Source file src/net/http/request.go
1 // Copyright 2009 The Go Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style 3 // license that can be found in the LICENSE file. 4 5 // HTTP Request reading and parsing. 6 7 package http 8 9 import ( 10 "bufio" 11 "bytes" 12 "context" 13 "crypto/tls" 14 "encoding/base64" 15 "errors" 16 "fmt" 17 "io" 18 "mime" 19 "mime/multipart" 20 "net" 21 "net/http/httptrace" 22 "net/http/internal/ascii" 23 "net/textproto" 24 "net/url" 25 urlpkg "net/url" 26 "strconv" 27 "strings" 28 "sync" 29 30 "golang.org/x/net/idna" 31 ) 32 33 const ( 34 defaultMaxMemory = 32 << 20 // 32 MB 35 ) 36 37 // ErrMissingFile is returned by FormFile when the provided file field name 38 // is either not present in the request or not a file field. 39 var ErrMissingFile = errors.New("http: no such file") 40 41 // ProtocolError represents an HTTP protocol error. 42 // 43 // Deprecated: Not all errors in the http package related to protocol errors 44 // are of type ProtocolError. 45 type ProtocolError struct { 46 ErrorString string 47 } 48 49 func (pe *ProtocolError) Error() string { return pe.ErrorString } 50 51 var ( 52 // ErrNotSupported indicates that a feature is not supported. 53 // 54 // It is returned by ResponseController methods to indicate that 55 // the handler does not support the method, and by the Push method 56 // of Pusher implementations to indicate that HTTP/2 Push support 57 // is not available. 58 ErrNotSupported = &ProtocolError{"feature not supported"} 59 60 // Deprecated: ErrUnexpectedTrailer is no longer returned by 61 // anything in the net/http package. Callers should not 62 // compare errors against this variable. 63 ErrUnexpectedTrailer = &ProtocolError{"trailer header without chunked transfer encoding"} 64 65 // ErrMissingBoundary is returned by Request.MultipartReader when the 66 // request's Content-Type does not include a "boundary" parameter. 67 ErrMissingBoundary = &ProtocolError{"no multipart boundary param in Content-Type"} 68 69 // ErrNotMultipart is returned by Request.MultipartReader when the 70 // request's Content-Type is not multipart/form-data. 71 ErrNotMultipart = &ProtocolError{"request Content-Type isn't multipart/form-data"} 72 73 // Deprecated: ErrHeaderTooLong is no longer returned by 74 // anything in the net/http package. Callers should not 75 // compare errors against this variable. 76 ErrHeaderTooLong = &ProtocolError{"header too long"} 77 78 // Deprecated: ErrShortBody is no longer returned by 79 // anything in the net/http package. Callers should not 80 // compare errors against this variable. 81 ErrShortBody = &ProtocolError{"entity body too short"} 82 83 // Deprecated: ErrMissingContentLength is no longer returned by 84 // anything in the net/http package. Callers should not 85 // compare errors against this variable. 86 ErrMissingContentLength = &ProtocolError{"missing ContentLength in HEAD response"} 87 ) 88 89 func badStringError(what, val string) error { return fmt.Errorf("%s %q", what, val) } 90 91 // Headers that Request.Write handles itself and should be skipped. 92 var reqWriteExcludeHeader = map[string]bool{ 93 "Host": true, // not in Header map anyway 94 "User-Agent": true, 95 "Content-Length": true, 96 "Transfer-Encoding": true, 97 "Trailer": true, 98 } 99 100 // A Request represents an HTTP request received by a server 101 // or to be sent by a client. 102 // 103 // The field semantics differ slightly between client and server 104 // usage. In addition to the notes on the fields below, see the 105 // documentation for Request.Write and RoundTripper. 106 type Request struct { 107 // Method specifies the HTTP method (GET, POST, PUT, etc.). 108 // For client requests, an empty string means GET. 109 // 110 // Go's HTTP client does not support sending a request with 111 // the CONNECT method. See the documentation on Transport for 112 // details. 113 Method string 114 115 // URL specifies either the URI being requested (for server 116 // requests) or the URL to access (for client requests). 117 // 118 // For server requests, the URL is parsed from the URI 119 // supplied on the Request-Line as stored in RequestURI. For 120 // most requests, fields other than Path and RawQuery will be 121 // empty. (See RFC 7230, Section 5.3) 122 // 123 // For client requests, the URL's Host specifies the server to 124 // connect to, while the Request's Host field optionally 125 // specifies the Host header value to send in the HTTP 126 // request. 127 URL *url.URL 128 129 // The protocol version for incoming server requests. 130 // 131 // For client requests, these fields are ignored. The HTTP 132 // client code always uses either HTTP/1.1 or HTTP/2. 133 // See the docs on Transport for details. 134 Proto string // "HTTP/1.0" 135 ProtoMajor int // 1 136 ProtoMinor int // 0 137 138 // Header contains the request header fields either received 139 // by the server or to be sent by the client. 140 // 141 // If a server received a request with header lines, 142 // 143 // Host: example.com 144 // accept-encoding: gzip, deflate 145 // Accept-Language: en-us 146 // fOO: Bar 147 // foo: two 148 // 149 // then 150 // 151 // Header = map[string][]string{ 152 // "Accept-Encoding": {"gzip, deflate"}, 153 // "Accept-Language": {"en-us"}, 154 // "Foo": {"Bar", "two"}, 155 // } 156 // 157 // For incoming requests, the Host header is promoted to the 158 // Request.Host field and removed from the Header map. 159 // 160 // HTTP defines that header names are case-insensitive. The 161 // request parser implements this by using CanonicalHeaderKey, 162 // making the first character and any characters following a 163 // hyphen uppercase and the rest lowercase. 164 // 165 // For client requests, certain headers such as Content-Length 166 // and Connection are automatically written when needed and 167 // values in Header may be ignored. See the documentation 168 // for the Request.Write method. 169 Header Header 170 171 // Body is the request's body. 172 // 173 // For client requests, a nil body means the request has no 174 // body, such as a GET request. The HTTP Client's Transport 175 // is responsible for calling the Close method. 176 // 177 // For server requests, the Request Body is always non-nil 178 // but will return EOF immediately when no body is present. 179 // The Server will close the request body. The ServeHTTP 180 // Handler does not need to. 181 // 182 // Body must allow Read to be called concurrently with Close. 