1 // Copyright 2009 The Go Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style 3 // license that can be found in the LICENSE file. 4 5 // HTTP Request reading and parsing. 6 7 package http 8 9 import ( 10 "bufio" 11 "bytes" 12 "context" 13 "crypto/tls" 14 "encoding/base64" 15 "errors" 16 "fmt" 17 "io" 18 "mime" 19 "mime/multipart" 20 "net/http/httptrace" 21 "net/http/internal/ascii" 22 "net/textproto" 23 "net/url" 24 urlpkg "net/url" 25 "strconv" 26 "strings" 27 "sync" 28 _ "unsafe" // for linkname 29 30 "golang.org/x/net/http/httpguts" 31 "golang.org/x/net/idna" 32 ) 33 34 const ( 35 defaultMaxMemory = 32 << 20 // 32 MB 36 ) 37 38 // ErrMissingFile is returned by FormFile when the provided file field name 39 // is either not present in the request or not a file field. 40 var ErrMissingFile = errors.New("http: no such file") 41 42 // ProtocolError represents an HTTP protocol error. 43 // 44 // Deprecated: Not all errors in the http package related to protocol errors 45 // are of type ProtocolError. 46 type ProtocolError struct { 47 ErrorString string 48 } 49 50 func (pe *ProtocolError) Error() string { return pe.ErrorString } 51 52 // Is lets http.ErrNotSupported match errors.ErrUnsupported. 53 func (pe *ProtocolError) Is(err error) bool { 54 return pe == ErrNotSupported && err == errors.ErrUnsupported 55 } 56 57 var ( 58 // ErrNotSupported indicates that a feature is not supported. 59 // 60 // It is returned by ResponseController methods to indicate that 61 // the handler does not support the method, and by the Push method 62 // of Pusher implementations to indicate that HTTP/2 Push support 63 // is not available. 64 ErrNotSupported = &ProtocolError{"feature not supported"} 65 66 // Deprecated: ErrUnexpectedTrailer is no longer returned by 67 // anything in the net/http package. Callers should not 68 // compare errors against this variable. 69 ErrUnexpectedTrailer = &ProtocolError{"trailer header without chunked transfer encoding"} 70 71 // ErrMissingBoundary is returned by Request.MultipartReader when the 72 // request's Content-Type does not include a "boundary" parameter. 73 ErrMissingBoundary = &ProtocolError{"no multipart boundary param in Content-Type"} 74 75 // ErrNotMultipart is returned by Request.MultipartReader when the 76 // request's Content-Type is not multipart/form-data. 77 ErrNotMultipart = &ProtocolError{"request Content-Type isn't multipart/form-data"} 78 79 // Deprecated: ErrHeaderTooLong is no longer returned by 80 // anything in the net/http package. Callers should not 81 // compare errors against this variable. 82 ErrHeaderTooLong = &ProtocolError{"header too long"} 83 84 // Deprecated: ErrShortBody is no longer returned by 85 // anything in the net/http package. Callers should not 86 // compare errors against this variable. 87 ErrShortBody = &ProtocolError{"entity body too short"} 88 89 // Deprecated: ErrMissingContentLength is no longer returned by 90 // anything in the net/http package. Callers should not 91 // compare errors against this variable. 92 ErrMissingContentLength = &ProtocolError{"missing ContentLength in HEAD response"} 93 ) 94 95 func badStringError(what, val string) error { return fmt.Errorf("%s %q", what, val) } 96 97 // Headers that Request.Write handles itself and should be skipped. 98 var reqWriteExcludeHeader = map[string]bool{ 99 "Host": true, // not in Header map anyway 100 "User-Agent": true, 101 "Content-Length": true, 102 "Transfer-Encoding": true, 103 "Trailer": true, 104 } 105 106 // A Request represents an HTTP request received by a server 107 // or to be sent by a client. 108 // 109 // The field semantics differ slightly between client and server 110 // usage. In addition to the notes on the fields below, see the 111 // documentation for [Request.Write] and [RoundTripper]. 112 type Request struct { 113 // Method specifies the HTTP method (GET, POST, PUT, etc.). 114 // For client requests, an empty string means GET. 115 Method string 116 117 // URL specifies either the URI being requested (for server 118 // requests) or the URL to access (for client requests). 119 // 120 // For server requests, the URL is parsed from the URI 121 // supplied on the Request-Line as stored in RequestURI. For 122 // most requests, fields other than Path and RawQuery will be 123 // empty. (See RFC 7230, Section 5.3) 124 // 125 // For client requests, the URL's Host specifies the server to 126 // connect to, while the Request's Host field optionally 127 // specifies the Host header value to send in the HTTP 128 // request. 129 URL *url.URL 130 131 // The protocol version for incoming server requests. 132 // 133 // For client requests, these fields are ignored. The HTTP 134 // client code always uses either HTTP/1.1 or HTTP/2. 135 // See the docs on Transport for details. 136 Proto string // "HTTP/1.0" 137 ProtoMajor int // 1 138 ProtoMinor int // 0 139 140 // Header contains the request header fields either received 141 // by the server or to be sent by the client. 142 // 143 // If a server received a request with header lines, 144 // 145 // Host: example.com 146 // accept-encoding: gzip, deflate 147 // Accept-Language: en-us 148 // fOO: Bar 149 // foo: two 150 // 151 // then 152 // 153 // Header = map[string][]string{ 154 // "Accept-Encoding": {"gzip, deflate"}, 155 // "Accept-Language": {"en-us"}, 156 // "Foo": {"Bar", "two"}, 157 // } 158 // 159 // For incoming requests, the Host header is promoted to the 160 // Request.Host field and removed from the Header map. 161 // 162 // HTTP defines that header names are case-insensitive. The 163 // request parser implements this by using CanonicalHeaderKey, 164 // making the first character and any characters following a 165 // hyphen uppercase and the rest lowercase. 