false
  1417  	}
  1418  	return hasToken(r.Header.get("Connection"), "keep-alive")
  1419  }
  1420  
  1421  func (r *Request) wantsClose() bool {
  1422  	if r.Close {
  1423  		return true
  1424  	}
  1425  	return hasToken(r.Header.get("Connection"), "close")
  1426  }
  1427  
  1428  func (r *Request) closeBody() error {
  1429  	if r.Body == nil {
  1430  		return nil
  1431  	}
  1432  	return r.Body.Close()
  1433  }
  1434  
  1435  func (r *Request) isReplayable() bool {
  1436  	if r.Body == nil || r.Body == NoBody || r.GetBody != nil {
  1437  		switch valueOrDefault(r.Method, "GET") {
  1438  		case "GET", "HEAD", "OPTIONS", "TRACE":
  1439  			return true
  1440  		}
  1441  		// The Idempotency-Key, while non-standard, is widely used to
  1442  		// mean a POST or other request is idempotent. See
  1443  		// https://golang.org/issue/19943#issuecomment-421092421
  1444  		if r.Header.has("Idempotency-Key") || r.Header.has("X-Idempotency-Key") {
  1445  			return true
  1446  		}
  1447  	}
  1448  	return false
  1449  }
  1450  
  1451  // outgoingLength reports the Content-Length of this outgoing (Client) request.
  1452  // It maps 0 into -1 (unknown) when the Body is non-nil.
  1453  func (r *Request) outgoingLength() int64 {
  1454  	if r.Body == nil || r.Body == NoBody {
  1455  		return 0
  1456  	}
  1457  	if r.ContentLength != 0 {
  1458  		return r.ContentLength
  1459  	}
  1460  	return -1
  1461  }
  1462  
  1463  // requestMethodUsuallyLacksBody reports whether the given request
  1464  // method is one that typically does not involve a request body.
  1465  // This is used by the Transport (via
  1466  // transferWriter.shouldSendChunkedRequestBody) to determine whether
  1467  // we try to test-read a byte from a non-nil Request.Body when
  1468  // Request.outgoingLength() returns -1. See the comments in
  1469  // shouldSendChunkedRequestBody.
  1470  func requestMethodUsuallyLacksBody(method string) bool {
  1471  	switch method {
  1472  	case "GET", "HEAD", "DELETE", "OPTIONS", "PROPFIND", "SEARCH":
  1473  		return true
  1474  	}
  1475  	return false
  1476  }
  1477  
  1478  // requiresHTTP1 reports whether this request requires being sent on
  1479  // an HTTP/1 connection.
  1480  func (r *Request) requiresHTTP1() bool {
  1481  	return hasToken(r.Header.Get("Connection"), "upgrade") &&
  1482  		ascii.EqualFold(r.Header.Get("Upgrade"), "websocket")
  1483  }
  1484  

View as plain text