183 // In particular, calling Close should unblock a Read waiting 184 // for input. 185 Body io.ReadCloser 186 187 // GetBody defines an optional func to return a new copy of 188 // Body. It is used for client requests when a redirect requires 189 // reading the body more than once. Use of GetBody still 190 // requires setting Body. 191 // 192 // For server requests, it is unused. 193 GetBody func() (io.ReadCloser, error) 194 195 // ContentLength records the length of the associated content. 196 // The value -1 indicates that the length is unknown. 197 // Values >= 0 indicate that the given number of bytes may 198 // be read from Body. 199 // 200 // For client requests, a value of 0 with a non-nil Body is 201 // also treated as unknown. 202 ContentLength int64 203 204 // TransferEncoding lists the transfer encodings from outermost to 205 // innermost. An empty list denotes the "identity" encoding. 206 // TransferEncoding can usually be ignored; chunked encoding is 207 // automatically added and removed as necessary when sending and 208 // receiving requests. 209 TransferEncoding []string 210 211 // Close indicates whether to close the connection after 212 // replying to this request (for servers) or after sending this 213 // request and reading its response (for clients). 214 // 215 // For server requests, the HTTP server handles this automatically 216 // and this field is not needed by Handlers. 217 // 218 // For client requests, setting this field prevents re-use of 219 // TCP connections between requests to the same hosts, as if 220 // Transport.DisableKeepAlives were set. 221 Close bool 222 223 // For server requests, Host specifies the host on which the 224 // URL is sought. For HTTP/1 (per RFC 7230, section 5.4), this 225 // is either the value of the "Host" header or the host name 226 // given in the URL itself. For HTTP/2, it is the value of the 227 // ":authority" pseudo-header field. 228 // It may be of the form "host:port". For international domain 229 // names, Host may be in Punycode or Unicode form. Use 230 // golang.org/x/net/idna to convert it to either format if 231 // needed. 232 // To prevent DNS rebinding attacks, server Handlers should 233 // validate that the Host header has a value for which the 234 // Handler considers itself authoritative. The included 235 // ServeMux supports patterns registered to particular host 236 // names and thus protects its registered Handlers. 237 // 238 // For client requests, Host optionally overrides the Host 239 // header to send. If empty, the Request.Write method uses 240 // the value of URL.Host. Host may contain an international 241 // domain name. 242 Host string 243 244 // Form contains the parsed form data, including both the URL 245 // field's query parameters and the PATCH, POST, or PUT form data. 246 // This field is only available after ParseForm is called. 247 // The HTTP client ignores Form and uses Body instead. 248 Form url.Values 249 250 // PostForm contains the parsed form data from PATCH, POST 251 // or PUT body parameters. 252 // 253 // This field is only available after ParseForm is called. 254 // The HTTP client ignores PostForm and uses Body instead. 255 PostForm url.Values 256 257 // MultipartForm is the parsed multipart form, including file uploads. 258 // This field is only available after ParseMultipartForm is called. 259 // The HTTP client ignores MultipartForm and uses Body instead. 260 MultipartForm *multipart.Form 261 262 // Trailer specifies additional headers that are sent after the request 263 // body. 264 // 265 // For server requests, the Trailer map initially contains only the 266 // trailer keys, with nil values. (The client declares which trailers it 267 // will later send.) While the handler is reading from Body, it must 268 // not reference Trailer. After reading from Body returns EOF, Trailer 269 // can be read again and will contain non-nil values, if they were sent 270 // by the client. 271 // 272 // For client requests, Trailer must be initialized to a map containing 273 // the trailer keys to later send. The values may be nil or their final 274 // values. The ContentLength must be 0 or -1, to send a chunked request. 275 // After the HTTP request is sent the map values can be updated while 276 // the request body is read. Once the body returns EOF, the caller must 277 // not mutate Trailer. 278 // 279 // Few HTTP clients, servers, or proxies support HTTP trailers. 280 Trailer Header 281 282 // RemoteAddr allows HTTP servers and other software to record 283 // the network address that sent the request, usually for 284 // logging. This field is not filled in by ReadRequest and 285 // has no defined format. The HTTP server in this package 286 // sets RemoteAddr to an "IP:port" address before invoking a 287 // handler. 288 // This field is ignored by the HTTP client. 289 RemoteAddr string 290 291 // RequestURI is the unmodified request-target of the 292 // Request-Line (RFC 7230, Section 3.1.1) as sent by the client 293 // to a server. Usually the URL field should be used instead. 294 // It is an error to set this field in an HTTP client request. 295 RequestURI string 296 297 // TLS allows HTTP servers and other software to record 298 // information about the TLS connection on which the request 299 // was received. This field is not filled in by ReadRequest. 300 // The HTTP server in this package sets the field for 301 // TLS-enabled connections before invoking a handler; 302 // otherwise it leaves the field nil. 303 // This field is ignored by the HTTP client. 304 TLS *tls.ConnectionState 305 306 // Cancel is an optional channel whose closure indicates that the client 307 // request should be regarded as canceled. Not all implementations of 308 // RoundTripper may support Cancel. 309 // 310 // For server requests, this field is not applicable. 311 // 312 // Deprecated: Set the Request's context with NewRequestWithContext 313 // instead. If a Request's Cancel field and context are both 314 // set, it is undefined whether Cancel is respected. 315 Cancel <-chan struct{} 316 317 // Response is the redirect response which caused this request 318 // to be created. This field is only populated during client 319 // redirects. 320 Response *Response 321 322 // ctx is either the client or server context. It should only 323 // be modified via copying the whole Request using Clone or WithContext. 