166 // 167 // For client requests, certain headers such as Content-Length 168 // and Connection are automatically written when needed and 169 // values in Header may be ignored. See the documentation 170 // for the Request.Write method. 171 Header Header 172 173 // Body is the request's body. 174 // 175 // For client requests, a nil body means the request has no 176 // body, such as a GET request. The HTTP Client's Transport 177 // is responsible for calling the Close method. 178 // 179 // For server requests, the Request Body is always non-nil 180 // but will return EOF immediately when no body is present. 181 // The Server will close the request body. The ServeHTTP 182 // Handler does not need to. 183 // 184 // Body must allow Read to be called concurrently with Close. 185 // In particular, calling Close should unblock a Read waiting 186 // for input. 187 Body io.ReadCloser 188 189 // GetBody defines an optional func to return a new copy of 190 // Body. It is used for client requests when a redirect requires 191 // reading the body more than once. Use of GetBody still 192 // requires setting Body. 193 // 194 // For server requests, it is unused. 195 GetBody func() (io.ReadCloser, error) 196 197 // ContentLength records the length of the associated content. 198 // The value -1 indicates that the length is unknown. 199 // Values >= 0 indicate that the given number of bytes may 200 // be read from Body. 201 // 202 // For client requests, a value of 0 with a non-nil Body is 203 // also treated as unknown. 204 ContentLength int64 205 206 // TransferEncoding lists the transfer encodings from outermost to 207 // innermost. An empty list denotes the "identity" encoding. 208 // TransferEncoding can usually be ignored; chunked encoding is 209 // automatically added and removed as necessary when sending and 210 // receiving requests. 211 TransferEncoding []string 212 213 // Close indicates whether to close the connection after 214 // replying to this request (for servers) or after sending this 215 // request and reading its response (for clients). 216 // 217 // For server requests, the HTTP server handles this automatically 218 // and this field is not needed by Handlers. 219 // 220 // For client requests, setting this field prevents re-use of 221 // TCP connections between requests to the same hosts, as if 222 // Transport.DisableKeepAlives were set. 223 Close bool 224 225 // For server requests, Host specifies the host on which the 226 // URL is sought. For HTTP/1 (per RFC 7230, section 5.4), this 227 // is either the value of the "Host" header or the host name 228 // given in the URL itself. For HTTP/2, it is the value of the 229 // ":authority" pseudo-header field. 230 // It may be of the form "host:port". For international domain 231 // names, Host may be in Punycode or Unicode form. Use 232 // golang.org/x/net/idna to convert it to either format if 233 // needed. 234 // To prevent DNS rebinding attacks, server Handlers should 235 // validate that the Host header has a value for which the 236 // Handler considers itself authoritative. The included 237 // ServeMux supports patterns registered to particular host 238 // names and thus protects its registered Handlers. 239 // 240 // For client requests, Host optionally overrides the Host 241 // header to send. If empty, the Request.Write method uses 242 // the value of URL.Host. Host may contain an international 243 // domain name. 244 Host string 245 246 // Form contains the parsed form data, including both the URL 247 // field's query parameters and the PATCH, POST, or PUT form data. 248 // This field is only available after ParseForm is called. 249 // The HTTP client ignores Form and uses Body instead. 250 Form url.Values 251 252 // PostForm contains the parsed form data from PATCH, POST 253 // or PUT body parameters. 254 // 255 // This field is only available after ParseForm is called. 256 // The HTTP client ignores PostForm and uses Body instead. 257 PostForm url.Values 258 259 // MultipartForm is the parsed multipart form, including file uploads. 260 // This field is only available after ParseMultipartForm is called. 261 // The HTTP client ignores MultipartForm and uses Body instead. 262 MultipartForm *multipart.Form 263 264 // Trailer specifies additional headers that are sent after the request 265 // body. 266 // 267 // For server requests, the Trailer map initially contains only the 268 // trailer keys, with nil values. (The client declares which trailers it 269 // will later send.) While the handler is reading from Body, it must 270 // not reference Trailer. After reading from Body returns EOF, Trailer 271 // can be read again and will contain non-nil values, if they were sent 272 // by the client. 273 // 274 // For client requests, Trailer must be initialized to a map containing 275 // the trailer keys to later send. The values may be nil or their final 276 // values. The ContentLength must be 0 or -1, to send a chunked request. 277 // After the HTTP request is sent the map values can be updated while 278 // the request body is read. Once the body returns EOF, the caller must 279 // not mutate Trailer. 280 // 281 // Few HTTP clients, servers, or proxies support HTTP trailers. 