324 // It is unexported to prevent people from using Context wrong 325 // and mutating the contexts held by callers of the same request. 326 ctx context.Context 327 } 328 329 // Context returns the request's context. To change the context, use 330 // Clone or WithContext. 331 // 332 // The returned context is always non-nil; it defaults to the 333 // background context. 334 // 335 // For outgoing client requests, the context controls cancellation. 336 // 337 // For incoming server requests, the context is canceled when the 338 // client's connection closes, the request is canceled (with HTTP/2), 339 // or when the ServeHTTP method returns. 340 func (r *Request) Context() context.Context { 341 if r.ctx != nil { 342 return r.ctx 343 } 344 return context.Background() 345 } 346 347 // WithContext returns a shallow copy of r with its context changed 348 // to ctx. The provided ctx must be non-nil. 349 // 350 // For outgoing client request, the context controls the entire 351 // lifetime of a request and its response: obtaining a connection, 352 // sending the request, and reading the response headers and body. 353 // 354 // To create a new request with a context, use NewRequestWithContext. 355 // To make a deep copy of a request with a new context, use Request.Clone. 356 func (r *Request) WithContext(ctx context.Context) *Request { 357 if ctx == nil { 358 panic("nil context") 359 } 360 r2 := new(Request) 361 *r2 = *r 362 r2.ctx = ctx 363 return r2 364 } 365 366 // Clone returns a deep copy of r with its context changed to ctx. 367 // The provided ctx must be non-nil. 368 // 369 // For an outgoing client request, the context controls the entire 370 // lifetime of a request and its response: obtaining a connection, 371 // sending the request, and reading the response headers and body. 372 func (r *Request) Clone(ctx context.Context) *Request { 373 if ctx == nil { 374 panic("nil context") 375 } 376 r2 := new(Request) 377 *r2 = *r 378 r2.ctx = ctx 379 r2.URL = cloneURL(r.URL) 380 if r.Header != nil { 381 r2.Header = r.Header.Clone() 382 } 383 if r.Trailer != nil { 384 r2.Trailer = r.Trailer.Clone() 385 } 386 if s := r.TransferEncoding; s != nil { 387 s2 := make([]string, len(s)) 388 copy(s2, s) 389 r2.TransferEncoding = s2 390 } 391 r2.Form = cloneURLValues(r.Form) 392 r2.PostForm = cloneURLValues(r.PostForm) 393 r2.MultipartForm = cloneMultipartForm(r.MultipartForm) 394 return r2 395 } 396 397 // ProtoAtLeast reports whether the HTTP protocol used 398 // in the request is at least major.minor. 399 func (r *Request) ProtoAtLeast(major, minor int) bool { 400 return r.ProtoMajor > major || 401 r.ProtoMajor == major && r.ProtoMinor >= minor 402 } 403 404 // UserAgent returns the client's User-Agent, if sent in the request. 405 func (r *Request) UserAgent() string { 406 return r.Header.Get("User-Agent") 407 } 408 409 // Cookies parses and returns the HTTP cookies sent with the request. 410 func (r *Request) Cookies() []*Cookie { 411 return readCookies(r.Header, "") 412 } 413 414 // ErrNoCookie is returned by Request's Cookie method when a cookie is not found. 415 var ErrNoCookie = errors.New("http: named cookie not present") 416 417 // Cookie returns the named cookie provided in the request or 418 // ErrNoCookie if not found. 419 // If multiple cookies match the given name, only one cookie will 420 // be returned. 421 func (r *Request) Cookie(name string) (*Cookie, error) { 422 if name == "" { 423 return nil, ErrNoCookie 424 } 425 for _, c := range readCookies(r.Header, name) { 426 return c, nil 427 } 428 return nil, ErrNoCookie 429 } 430 431 // AddCookie adds a cookie to the request. Per RFC 6265 section 5.4, 432 // AddCookie does not attach more than one Cookie header field. That 433 // means all cookies, if any, are written into the same line, 434 // separated by semicolon. 435 // AddCookie only sanitizes c's name and value, and does not sanitize 436 // a Cookie header already present in the request. 437 func (r *Request) AddCookie(c *Cookie) { 438 s := fmt.Sprintf("%s=%s", sanitizeCookieName(c.Name), sanitizeCookieValue(c.Value)) 439 if c := r.Header.Get("Cookie"); c != "" { 440 r.Header.Set("Cookie", c+"; "+s) 441 } else { 442 r.Header.Set("Cookie", s) 443 } 444 } 445 446 // Referer returns the referring URL, if sent in the request. 447 // 448 // Referer is misspelled as in the request itself, a mistake from the 449 // earliest days of HTTP. This value can also be fetched from the 450 // Header map as Header["Referer"]; the benefit of making it available 451 // as a method is that the compiler can diagnose programs that use the 452 // alternate (correct English) spelling req.Referrer() but cannot 453 // diagnose programs that use Header["Referrer"]. 454 func (r *Request) Referer() string { 455 return r.Header.Get("Referer") 456 } 457 458 // multipartByReader is a sentinel value. 459 // Its presence in Request.MultipartForm indicates that parsing of the request 460 // body has been handed off to a MultipartReader instead of ParseMultipartForm. 461 var multipartByReader = &multipart.Form{ 462 Value: make(map[string][]string), 463 File: make(map[string][]*multipart.FileHeader), 464 } 465 466 // MultipartReader returns a MIME multipart reader if this is a 467 // multipart/form-data or a multipart/mixed POST request, else returns nil and an error. 468 // Use this function instead of ParseMultipartForm to 469 // process the request body as a stream. 470 func (r *Request) MultipartReader() (*multipart.Reader, error) { 471 if r.MultipartForm == multipartByReader { 472 return nil, errors.New("http: MultipartReader called twice") 473 } 474 if r.MultipartForm != nil { 475 return nil, errors.New("http: multipart handled by ParseMultipartForm") 476 } 477 r.MultipartForm = multipartByReader 478 return r.multipartReader(true) 479 } 480 481 func (r *Request) multipartReader(allowMixed bool) (*multipart.Reader, error) { 482 v := r.Header.Get("Content-Type") 483 if v == "" { 484 return nil, ErrNotMultipart 485 } 486 if r.Body == nil { 487 return nil, errors.New("missing form body") 488 } 489 d, params, err := mime.ParseMediaType(v) 490 if err != nil || !(d == "multipart/form-data" || allowMixed && d == "multipart/mixed") { 491 return nil, ErrNotMultipart 492 } 493 boundary, ok := params["boundary"] 494 if !ok { 495 return nil, ErrMissingBoundary 496 } 497 return multipart.NewReader(r.Body, boundary), nil 498 } 499 500 // isH2Upgrade reports whether r represents the http2 "client preface" 501 // magic string. 502 func (r *Request) isH2Upgrade() bool { 503 return r.Method == "PRI" && len(r.Header) == 0 && r.URL.Path == "*" && r.Proto == "HTTP/2.0" 504 } 505 506 // Return value if nonempty, def otherwise. 507 func valueOrDefault(value, def string) string { 508 if value != "" { 509 return value 510 } 511 return def 512 } 513 514 // NOTE: This is not intended to reflect the actual Go version being used. 515 // It was changed at the time of Go 1.1 release because the former User-Agent 516 // had ended up blocked by some intrusion detection systems. 517 // See https://codereview.appspot.com/7532043. 518 const defaultUserAgent = "Go-http-client/1.1" 519 520 // Write writes an HTTP/1.1 request, which is the header and body, in wire format. 521 // This method consults the following fields of the request: 522 // 523 // Host 524 // URL 525 // Method (defaults to "GET") 526 // Header 527 // ContentLength 528 // TransferEncoding 529 // Body 530 // 531 // If Body is present, Content-Length is <= 0 and TransferEncoding 532 // hasn't been set to "identity", Write adds "Transfer-Encoding: 533 // chunked" to the header. Body is closed after it is sent. 534 func (r *Request) Write(w io.Writer) error { 535 return r.write(w, false, nil, nil) 536 } 537 538 // WriteProxy is like Write but writes the request in the form 539 // expected by an HTTP proxy. In particular, WriteProxy writes the 540 // initial Request-URI line of the request with an absolute URI, per 541 // section 5.3 of RFC 7230, including the scheme and host. 542 // In either case, WriteProxy also writes a Host header, using 543 // either r.Host or r.URL.Host. 544 func (r *Request) WriteProxy(w io.Writer) error { 545 return r.write(w, true, nil, nil) 546 } 547 548 // errMissingHost is returned by Write when there is no Host or URL present in 549 // the Request. 550 var errMissingHost = errors.New("http: Request.Write on Request with no Host or URL set") 551 552 // extraHeaders may be nil 553 // waitForContinue may be nil 554 // always closes body 555 func (r *Request) write(w io.Writer, usingProxy bool, extraHeaders Header, waitForContinue func() bool) (err error) { 556 trace := httptrace.ContextClientTrace(r.Context()) 557 if trace != nil && trace.WroteRequest != nil { 558 defer func() { 559 trace.WroteRequest(httptrace.WroteRequestInfo{ 560 Err: err, 561 }) 562 }() 563 } 564 closed := false 565 defer func() { 566 if closed { 567 return 568 } 569 if closeErr := r.closeBody(); closeErr != nil && err == nil { 570 err = closeErr 571 } 572 }() 573 574 // Find the target host. Prefer the Host: header, but if that 575 // is not given, use the host from the request URL. 576 // 577 // Clean the host, in case it arrives with unexpected stuff in it. 578 host := cleanHost(r.Host) 579 if host == "" { 580 if r.URL == nil { 581 return errMissingHost 582 } 583 host = cleanHost(r.URL.Host) 584 } 585 586 // According to RFC 6874, an HTTP client, proxy, or other 587 // intermediary must remove any IPv6 zone identifier attached 588 // to an outgoing URI. 589 host = removeZone(host) 590 591 ruri := r.URL.RequestURI() 592 if usingProxy && r.URL.Scheme != "" && r.URL.Opaque == "" { 593 ruri = r.URL.Scheme + "://" + host + ruri 594 } else if r.Method == "CONNECT" && r.URL.Path == "" { 595 // CONNECT requests normally give just the host and port, not a full URL. 596 ruri = host 597 if r.URL.Opaque != "" { 598 ruri = r.URL.Opaque 599 } 600 } 601 if stringContainsCTLByte(ruri) { 602 return errors.New("net/http: can't write control character in Request.URL") 603 } 604 // TODO: validate r.Method too? At least it's less likely to 605 // come from an attacker (more likely to be a constant in 606 // code). 607 608 // Wrap the writer in a bufio Writer if it's not already buffered. 609 // Don't always call NewWriter, as that forces a bytes.Buffer 610 // and other small bufio Writers to have a minimum 4k buffer 611 // size. 612 var bw *bufio.Writer 613 if _, ok := w.(io.ByteWriter); !ok { 614 bw = bufio.NewWriter(w) 615 w = bw 616 } 617 618 _, err = fmt.Fprintf(w, "%s %s HTTP/1.1\r\n", valueOrDefault(r.Method, "GET"), ruri) 619 if err != nil { 620 return err 621 } 622 623 // Header lines 624 _, err = fmt.Fprintf(w, "Host: %s\r\n", host) 625 if err != nil { 626 return err 627 } 628 if trace != nil && trace.WroteHeaderField != nil { 629 trace.WroteHeaderField("Host", []string{host}) 630 } 631 632 // Use the defaultUserAgent unless the Header contains one, which 633 // may be blank to not send the header. 634 userAgent := defaultUserAgent 635 if r.Header.has("User-Agent") { 636 userAgent = r.Header.Get("User-Agent") 637 } 638 if userAgent != "" { 639 _, err = fmt.Fprintf(w, "User-Agent: %s\r\n", userAgent) 640 if err != nil { 641 return err 642 } 643 if trace != nil && trace.WroteHeaderField != nil { 644 trace.WroteHeaderField("User-Agent", []string{userAgent}) 645 } 646 } 647 648 // Process Body,ContentLength,Close,Trailer 649 tw, err := newTransferWriter(r) 650 if err != nil { 651 return err 652 } 653 err = tw.writeHeader(w, trace) 654 if err != nil { 655 return err 656 } 657 658 err = r.Header.writeSubset(w, reqWriteExcludeHeader, trace) 659 if err != nil { 660 return err 661 } 662 663 if extraHeaders != nil { 664 err = extraHeaders.write(w, trace) 665 if err != nil { 666 return err 667 } 668 } 669 670 _, err = io.WriteString(w, "\r\n") 671 if err != nil { 672 return err 673 } 674 675 if trace != nil && trace.WroteHeaders != nil { 676 trace.WroteHeaders() 677 } 678 679 // Flush and wait for 100-continue if expected. 680 if waitForContinue != nil { 681 if bw, ok := w.(*bufio.Writer); ok { 682 err = bw.Flush() 683 if err != nil { 684 return err 685 } 686 } 687 if trace != nil && trace.Wait100Continue != nil { 688 trace.Wait100Continue() 689 } 690 if !waitForContinue() { 691 closed = true 692 r.closeBody() 693 return nil 694 } 695 } 696 697 if bw, ok := w.(*bufio.Writer); ok && tw.FlushHeaders { 698 if err := bw.Flush(); err != nil { 699 return err 700 } 701 } 702 703 // Write body and trailer 704 closed = true 705 err = tw.writeBody(w) 706 if err != nil { 707 if tw.bodyReadError == err { 708 err = requestBodyReadError{err} 709 } 710 return err 711 } 712 713 if bw != nil { 714 return bw.Flush() 715 } 716 return nil 717 } 718 719 // requestBodyReadError wraps an error from (*Request).write to indicate 720 // that the error came from a Read call on the Request.Body. 721 // This error type should not escape the net/http package to users. 