282 Trailer Header 283 284 // RemoteAddr allows HTTP servers and other software to record 285 // the network address that sent the request, usually for 286 // logging. This field is not filled in by ReadRequest and 287 // has no defined format. The HTTP server in this package 288 // sets RemoteAddr to an "IP:port" address before invoking a 289 // handler. 290 // This field is ignored by the HTTP client. 291 RemoteAddr string 292 293 // RequestURI is the unmodified request-target of the 294 // Request-Line (RFC 7230, Section 3.1.1) as sent by the client 295 // to a server. Usually the URL field should be used instead. 296 // It is an error to set this field in an HTTP client request. 297 RequestURI string 298 299 // TLS allows HTTP servers and other software to record 300 // information about the TLS connection on which the request 301 // was received. This field is not filled in by ReadRequest. 302 // The HTTP server in this package sets the field for 303 // TLS-enabled connections before invoking a handler; 304 // otherwise it leaves the field nil. 305 // This field is ignored by the HTTP client. 306 TLS *tls.ConnectionState 307 308 // Cancel is an optional channel whose closure indicates that the client 309 // request should be regarded as canceled. Not all implementations of 310 // RoundTripper may support Cancel. 311 // 312 // For server requests, this field is not applicable. 313 // 314 // Deprecated: Set the Request's context with NewRequestWithContext 315 // instead. If a Request's Cancel field and context are both 316 // set, it is undefined whether Cancel is respected. 317 Cancel <-chan struct{} 318 319 // Response is the redirect response which caused this request 320 // to be created. This field is only populated during client 321 // redirects. 322 Response *Response 323 324 // Pattern is the [ServeMux] pattern that matched the request. 325 // It is empty if the request was not matched against a pattern. 326 Pattern string 327 328 // ctx is either the client or server context. It should only 329 // be modified via copying the whole Request using Clone or WithContext. 330 // It is unexported to prevent people from using Context wrong 331 // and mutating the contexts held by callers of the same request. 332 ctx context.Context 333 334 // The following fields are for requests matched by ServeMux. 335 pat *pattern // the pattern that matched 336 matches []string // values for the matching wildcards in pat 337 otherValues map[string]string // for calls to SetPathValue that don't match a wildcard 338 } 339 340 // Context returns the request's context. To change the context, use 341 // [Request.Clone] or [Request.WithContext]. 342 // 343 // The returned context is always non-nil; it defaults to the 344 // background context. 345 // 346 // For outgoing client requests, the context controls cancellation. 347 // 348 // For incoming server requests, the context is canceled when the 349 // client's connection closes, the request is canceled (with HTTP/2), 350 // or when the ServeHTTP method returns. 351 func (r *Request) Context() context.Context { 352 if r.ctx != nil { 353 return r.ctx 354 } 355 return context.Background() 356 } 357 358 // WithContext returns a shallow copy of r with its context changed 359 // to ctx. The provided ctx must be non-nil. 360 // 361 // For outgoing client request, the context controls the entire 362 // lifetime of a request and its response: obtaining a connection, 363 // sending the request, and reading the response headers and body. 364 // 365 // To create a new request with a context, use [NewRequestWithContext]. 366 // To make a deep copy of a request with a new context, use [Request.Clone]. 367 func (r *Request) WithContext(ctx context.Context) *Request { 368 if ctx == nil { 369 panic("nil context") 370 } 371 r2 := new(Request) 372 *r2 = *r 373 r2.ctx = ctx 374 return r2 375 } 376 377 // Clone returns a deep copy of r with its context changed to ctx. 378 // The provided ctx must be non-nil. 379 // 380 // Clone only makes a shallow copy of the Body field. 381 // 382 // For an outgoing client request, the context controls the entire 383 // lifetime of a request and its response: obtaining a connection, 384 // sending the request, and reading the response headers and body. 385 func (r *Request) Clone(ctx context.Context) *Request { 386 if ctx == nil { 387 panic("nil context") 388 } 389 r2 := new(Request) 390 *r2 = *r 391 r2.ctx = ctx 392 r2.URL = cloneURL(r.URL) 393 if r.Header != nil { 394 r2.Header = r.Header.Clone() 395 } 396 if r.Trailer != nil { 397 r2.Trailer = r.Trailer.Clone() 398 } 399 if s := r.TransferEncoding; s != nil { 400 s2 := make([]string, len(s)) 401 copy(s2, s) 402 r2.TransferEncoding = s2 403 } 404 r2.Form = cloneURLValues(r.Form) 405 r2.PostForm = cloneURLValues(r.PostForm) 406 r2.MultipartForm = cloneMultipartForm(r.MultipartForm) 407 408 // Copy matches and otherValues. See issue 61410. 409 if s := r.matches; s != nil { 410 s2 := make([]string, len(s)) 411 copy(s2, s) 412 r2.matches = s2 413 } 414 if s := r.otherValues; s != nil { 415 s2 := make(map[string]string, len(s)) 416 for k, v := range s { 417 s2[k] = v 418 } 419 r2.otherValues = s2 420 } 421 return r2 422 } 423 424 // ProtoAtLeast reports whether the HTTP protocol used 425 // in the request is at least major.minor. 426 func (r *Request) ProtoAtLeast(major, minor int) bool { 427 return r.ProtoMajor > major || 428 r.ProtoMajor == major && r.ProtoMinor >= minor 429 } 430 431 // UserAgent returns the client's User-Agent, if sent in the request. 