722 type requestBodyReadError struct{ error } 723 724 func idnaASCII(v string) (string, error) { 725 // TODO: Consider removing this check after verifying performance is okay. 726 // Right now punycode verification, length checks, context checks, and the 727 // permissible character tests are all omitted. It also prevents the ToASCII 728 // call from salvaging an invalid IDN, when possible. As a result it may be 729 // possible to have two IDNs that appear identical to the user where the 730 // ASCII-only version causes an error downstream whereas the non-ASCII 731 // version does not. 732 // Note that for correct ASCII IDNs ToASCII will only do considerably more 733 // work, but it will not cause an allocation. 734 if ascii.Is(v) { 735 return v, nil 736 } 737 return idna.Lookup.ToASCII(v) 738 } 739 740 // cleanHost cleans up the host sent in request's Host header. 741 // 742 // It both strips anything after '/' or ' ', and puts the value 743 // into Punycode form, if necessary. 744 // 745 // Ideally we'd clean the Host header according to the spec: 746 // 747 // https://tools.ietf.org/html/rfc7230#section-5.4 (Host = uri-host [ ":" port ]") 748 // https://tools.ietf.org/html/rfc7230#section-2.7 (uri-host -> rfc3986's host) 749 // https://tools.ietf.org/html/rfc3986#section-3.2.2 (definition of host) 750 // 751 // But practically, what we are trying to avoid is the situation in 752 // issue 11206, where a malformed Host header used in the proxy context 753 // would create a bad request. So it is enough to just truncate at the 754 // first offending character. 755 func cleanHost(in string) string { 756 if i := strings.IndexAny(in, " /"); i != -1 { 757 in = in[:i] 758 } 759 host, port, err := net.SplitHostPort(in) 760 if err != nil { // input was just a host 761 a, err := idnaASCII(in) 762 if err != nil { 763 return in // garbage in, garbage out 764 } 765 return a 766 } 767 a, err := idnaASCII(host) 768 if err != nil { 769 return in // garbage in, garbage out 770 } 771 return net.JoinHostPort(a, port) 772 } 773 774 // removeZone removes IPv6 zone identifier from host. 775 // E.g., "[fe80::1%en0]:8080" to "[fe80::1]:8080" 776 func removeZone(host string) string { 777 if !strings.HasPrefix(host, "[") { 778 return host 779 } 780 i := strings.LastIndex(host, "]") 781 if i < 0 { 782 return host 783 } 784 j := strings.LastIndex(host[:i], "%") 785 if j < 0 { 786 return host 787 } 788 return host[:j] + host[i:] 789 } 790 791 // ParseHTTPVersion parses an HTTP version string according to RFC 7230, section 2.6. 792 // "HTTP/1.0" returns (1, 0, true). Note that strings without 793 // a minor version, such as "HTTP/2", are not valid. 794 func ParseHTTPVersion(vers string) (major, minor int, ok bool) { 795 switch vers { 796 case "HTTP/1.1": 797 return 1, 1, true 798 case "HTTP/1.0": 799 return 1, 0, true 800 } 801 if !strings.HasPrefix(vers, "HTTP/") { 802 return 0, 0, false 803 } 804 if len(vers) != len("HTTP/X.Y") { 805 return 0, 0, false 806 } 807 if vers[6] != '.' { 808 return 0, 0, false 809 } 810 maj, err := strconv.ParseUint(vers[5:6], 10, 0) 811 if err != nil { 812 return 0, 0, false 813 } 814 min, err := strconv.ParseUint(vers[7:8], 10, 0) 815 if err != nil { 816 return 0, 0, false 817 } 818 return int(maj), int(min), true 819 } 820 821 func validMethod(method string) bool { 822 /* 823 Method = "OPTIONS" ; Section 9.2 824 | "GET" ; Section 9.3 825 | "HEAD" ; Section 9.4 826 | "POST" ; Section 9.5 827 | "PUT" ; Section 9.6 828 | "DELETE" ; Section 9.7 829 | "TRACE" ; Section 9.8 830 | "CONNECT" ; Section 9.9 831 | extension-method 832 extension-method = token 833 token = 1*<any CHAR except CTLs or separators> 834 */ 835 return len(method) > 0 && strings.IndexFunc(method, isNotToken) == -1 836 } 837 838 // NewRequest wraps NewRequestWithContext using context.Background. 839 func NewRequest(method, url string, body io.Reader) (*Request, error) { 840 return NewRequestWithContext(context.Background(), method, url, body) 841 } 842 843 // NewRequestWithContext returns a new Request given a method, URL, and 844 // optional body. 845 // 846 // If the provided body is also an io.Closer, the returned 847 // Request.Body is set to body and will be closed by the Client 848 // methods Do, Post, and PostForm, and Transport.RoundTrip. 849 // 850 // NewRequestWithContext returns a Request suitable for use with 851 // Client.Do or Transport.RoundTrip. To create a request for use with 852 // testing a Server Handler, either use the NewRequest function in the 853 // net/http/httptest package, use ReadRequest, or manually update the 854 // Request fields. For an outgoing client request, the context 855 // controls the entire lifetime of a request and its response: 856 // obtaining a connection, sending the request, and reading the 857 // response headers and body. See the Request type's documentation for 858 // the difference between inbound and outbound request fields. 859 // 860 // If body is of type *bytes.Buffer, *bytes.Reader, or 861 // *strings.Reader, the returned request's ContentLength is set to its 862 // exact value (instead of -1), GetBody is populated (so 307 and 308 863 // redirects can replay the body), and Body is set to NoBody if the 864 // ContentLength is 0. 865 func NewRequestWithContext(ctx context.Context, method, url string, body io.Reader) (*Request, error) { 866 if method == "" { 867 // We document that "" means "GET" for Request.Method, and people have 868 // relied on that from NewRequest, so keep that working. 869 // We still enforce validMethod for non-empty methods. 870 method = "GET" 871 } 872 if !validMethod(method) { 873 return nil, fmt.Errorf("net/http: invalid method %q", method) 874 } 875 if ctx == nil { 876 return nil, errors.New("net/http: nil Context") 877 } 878 u, err := urlpkg.Parse(url) 879 if err != nil { 880 return nil, err 881 } 882 rc, ok := body.(io.ReadCloser) 883 if !ok && body != nil { 884 rc = io.NopCloser(body) 885 } 886 // The host's colon:port should be normalized. See Issue 14836. 887 u.Host = removeEmptyPort(u.Host) 888 req := &Request{ 889 ctx: ctx, 890 Method: method, 891 URL: u, 892 Proto: "HTTP/1.1", 893 ProtoMajor: 1, 894 ProtoMinor: 1, 895 Header: make(Header), 896 Body: rc, 897 Host: u.Host, 898 } 899 if body != nil { 900 switch v := body.(type) { 901 case *bytes.Buffer: 902 req.ContentLength = int64(v.Len()) 903 buf := v.Bytes() 904 req.GetBody = func() (io.ReadCloser, error) { 905 r := bytes.NewReader(buf) 906 return io.NopCloser(r), nil 907 } 908 case *bytes.Reader: 909 req.ContentLength = int64(v.Len()) 910 snapshot := *v 911 req.GetBody = func() (io.ReadCloser, error) { 912 r := snapshot 913 return io.NopCloser(&r), nil 914 } 915 case *strings.Reader: 916 req.ContentLength = int64(v.Len()) 917 snapshot := *v 918 req.GetBody = func() (io.ReadCloser, error) { 919 r := snapshot 920 return io.NopCloser(&r), nil 921 } 922 default: 923 // This is where we'd set it to -1 (at least 924 // if body != NoBody) to mean unknown, but 925 // that broke people during the Go 1.8 testing 926 // period. People depend on it being 0 I 927 // guess. Maybe retry later. See Issue 18117. 928 } 929 // For client requests, Request.ContentLength of 0 930 // means either actually 0, or unknown. The only way 931 // to explicitly say that the ContentLength is zero is 932 // to set the Body to nil. But turns out too much code 933 // depends on NewRequest returning a non-nil Body, 934 // so we use a well-known ReadCloser variable instead 935 // and have the http package also treat that sentinel 936 // variable to mean explicitly zero. 937 if req.GetBody != nil && req.ContentLength == 0 { 938 req.Body = NoBody 939 req.GetBody = func() (io.ReadCloser, error) { return NoBody, nil } 940 } 941 } 942 943 return req, nil 944 } 945 946 // BasicAuth returns the username and password provided in the request's 947 // Authorization header, if the request uses HTTP Basic Authentication. 948 // See RFC 2617, Section 2. 949 func (r *Request) BasicAuth() (username, password string, ok bool) { 950 auth := r.Header.Get("Authorization") 951 if auth == "" { 952 return "", "", false 953 } 954 return parseBasicAuth(auth) 955 } 956 957 // parseBasicAuth parses an HTTP Basic Authentication string. 958 // "Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==" returns ("Aladdin", "open sesame", true). 959 func parseBasicAuth(auth string) (username, password string, ok bool) { 960 const prefix = "Basic " 961 // Case insensitive prefix match. See Issue 22736. 962 if len(auth) < len(prefix) || !ascii.EqualFold(auth[:len(prefix)], prefix) { 963 return "", "", false 964 } 965 c, err := base64.StdEncoding.DecodeString(auth[len(prefix):]) 966 if err != nil { 967 return "", "", false 968 } 969 cs := string(c) 970 username, password, ok = strings.Cut(cs, ":") 971 if !ok { 972 return "", "", false 973 } 974 return username, password, true 975 } 976 977 // SetBasicAuth sets the request's Authorization header to use HTTP 978 // Basic Authentication with the provided username and password. 979 // 980 // With HTTP Basic Authentication the provided username and password 981 // are not encrypted. It should generally only be used in an HTTPS 982 // request. 983 // 984 // The username may not contain a colon. Some protocols may impose 985 // additional requirements on pre-escaping the username and 986 // password. For instance, when used with OAuth2, both arguments must 987 // be URL encoded first with url.QueryEscape. 988 func (r *Request) SetBasicAuth(username, password string) { 989 r.Header.Set("Authorization", "Basic "+basicAuth(username, password)) 990 } 991 992 // parseRequestLine parses "GET /foo HTTP/1.1" into its three parts. 993 func parseRequestLine(line string) (method, requestURI, proto string, ok bool) { 994 method, rest, ok1 := strings.Cut(line, " ") 995 requestURI, proto, ok2 := strings.Cut(rest, " ") 996 if !ok1 || !ok2 { 997 return "", "", "", false 998 } 999 return method, requestURI, proto, true 1000 } 1001 1002 var textprotoReaderPool sync.Pool 1003 1004 func newTextprotoReader(br *bufio.Reader) *textproto.Reader { 1005 if v := textprotoReaderPool.Get(); v != nil { 1006 tr := v.(*textproto.Reader) 1007 tr.R = br 1008 return tr 1009 } 1010 return textproto.NewReader(br) 1011 } 1012 1013 func putTextprotoReader(r *textproto.Reader) { 1014 r.R = nil 1015 textprotoReaderPool.Put(r) 1016 } 1017 1018 // ReadRequest reads and parses an incoming request from b. 1019 // 1020 // ReadRequest is a low-level function and should only be used for 1021 // specialized applications; most code should use the Server to read 1022 // requests and handle them via the Handler interface. ReadRequest 1023 // only supports HTTP/1.x requests. For HTTP/2, use golang.org/x/net/http2. 1024 func ReadRequest(b *bufio.Reader) (*Request, error) { 1025 req, err := readRequest(b) 1026 if err != nil { 1027 return nil, err 1028 } 1029 1030 delete(req.Header, "Host") 1031 return req, err 1032 } 1033 1034 func readRequest(b *bufio.Reader) (req *Request, err error) { 1035 tp := newTextprotoReader(b) 1036 defer putTextprotoReader(tp) 1037 1038 req = new(Request) 1039 1040 // First line: GET /index.html HTTP/1.0 1041 var s string 1042 if s, err = tp.ReadLine(); err != nil { 1043 return nil, err 1044 } 1045 defer func() { 1046 if err == io.EOF { 1047 err = io.ErrUnexpectedEOF 1048 } 1049 }() 1050 1051 var ok bool 1052 req.Method, req.RequestURI, req.Proto, ok = parseRequestLine(s) 1053 if !ok { 1054 return nil, badStringError("malformed HTTP request", s) 1055 } 1056 if !validMethod(req.Method) { 1057 return nil, badStringError("invalid method", req.Method) 1058 } 1059 rawurl := req.RequestURI 1060 if req.ProtoMajor, req.ProtoMinor, ok = ParseHTTPVersion(req.Proto); !ok { 1061 return nil, badStringError("malformed HTTP version", req.Proto) 1062 } 1063 1064 // CONNECT requests are used two different ways, and neither uses a full URL: 1065 // The standard use is to tunnel HTTPS through an HTTP proxy. 1066 // It looks like "CONNECT www.google.com:443 HTTP/1.1", and the parameter is 1067 // just the authority section of a URL. This information should go in req.URL.Host. 1068 // 1069 // The net/rpc package also uses CONNECT, but there the parameter is a path 1070 // that starts with a slash. It can be parsed with the regular URL parser, 1071 // and the path will end up in req.URL.Path, where it needs to be in order for 1072 // RPC to work. 1073 justAuthority := req.Method == "CONNECT" && !strings.HasPrefix(rawurl, "/") 1074 if justAuthority { 1075 rawurl = "http://" + rawurl 1076 } 1077 1078 if req.URL, err = url.ParseRequestURI(rawurl); err != nil { 1079 return nil, err 1080 } 1081 1082 if justAuthority { 1083 // Strip the bogus "http://" back off. 1084 req.URL.Scheme = "" 1085 } 1086 1087 // Subsequent lines: Key: value. 