432 func (r *Request) UserAgent() string { 433 return r.Header.Get("User-Agent") 434 } 435 436 // Cookies parses and returns the HTTP cookies sent with the request. 437 func (r *Request) Cookies() []*Cookie { 438 return readCookies(r.Header, "") 439 } 440 441 // CookiesNamed parses and returns the named HTTP cookies sent with the request 442 // or an empty slice if none matched. 443 func (r *Request) CookiesNamed(name string) []*Cookie { 444 if name == "" { 445 return []*Cookie{} 446 } 447 return readCookies(r.Header, name) 448 } 449 450 // ErrNoCookie is returned by Request's Cookie method when a cookie is not found. 451 var ErrNoCookie = errors.New("http: named cookie not present") 452 453 // Cookie returns the named cookie provided in the request or 454 // [ErrNoCookie] if not found. 455 // If multiple cookies match the given name, only one cookie will 456 // be returned. 457 func (r *Request) Cookie(name string) (*Cookie, error) { 458 if name == "" { 459 return nil, ErrNoCookie 460 } 461 for _, c := range readCookies(r.Header, name) { 462 return c, nil 463 } 464 return nil, ErrNoCookie 465 } 466 467 // AddCookie adds a cookie to the request. Per RFC 6265 section 5.4, 468 // AddCookie does not attach more than one [Cookie] header field. That 469 // means all cookies, if any, are written into the same line, 470 // separated by semicolon. 471 // AddCookie only sanitizes c's name and value, and does not sanitize 472 // a Cookie header already present in the request. 473 func (r *Request) AddCookie(c *Cookie) { 474 s := fmt.Sprintf("%s=%s", sanitizeCookieName(c.Name), sanitizeCookieValue(c.Value, c.Quoted)) 475 if c := r.Header.Get("Cookie"); c != "" { 476 r.Header.Set("Cookie", c+"; "+s) 477 } else { 478 r.Header.Set("Cookie", s) 479 } 480 } 481 482 // Referer returns the referring URL, if sent in the request. 483 // 484 // Referer is misspelled as in the request itself, a mistake from the 485 // earliest days of HTTP. This value can also be fetched from the 486 // [Header] map as Header["Referer"]; the benefit of making it available 487 // as a method is that the compiler can diagnose programs that use the 488 // alternate (correct English) spelling req.Referrer() but cannot 489 // diagnose programs that use Header["Referrer"]. 490 func (r *Request) Referer() string { 491 return r.Header.Get("Referer") 492 } 493 494 // multipartByReader is a sentinel value. 495 // Its presence in Request.MultipartForm indicates that parsing of the request 496 // body has been handed off to a MultipartReader instead of ParseMultipartForm. 497 var multipartByReader = &multipart.Form{ 498 Value: make(map[string][]string), 499 File: make(map[string][]*multipart.FileHeader), 500 } 501 502 // MultipartReader returns a MIME multipart reader if this is a 503 // multipart/form-data or a multipart/mixed POST request, else returns nil and an error. 504 // Use this function instead of [Request.ParseMultipartForm] to 505 // process the request body as a stream. 506 func (r *Request) MultipartReader() (*multipart.Reader, error) { 507 if r.MultipartForm == multipartByReader { 508 return nil, errors.New("http: MultipartReader called twice") 509 } 510 if r.MultipartForm != nil { 511 return nil, errors.New("http: multipart handled by ParseMultipartForm") 512 } 513 r.MultipartForm = multipartByReader 514 return r.multipartReader(true) 515 } 516 517 func (r *Request) multipartReader(allowMixed bool) (*multipart.Reader, error) { 518 v := r.Header.Get("Content-Type") 519 if v == "" { 520 return nil, ErrNotMultipart 521 } 522 if r.Body == nil { 523 return nil, errors.New("missing form body") 524 } 525 d, params, err := mime.ParseMediaType(v) 526 if err != nil || !(d == "multipart/form-data" || allowMixed && d == "multipart/mixed") { 527 return nil, ErrNotMultipart 528 } 529 boundary, ok := params["boundary"] 530 if !ok { 531 return nil, ErrMissingBoundary 532 } 533 return multipart.NewReader(r.Body, boundary), nil 534 } 535 536 // isH2Upgrade reports whether r represents the http2 "client preface" 537 // magic string. 538 func (r *Request) isH2Upgrade() bool { 539 return r.Method == "PRI" && len(r.Header) == 0 && r.URL.Path == "*" && r.Proto == "HTTP/2.0" 540 } 541 542 // Return value if nonempty, def otherwise. 543 func valueOrDefault(value, def string) string { 544 if value != "" { 545 return value 546 } 547 return def 548 } 549 550 // NOTE: This is not intended to reflect the actual Go version being used. 551 // It was changed at the time of Go 1.1 release because the former User-Agent 552 // had ended up blocked by some intrusion detection systems. 553 // See https://codereview.appspot.com/7532043. 554 const defaultUserAgent = "Go-http-client/1.1" 555 556 // Write writes an HTTP/1.1 request, which is the header and body, in wire format. 557 // This method consults the following fields of the request: 558 // 559 // Host 560 // URL 561 // Method (defaults to "GET") 562 // Header 563 // ContentLength 564 // TransferEncoding 565 // Body 566 // 567 // If Body is present, Content-Length is <= 0 and [Request.TransferEncoding] 568 // hasn't been set to "identity", Write adds "Transfer-Encoding: 569 // chunked" to the header. Body is closed after it is sent. 570 func (r *Request) Write(w io.Writer) error { 571 return r.write(w, false, nil, nil) 572 } 573 574 // WriteProxy is like [Request.Write] but writes the request in the form 575 // expected by an HTTP proxy. In particular, [Request.WriteProxy] writes the 576 // initial Request-URI line of the request with an absolute URI, per 577 // section 5.3 of RFC 7230, including the scheme and host. 578 // In either case, WriteProxy also writes a Host header, using 579 // either r.Host or r.URL.Host. 580 func (r *Request) WriteProxy(w io.Writer) error { 581 return r.write(w, true, nil, nil) 582 } 583 584 // errMissingHost is returned by Write when there is no Host or URL present in 585 // the Request. 