1088 mimeHeader, err := tp.ReadMIMEHeader() 1089 if err != nil { 1090 return nil, err 1091 } 1092 req.Header = Header(mimeHeader) 1093 if len(req.Header["Host"]) > 1 { 1094 return nil, fmt.Errorf("too many Host headers") 1095 } 1096 1097 // RFC 7230, section 5.3: Must treat 1098 // GET /index.html HTTP/1.1 1099 // Host: www.google.com 1100 // and 1101 // GET http://www.google.com/index.html HTTP/1.1 1102 // Host: doesntmatter 1103 // the same. In the second case, any Host line is ignored. 1104 req.Host = req.URL.Host 1105 if req.Host == "" { 1106 req.Host = req.Header.get("Host") 1107 } 1108 1109 fixPragmaCacheControl(req.Header) 1110 1111 req.Close = shouldClose(req.ProtoMajor, req.ProtoMinor, req.Header, false) 1112 1113 err = readTransfer(req, b) 1114 if err != nil { 1115 return nil, err 1116 } 1117 1118 if req.isH2Upgrade() { 1119 // Because it's neither chunked, nor declared: 1120 req.ContentLength = -1 1121 1122 // We want to give handlers a chance to hijack the 1123 // connection, but we need to prevent the Server from 1124 // dealing with the connection further if it's not 1125 // hijacked. Set Close to ensure that: 1126 req.Close = true 1127 } 1128 return req, nil 1129 } 1130 1131 // MaxBytesReader is similar to io.LimitReader but is intended for 1132 // limiting the size of incoming request bodies. In contrast to 1133 // io.LimitReader, MaxBytesReader's result is a ReadCloser, returns a 1134 // non-nil error of type *MaxBytesError for a Read beyond the limit, 1135 // and closes the underlying reader when its Close method is called. 1136 // 1137 // MaxBytesReader prevents clients from accidentally or maliciously 1138 // sending a large request and wasting server resources. If possible, 1139 // it tells the ResponseWriter to close the connection after the limit 1140 // has been reached. 1141 func MaxBytesReader(w ResponseWriter, r io.ReadCloser, n int64) io.ReadCloser { 1142 if n < 0 { // Treat negative limits as equivalent to 0. 1143 n = 0 1144 } 1145 return &maxBytesReader{w: w, r: r, i: n, n: n} 1146 } 1147 1148 // MaxBytesError is returned by MaxBytesReader when its read limit is exceeded. 1149 type MaxBytesError struct { 1150 Limit int64 1151 } 1152 1153 func (e *MaxBytesError) Error() string { 1154 // Due to Hyrum's law, this text cannot be changed. 1155 return "http: request body too large" 1156 } 1157 1158 type maxBytesReader struct { 1159 w ResponseWriter 1160 r io.ReadCloser // underlying reader 1161 i int64 // max bytes initially, for MaxBytesError 1162 n int64 // max bytes remaining 1163 err error // sticky error 1164 } 1165 1166 func (l *maxBytesReader) Read(p []byte) (n int, err error) { 1167 if l.err != nil { 1168 return 0, l.err 1169 } 1170 if len(p) == 0 { 1171 return 0, nil 1172 } 1173 // If they asked for a 32KB byte read but only 5 bytes are 1174 // remaining, no need to read 32KB. 6 bytes will answer the 1175 // question of the whether we hit the limit or go past it. 1176 // 0 < len(p) < 2^63 1177 if int64(len(p))-1 > l.n { 1178 p = p[:l.n+1] 1179 } 1180 n, err = l.r.Read(p) 1181 1182 if int64(n) <= l.n { 1183 l.n -= int64(n) 1184 l.err = err 1185 return n, err 1186 } 1187 1188 n = int(l.n) 1189 l.n = 0 1190 1191 // The server code and client code both use 1192 // maxBytesReader. This "requestTooLarge" check is 1193 // only used by the server code. To prevent binaries 1194 // which only using the HTTP Client code (such as 1195 // cmd/go) from also linking in the HTTP server, don't 1196 // use a static type assertion to the server 1197 // "*response" type. Check this interface instead: 1198 type requestTooLarger interface { 1199 requestTooLarge() 1200 } 1201 if res, ok := l.w.(requestTooLarger); ok { 1202 res.requestTooLarge() 1203 } 1204 l.err = &MaxBytesError{l.i} 1205 return n, l.err 1206 } 1207 1208 func (l *maxBytesReader) Close() error { 1209 return l.r.Close() 1210 } 1211 1212 func copyValues(dst, src url.Values) { 1213 for k, vs := range src { 1214 dst[k] = append(dst[k], vs...) 1215 } 1216 } 1217 1218 func parsePostForm(r *Request) (vs url.Values, err error) { 1219 if r.Body == nil { 1220 err = errors.New("missing form body") 1221 return 1222 } 1223 ct := r.Header.Get("Content-Type") 1224 // RFC 7231, section 3.1.1.5 - empty type 1225 // MAY be treated as application/octet-stream 1226 if ct == "" { 1227 ct = "application/octet-stream" 1228 } 1229 ct, _, err = mime.ParseMediaType(ct) 1230 switch { 1231 case ct == "application/x-www-form-urlencoded": 1232 var reader io.Reader = r.Body 1233 maxFormSize := int64(1<<63 - 1) 1234 if _, ok := r.Body.(*maxBytesReader); !ok { 1235 maxFormSize = int64(10 << 20) // 10 MB is a lot of text. 1236 reader = io.LimitReader(r.Body, maxFormSize+1) 1237 } 1238 b, e := io.ReadAll(reader) 1239 if e != nil { 1240 if err == nil { 1241 err = e 1242 } 1243 break 1244 } 1245 if int64(len(b)) > maxFormSize { 1246 err = errors.New("http: POST too large") 1247 return 1248 } 1249 vs, e = url.ParseQuery(string(b)) 1250 if err == nil { 1251 err = e 1252 } 1253 case ct == "multipart/form-data": 1254 // handled by ParseMultipartForm (which is calling us, or should be) 1255 // TODO(bradfitz): there are too many possible 1256 // orders to call too many functions here. 1257 // Clean this up and write more tests. 1258 // request_test.go contains the start of this, 1259 // in TestParseMultipartFormOrder and others. 1260 } 1261 return 1262 } 1263 1264 // ParseForm populates r.Form and r.PostForm. 1265 // 1266 // For all requests, ParseForm parses the raw query from the URL and updates 1267 // r.Form. 1268 // 1269 // For POST, PUT, and PATCH requests, it also reads the request body, parses it 1270 // as a form and puts the results into both r.PostForm and r.Form. Request body 1271 // parameters take precedence over URL query string values in r.Form. 1272 // 1273 // If the request Body's size has not already been limited by MaxBytesReader, 1274 // the size is capped at 10MB. 1275 // 1276 // For other HTTP methods, or when the Content-Type is not 1277 // application/x-www-form-urlencoded, the request Body is not read, and 1278 // r.PostForm is initialized to a non-nil, empty value. 1279 // 1280 // ParseMultipartForm calls ParseForm automatically. 1281 // ParseForm is idempotent. 