586 var errMissingHost = errors.New("http: Request.Write on Request with no Host or URL set") 587 588 // extraHeaders may be nil 589 // waitForContinue may be nil 590 // always closes body 591 func (r *Request) write(w io.Writer, usingProxy bool, extraHeaders Header, waitForContinue func() bool) (err error) { 592 trace := httptrace.ContextClientTrace(r.Context()) 593 if trace != nil && trace.WroteRequest != nil { 594 defer func() { 595 trace.WroteRequest(httptrace.WroteRequestInfo{ 596 Err: err, 597 }) 598 }() 599 } 600 closed := false 601 defer func() { 602 if closed { 603 return 604 } 605 if closeErr := r.closeBody(); closeErr != nil && err == nil { 606 err = closeErr 607 } 608 }() 609 610 // Find the target host. Prefer the Host: header, but if that 611 // is not given, use the host from the request URL. 612 // 613 // Clean the host, in case it arrives with unexpected stuff in it. 614 host := r.Host 615 if host == "" { 616 if r.URL == nil { 617 return errMissingHost 618 } 619 host = r.URL.Host 620 } 621 host, err = httpguts.PunycodeHostPort(host) 622 if err != nil { 623 return err 624 } 625 // Validate that the Host header is a valid header in general, 626 // but don't validate the host itself. This is sufficient to avoid 627 // header or request smuggling via the Host field. 628 // The server can (and will, if it's a net/http server) reject 629 // the request if it doesn't consider the host valid. 630 if !httpguts.ValidHostHeader(host) { 631 // Historically, we would truncate the Host header after '/' or ' '. 632 // Some users have relied on this truncation to convert a network 633 // address such as Unix domain socket path into a valid, ignored 634 // Host header (see https://go.dev/issue/61431). 635 // 636 // We don't preserve the truncation, because sending an altered 637 // header field opens a smuggling vector. Instead, zero out the 638 // Host header entirely if it isn't valid. (An empty Host is valid; 639 // see RFC 9112 Section 3.2.) 640 // 641 // Return an error if we're sending to a proxy, since the proxy 642 // probably can't do anything useful with an empty Host header. 643 if !usingProxy { 644 host = "" 645 } else { 646 return errors.New("http: invalid Host header") 647 } 648 } 649 650 // According to RFC 6874, an HTTP client, proxy, or other 651 // intermediary must remove any IPv6 zone identifier attached 652 // to an outgoing URI. 653 host = removeZone(host) 654 655 ruri := r.URL.RequestURI() 656 if usingProxy && r.URL.Scheme != "" && r.URL.Opaque == "" { 657 ruri = r.URL.Scheme + "://" + host + ruri 658 } else if r.Method == "CONNECT" && r.URL.Path == "" { 659 // CONNECT requests normally give just the host and port, not a full URL. 660 ruri = host 661 if r.URL.Opaque != "" { 662 ruri = r.URL.Opaque 663 } 664 } 665 if stringContainsCTLByte(ruri) { 666 return errors.New("net/http: can't write control character in Request.URL") 667 } 668 // TODO: validate r.Method too? At least it's less likely to 669 // come from an attacker (more likely to be a constant in 670 // code). 671 672 // Wrap the writer in a bufio Writer if it's not already buffered. 673 // Don't always call NewWriter, as that forces a bytes.Buffer 674 // and other small bufio Writers to have a minimum 4k buffer 675 // size. 676 var bw *bufio.Writer 677 if _, ok := w.(io.ByteWriter); !ok { 678 bw = bufio.NewWriter(w) 679 w = bw 680 } 681 682 _, err = fmt.Fprintf(w, "%s %s HTTP/1.1\r\n", valueOrDefault(r.Method, "GET"), ruri) 683 if err != nil { 684 return err 685 } 686 687 // Header lines 688 _, err = fmt.Fprintf(w, "Host: %s\r\n", host) 689 if err != nil { 690 return err 691 } 692 if trace != nil && trace.WroteHeaderField != nil { 693 trace.WroteHeaderField("Host", []string{host}) 694 } 695 696 // Use the defaultUserAgent unless the Header contains one, which 697 // may be blank to not send the header. 698 userAgent := defaultUserAgent 699 if r.Header.has("User-Agent") { 700 userAgent = r.Header.Get("User-Agent") 701 } 702 if userAgent != "" { 703 userAgent = headerNewlineToSpace.Replace(userAgent) 704 userAgent = textproto.TrimString(userAgent) 705 _, err = fmt.Fprintf(w, "User-Agent: %s\r\n", userAgent) 706 if err != nil { 707 return err 708 } 709 if trace != nil && trace.WroteHeaderField != nil { 710 trace.WroteHeaderField("User-Agent", []string{userAgent}) 711 } 712 } 713 714 // Process Body,ContentLength,Close,Trailer 715 tw, err := newTransferWriter(r) 716 if err != nil { 717 return err 718 } 719 err = tw.writeHeader(w, trace) 720 if err != nil { 721 return err 722 } 723 724 err = r.Header.writeSubset(w, reqWriteExcludeHeader, trace) 725 if err != nil { 726 return err 727 } 728 729 if extraHeaders != nil { 730 err = extraHeaders.write(w, trace) 731 if err != nil { 732 return err 733 } 734 } 735 736 _, err = io.WriteString(w, "\r\n") 737 if err != nil { 738 return err 739 } 740 741 if trace != nil && trace.WroteHeaders != nil { 742 trace.WroteHeaders() 743 } 744 745 // Flush and wait for 100-continue if expected. 746 if waitForContinue != nil { 747 if bw, ok := w.(*bufio.Writer); ok { 748 err = bw.Flush() 749 if err != nil { 750 return err 751 } 752 } 753 if trace != nil && trace.Wait100Continue != nil { 754 trace.Wait100Continue() 755 } 756 if !waitForContinue() { 757 closed = true 758 r.closeBody() 759 return nil 760 } 761 } 762 763 if bw, ok := w.(*bufio.Writer); ok && tw.FlushHeaders { 764 if err := bw.Flush(); err != nil { 765 return err 766 } 767 } 768 769 // Write body and trailer 770 closed = true 771 err = tw.writeBody(w) 772 if err != nil { 773 if tw.bodyReadError == err { 774 err = requestBodyReadError{err} 775 } 776 return err 777 } 778 779 if bw != nil { 780 return bw.Flush() 781 } 782 return nil 783 } 784 785 // requestBodyReadError wraps an error from (*Request).write to indicate 786 // that the error came from a Read call on the Request.Body. 787 // This error type should not escape the net/http package to users. 788 type requestBodyReadError struct{ error } 789 790 func idnaASCII(v string) (string, error) { 791 // TODO: Consider removing this check after verifying performance is okay. 792 // Right now punycode verification, length checks, context checks, and the 793 // permissible character tests are all omitted. It also prevents the ToASCII 794 // call from salvaging an invalid IDN, when possible. As a result it may be 795 // possible to have two IDNs that appear identical to the user where the 796 // ASCII-only version causes an error downstream whereas the non-ASCII 797 // version does not. 798 // Note that for correct ASCII IDNs ToASCII will only do considerably more 799 // work, but it will not cause an allocation. 800 if ascii.Is(v) { 801 return v, nil 802 } 803 return idna.Lookup.ToASCII(v) 804 } 805 806 // removeZone removes IPv6 zone identifier from host. 807 // E.g., "[fe80::1%en0]:8080" to "[fe80::1]:8080" 808 func removeZone(host string) string { 809 if !strings.HasPrefix(host, "[") { 810 return host 811 } 812 i := strings.LastIndex(host, "]") 813 if i < 0 { 814 return host 815 } 816 j := strings.LastIndex(host[:i], "%") 817 if j < 0 { 818 return host 819 } 820 return host[:j] + host[i:] 821 } 822 823 // ParseHTTPVersion parses an HTTP version string according to RFC 7230, section 2.6. 824 // "HTTP/1.0" returns (1, 0, true). Note that strings without 825 // a minor version, such as "HTTP/2", are not valid. 826 func ParseHTTPVersion(vers string) (major, minor int, ok bool) { 827 switch vers { 828 case "HTTP/1.1": 829 return 1, 1, true 830 case "HTTP/1.0": 831 return 1, 0, true 832 } 833 if !strings.HasPrefix(vers, "HTTP/") { 834 return 0, 0, false 835 } 836 if len(vers) != len("HTTP/X.Y") { 837 return 0, 0, false 838 } 839 if vers[6] != '.' { 840 return 0, 0, false 841 } 842 maj, err := strconv.ParseUint(vers[5:6], 10, 0) 843 if err != nil { 844 return 0, 0, false 845 } 846 min, err := strconv.ParseUint(vers[7:8], 10, 0) 847 if err != nil { 848 return 0, 0, false 849 } 850 return int(maj), int(min), true 851 } 852 853 func validMethod(method string) bool { 854 /* 855 Method = "OPTIONS" ; Section 9.2 856 | "GET" ; Section 9.3 857 | "HEAD" ; Section 9.4 858 | "POST" ; Section 9.5 859 | "PUT" ; Section 9.6 860 | "DELETE" ; Section 9.7 861 | "TRACE" ; Section 9.8 862 | "CONNECT" ; Section 9.9 863 | extension-method 864 extension-method = token 865 token = 1*<any CHAR except CTLs or separators> 866 */ 867 return len(method) > 0 && strings.IndexFunc(method, isNotToken) == -1 868 } 869 870 // NewRequest wraps [NewRequestWithContext] using [context.Background]. 871 func NewRequest(method, url string, body io.Reader) (*Request, error) { 872 return NewRequestWithContext(context.Background(), method, url, body) 873 } 874 875 // NewRequestWithContext returns a new [Request] given a method, URL, and 876 // optional body. 877 // 878 // If the provided body is also an [io.Closer], the returned 879 // [Request.Body] is set to body and will be closed (possibly 880 // asynchronously) by the Client methods Do, Post, and PostForm, 881 // and [Transport.RoundTrip]. 882 // 883 // NewRequestWithContext returns a Request suitable for use with 884 // [Client.Do] or [Transport.RoundTrip]. To create a request for use with 885 // testing a Server Handler, either use the [NewRequest] function in the 886 // net/http/httptest package, use [ReadRequest], or manually update the 887 // Request fields. For an outgoing client request, the context 888 // controls the entire lifetime of a request and its response: 889 // obtaining a connection, sending the request, and reading the 890 // response headers and body. See the Request type's documentation for 891 // the difference between inbound and outbound request fields. 892 // 893 // If body is of type [*bytes.Buffer], [*bytes.Reader], or 894 // [*strings.Reader], the returned request's ContentLength is set to its 895 // exact value (instead of -1), GetBody is populated (so 307 and 308 896 // redirects can replay the body), and Body is set to [NoBody] if the 897 // ContentLength is 0. 898 func NewRequestWithContext(ctx context.Context, method, url string, body io.Reader) (*Request, error) { 899 if method == "" { 900 // We document that "" means "GET" for Request.Method, and people have 901 // relied on that from NewRequest, so keep that working. 902 // We still enforce validMethod for non-empty methods. 903 method = "GET" 904 } 905 if !validMethod(method) { 906 return nil, fmt.Errorf("net/http: invalid method %q", method) 907 } 908 if ctx == nil { 909 return nil, errors.New("net/http: nil Context") 910 } 911 u, err := urlpkg.Parse(url) 912 if err != nil { 913 return nil, err 914 } 915 rc, ok := body.