1282 func (r *Request) ParseForm() error { 1283 var err error 1284 if r.PostForm == nil { 1285 if r.Method == "POST" || r.Method == "PUT" || r.Method == "PATCH" { 1286 r.PostForm, err = parsePostForm(r) 1287 } 1288 if r.PostForm == nil { 1289 r.PostForm = make(url.Values) 1290 } 1291 } 1292 if r.Form == nil { 1293 if len(r.PostForm) > 0 { 1294 r.Form = make(url.Values) 1295 copyValues(r.Form, r.PostForm) 1296 } 1297 var newValues url.Values 1298 if r.URL != nil { 1299 var e error 1300 newValues, e = url.ParseQuery(r.URL.RawQuery) 1301 if err == nil { 1302 err = e 1303 } 1304 } 1305 if newValues == nil { 1306 newValues = make(url.Values) 1307 } 1308 if r.Form == nil { 1309 r.Form = newValues 1310 } else { 1311 copyValues(r.Form, newValues) 1312 } 1313 } 1314 return err 1315 } 1316 1317 // ParseMultipartForm parses a request body as multipart/form-data. 1318 // The whole request body is parsed and up to a total of maxMemory bytes of 1319 // its file parts are stored in memory, with the remainder stored on 1320 // disk in temporary files. 1321 // ParseMultipartForm calls ParseForm if necessary. 1322 // If ParseForm returns an error, ParseMultipartForm returns it but also 1323 // continues parsing the request body. 1324 // After one call to ParseMultipartForm, subsequent calls have no effect. 1325 func (r *Request) ParseMultipartForm(maxMemory int64) error { 1326 if r.MultipartForm == multipartByReader { 1327 return errors.New("http: multipart handled by MultipartReader") 1328 } 1329 var parseFormErr error 1330 if r.Form == nil { 1331 // Let errors in ParseForm fall through, and just 1332 // return it at the end. 1333 parseFormErr = r.ParseForm() 1334 } 1335 if r.MultipartForm != nil { 1336 return nil 1337 } 1338 1339 mr, err := r.multipartReader(false) 1340 if err != nil { 1341 return err 1342 } 1343 1344 f, err := mr.ReadForm(maxMemory) 1345 if err != nil { 1346 return err 1347 } 1348 1349 if r.PostForm == nil { 1350 r.PostForm = make(url.Values) 1351 } 1352 for k, v := range f.Value { 1353 r.Form[k] = append(r.Form[k], v...) 1354 // r.PostForm should also be populated. See Issue 9305. 1355 r.PostForm[k] = append(r.PostForm[k], v...) 1356 } 1357 1358 r.MultipartForm = f 1359 1360 return parseFormErr 1361 } 1362 1363 // FormValue returns the first value for the named component of the query. 1364 // POST and PUT body parameters take precedence over URL query string values. 1365 // FormValue calls ParseMultipartForm and ParseForm if necessary and ignores 1366 // any errors returned by these functions. 1367 // If key is not present, FormValue returns the empty string. 1368 // To access multiple values of the same key, call ParseForm and 1369 // then inspect Request.Form directly. 1370 func (r *Request) FormValue(key string) string { 1371 if r.Form == nil { 1372 r.ParseMultipartForm(defaultMaxMemory) 1373 } 1374 if vs := r.Form[key]; len(vs) > 0 { 1375 return vs[0] 1376 } 1377 return "" 1378 } 1379 1380 // PostFormValue returns the first value for the named component of the POST, 1381 // PATCH, or PUT request body. URL query parameters are ignored. 1382 // PostFormValue calls ParseMultipartForm and ParseForm if necessary and ignores 1383 // any errors returned by these functions. 1384 // If key is not present, PostFormValue returns the empty string. 1385 func (r *Request) PostFormValue(key string) string { 1386 if r.PostForm == nil { 1387 r.ParseMultipartForm(defaultMaxMemory) 1388 } 1389 if vs := r.PostForm[key]; len(vs) > 0 { 1390 return vs[0] 1391 } 1392 return "" 1393 } 1394 1395 // FormFile returns the first file for the provided form key. 1396 // FormFile calls ParseMultipartForm and ParseForm if necessary. 1397 func (r *Request) FormFile(key string) (multipart.File, *multipart.FileHeader, error) { 1398 if r.MultipartForm == multipartByReader { 1399 return nil, nil, errors.New("http: multipart handled by MultipartReader") 1400 } 1401 if r.MultipartForm == nil { 1402 err := r.ParseMultipartForm(defaultMaxMemory) 1403 if err != nil { 1404 return nil, nil, err 1405 } 1406 } 1407 if r.MultipartForm != nil && r.MultipartForm.File != nil { 1408 if fhs := r.MultipartForm.File[key]; len(fhs) > 0 { 1409 f, err := fhs[0].Open() 1410 return f, fhs[0], err 1411 } 1412 } 1413 return nil, nil, ErrMissingFile 1414 } 1415 1416 func (r *Request) expectsContinue() bool { 1417 return hasToken(r.Header.get("Expect"), "100-continue") 1418 } 1419 1420 func (r *Request) wantsHttp10KeepAlive() bool { 1421 if r.ProtoMajor != 1 || r.ProtoMinor != 0 { 1422 return false 1423 } 1424 return hasToken(r.Header.get("Connection"), "keep-alive") 1425 } 1426 1427 func (r *Request) wantsClose() bool { 1428 if r.Close { 1429 return true 1430 } 1431 return hasToken(r.Header.get("Connection"), "close") 1432 } 1433 1434 func (r *Request) closeBody() error { 1435 if r.Body == nil { 1436 return nil 1437 } 1438 return r.Body.Close() 1439 } 1440 1441 func (r *Request) isReplayable() bool { 1442 if r.Body == nil || r.Body == NoBody || r.GetBody != nil { 1443 switch valueOrDefault(r.Method, "GET") { 1444 case "GET", "HEAD", "OPTIONS", "TRACE": 1445 return true 1446 } 1447 // The Idempotency-Key, while non-standard, is widely used to 1448 // mean a POST or other request is idempotent. See 1449 // https://golang.org/issue/19943#issuecomment-421092421 1450 if r.Header.has("Idempotency-Key") || r.Header.has("X-Idempotency-Key") { 1451 return true 1452 } 1453 } 1454 return false 1455 } 1456 1457 // outgoingLength reports the Content-Length of this outgoing (Client) request. 1458 // It maps 0 into -1 (unknown) when the Body is non-nil. 1459 func (r *Request) outgoingLength() int64 { 1460 if r.Body == nil || r.Body == NoBody { 1461 return 0 1462 } 1463 if r.ContentLength != 0 { 1464 return r.ContentLength 1465 } 1466 return -1 1467 } 1468 1469 // requestMethodUsuallyLacksBody reports whether the given request 1470 // method is one that typically does not involve a request body. 1471 // This is used by the Transport (via 1472 // transferWriter.shouldSendChunkedRequestBody) to determine whether 1473 // we try to test-read a byte from a non-nil Request.Body when 1474 // Request.outgoingLength() returns -1. See the comments in 1475 // shouldSendChunkedRequestBody. 1476 func requestMethodUsuallyLacksBody(method string) bool { 1477 switch method { 1478 case "GET", "HEAD", "DELETE", "OPTIONS", "PROPFIND", "SEARCH": 1479 return true 1480 } 1481 return false 1482 } 1483 1484 // requiresHTTP1 reports whether this request requires being sent on 1485 // an HTTP/1 connection. 1486 func (r *Request) requiresHTTP1() bool { 1487 return hasToken(r.Header.Get("Connection"), "upgrade") && 1488 ascii.EqualFold(r.Header.Get("Upgrade"), "websocket") 1489 } 1490