(io.ReadCloser) 916 if !ok && body != nil { 917 rc = io.NopCloser(body) 918 } 919 // The host's colon:port should be normalized. See Issue 14836. 920 u.Host = removeEmptyPort(u.Host) 921 req := &Request{ 922 ctx: ctx, 923 Method: method, 924 URL: u, 925 Proto: "HTTP/1.1", 926 ProtoMajor: 1, 927 ProtoMinor: 1, 928 Header: make(Header), 929 Body: rc, 930 Host: u.Host, 931 } 932 if body != nil { 933 switch v := body.(type) { 934 case *bytes.Buffer: 935 req.ContentLength = int64(v.Len()) 936 buf := v.Bytes() 937 req.GetBody = func() (io.ReadCloser, error) { 938 r := bytes.NewReader(buf) 939 return io.NopCloser(r), nil 940 } 941 case *bytes.Reader: 942 req.ContentLength = int64(v.Len()) 943 snapshot := *v 944 req.GetBody = func() (io.ReadCloser, error) { 945 r := snapshot 946 return io.NopCloser(&r), nil 947 } 948 case *strings.Reader: 949 req.ContentLength = int64(v.Len()) 950 snapshot := *v 951 req.GetBody = func() (io.ReadCloser, error) { 952 r := snapshot 953 return io.NopCloser(&r), nil 954 } 955 default: 956 // This is where we'd set it to -1 (at least 957 // if body != NoBody) to mean unknown, but 958 // that broke people during the Go 1.8 testing 959 // period. People depend on it being 0 I 960 // guess. Maybe retry later. See Issue 18117. 961 } 962 // For client requests, Request.ContentLength of 0 963 // means either actually 0, or unknown. The only way 964 // to explicitly say that the ContentLength is zero is 965 // to set the Body to nil. But turns out too much code 966 // depends on NewRequest returning a non-nil Body, 967 // so we use a well-known ReadCloser variable instead 968 // and have the http package also treat that sentinel 969 // variable to mean explicitly zero. 970 if req.GetBody != nil && req.ContentLength == 0 { 971 req.Body = NoBody 972 req.GetBody = func() (io.ReadCloser, error) { return NoBody, nil } 973 } 974 } 975 976 return req, nil 977 } 978 979 // BasicAuth returns the username and password provided in the request's 980 // Authorization header, if the request uses HTTP Basic Authentication. 981 // See RFC 2617, Section 2. 982 func (r *Request) BasicAuth() (username, password string, ok bool) { 983 auth := r.Header.Get("Authorization") 984 if auth == "" { 985 return "", "", false 986 } 987 return parseBasicAuth(auth) 988 } 989 990 // parseBasicAuth parses an HTTP Basic Authentication string. 991 // "Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==" returns ("Aladdin", "open sesame", true). 992 // 993 // parseBasicAuth should be an internal detail, 994 // but widely used packages access it using linkname. 995 // Notable members of the hall of shame include: 996 // - github.com/sagernet/sing 997 // 998 // Do not remove or change the type signature. 999 // See go.dev/issue/67401. 1000 // 1001 //go:linkname parseBasicAuth 1002 func parseBasicAuth(auth string) (username, password string, ok bool) { 1003 const prefix = "Basic " 1004 // Case insensitive prefix match. See Issue 22736. 1005 if len(auth) < len(prefix) || !ascii.EqualFold(auth[:len(prefix)], prefix) { 1006 return "", "", false 1007 } 1008 c, err := base64.StdEncoding.DecodeString(auth[len(prefix):]) 1009 if err != nil { 1010 return "", "", false 1011 } 1012 cs := string(c) 1013 username, password, ok = strings.Cut(cs, ":") 1014 if !ok { 1015 return "", "", false 1016 } 1017 return username, password, true 1018 } 1019 1020 // SetBasicAuth sets the request's Authorization header to use HTTP 1021 // Basic Authentication with the provided username and password. 1022 // 1023 // With HTTP Basic Authentication the provided username and password 1024 // are not encrypted. It should generally only be used in an HTTPS 1025 // request. 1026 // 1027 // The username may not contain a colon. Some protocols may impose 1028 // additional requirements on pre-escaping the username and 1029 // password. For instance, when used with OAuth2, both arguments must 1030 // be URL encoded first with [url.QueryEscape]. 1031 func (r *Request) SetBasicAuth(username, password string) { 1032 r.Header.Set("Authorization", "Basic "+basicAuth(username, password)) 1033 } 1034 1035 // parseRequestLine parses "GET /foo HTTP/1.1" into its three parts. 1036 func parseRequestLine(line string) (method, requestURI, proto string, ok bool) { 1037 method, rest, ok1 := strings.Cut(line, " ") 1038 requestURI, proto, ok2 := strings.Cut(rest, " ") 1039 if !ok1 || !ok2 { 1040 return "", "", "", false 1041 } 1042 return method, requestURI, proto, true 1043 } 1044 1045 var textprotoReaderPool sync.Pool 1046 1047 func newTextprotoReader(br *bufio.Reader) *textproto.Reader { 1048 if v := textprotoReaderPool.Get(); v != nil { 1049 tr := v.(*textproto.Reader) 1050 tr.R = br 1051 return tr 1052 } 1053 return textproto.NewReader(br) 1054 } 1055 1056 func putTextprotoReader(r *textproto.Reader) { 1057 r.R = nil 1058 textprotoReaderPool.Put(r) 1059 } 1060 1061 // ReadRequest reads and parses an incoming request from b. 1062 // 1063 // ReadRequest is a low-level function and should only be used for 1064 // specialized applications; most code should use the [Server] to read 1065 // requests and handle them via the [Handler] interface. ReadRequest 1066 // only supports HTTP/1.x requests. For HTTP/2, use golang.org/x/net/http2. 1067 func ReadRequest(b *bufio.Reader) (*Request, error) { 1068 req, err := readRequest(b) 1069 if err != nil { 1070 return nil, err 1071 } 1072 1073 delete(req.Header, "Host") 1074 return req, err 1075 } 1076 1077 // readRequest should be an internal detail, 1078 // but widely used packages access it using linkname. 1079 // Notable members of the hall of shame include: 1080 // - github.com/sagernet/sing 1081 // - github.com/v2fly/v2ray-core/v4 1082 // - github.com/v2fly/v2ray-core/v5 1083 // 1084 // Do not remove or change the type signature. 1085 // See go.dev/issue/67401. 1086 // 1087 //go:linkname readRequest 1088 func readRequest(b *bufio.Reader) (req *Request, err error) { 1089 tp := newTextprotoReader(b) 1090 defer putTextprotoReader(tp) 1091 1092 req = new(Request) 1093 1094 // First line: GET /index.html HTTP/1.0 1095 var s string 1096 if s, err = tp.ReadLine(); err != nil { 1097 return nil, err 1098 } 1099 defer func() { 1100 if err == io.EOF { 1101 err = io.ErrUnexpectedEOF 1102 } 1103 }() 1104 1105 var ok bool 1106 req.Method, req.RequestURI, req.Proto, ok = parseRequestLine(s) 1107 if !ok { 1108 return nil, badStringError("malformed HTTP request", s) 1109 } 1110 if !validMethod(req.Method) { 1111 return nil, badStringError("invalid method", req.Method) 1112 } 1113 rawurl := req.RequestURI 1114 if req.ProtoMajor, req.ProtoMinor, ok = ParseHTTPVersion(req.Proto); !ok { 1115 return nil, badStringError("malformed HTTP version", req.Proto) 1116 } 1117 1118 // CONNECT requests are used two different ways, and neither uses a full URL: 1119 // The standard use is to tunnel HTTPS through an HTTP proxy. 1120 // It looks like "CONNECT www.google.com:443 HTTP/1.1", and the parameter is 1121 // just the authority section of a URL. This information should go in req.URL.Host. 1122 // 1123 // The net/rpc package also uses CONNECT, but there the parameter is a path 1124 // that starts with a slash. It can be parsed with the regular URL parser, 1125 // and the path will end up in req.URL.Path, where it needs to be in order for 1126 // RPC to work. 1127 justAuthority := req.Method == "CONNECT" && !strings.HasPrefix(rawurl, "/") 1128 if justAuthority { 1129 rawurl = "http://" + rawurl 1130 } 1131 1132 if req.URL, err = url.ParseRequestURI(rawurl); err != nil { 1133 return nil, err 1134 } 1135 1136 if justAuthority { 1137 // Strip the bogus "http://" back off. 1138 req.URL.Scheme = "" 1139 } 1140 1141 // Subsequent lines: Key: value. 1142 mimeHeader, err := tp.ReadMIMEHeader() 1143 if err != nil { 1144 return nil, err 1145 } 1146 req.Header = Header(mimeHeader) 1147 if len(req.Header["Host"]) > 1 { 1148 return nil, fmt.Errorf("too many Host headers") 1149 } 1150 1151 // RFC 7230, section 5.3: Must treat 1152 // GET /index.html HTTP/1.1 1153 // Host: www.google.com 1154 // and 1155 // GET http://www.google.com/index.html HTTP/1.1 1156 // Host: doesntmatter 1157 // the same. In the second case, any Host line is ignored. 1158 req.Host = req.URL.Host 1159 if req.Host == "" { 1160 req.Host = req.Header.get("Host") 1161 } 1162 1163 fixPragmaCacheControl(req.Header) 1164 1165 req.Close = shouldClose(req.ProtoMajor, req.ProtoMinor, req.Header, false) 1166 1167 err = readTransfer(req, b) 1168 if err != nil { 1169 return nil, err 1170 } 1171 1172 if req.isH2Upgrade() { 1173 // Because it's neither chunked, nor declared: 1174 req.ContentLength = -1 1175 1176 // We want to give handlers a chance to hijack the 1177 // connection, but we need to prevent the Server from 1178 // dealing with the connection further if it's not 1179 // hijacked. Set Close to ensure that: 1180 req.Close = true 1181 } 1182 return req, nil 1183 } 1184 1185 // MaxBytesReader is similar to [io.LimitReader] but is intended for 1186 // limiting the size of incoming request bodies. In contrast to 1187 // io.LimitReader, MaxBytesReader's result is a ReadCloser, returns a 1188 // non-nil error of type [*MaxBytesError] for a Read beyond the limit, 1189 // and closes the underlying reader when its Close method is called. 1190 // 1191 // MaxBytesReader prevents clients from accidentally or maliciously 1192 // sending a large request and wasting server resources. If possible, 1193 // it tells the [ResponseWriter] to close the connection after the limit 1194 // has been reached. 1195 func MaxBytesReader(w ResponseWriter, r io.ReadCloser, n int64) io.ReadCloser { 1196 if n < 0 { // Treat negative limits as equivalent to 0. 1197 n = 0 1198 } 1199 return &maxBytesReader{w: w, r: r, i: n, n: n} 1200 } 1201 1202 // MaxBytesError is returned by [MaxBytesReader] when its read limit is exceeded. 1203 type MaxBytesError struct { 1204 Limit int64 1205 } 1206 1207 func (e *MaxBytesError) Error() string { 1208 // Due to Hyrum's law, this text cannot be changed. 1209 return "http: request body too large" 1210 } 1211 1212 type maxBytesReader struct { 1213 w ResponseWriter 1214 r io.ReadCloser // underlying reader 1215 i int64 // max bytes initially, for MaxBytesError 1216 n int64 // max bytes remaining 1217 err error // sticky error 1218 } 1219 1220 func (l *maxBytesReader) Read(p []byte) (n int, err error) { 1221 if l.err != nil { 1222 return 0, l.err 1223 } 1224 if len(p) == 0 { 1225 return 0, nil 1226 } 1227 // If they asked for a 32KB byte read but only 5 bytes are 1228 // remaining, no need to read 32KB. 6 bytes will answer the 1229 // question of the whether we hit the limit or go past it. 1230 // 0 < len(p) < 2^63 1231 if int64(len(p))-1 > l.n { 1232 p = p[:l.n+1] 1233 } 1234 n, err = l.r.Read(p) 1235 1236 if int64(n) <= l.n { 1237 l.n -= int64(n) 1238 l.err = err 1239 return n, err 1240 } 1241 1242 n = int(l.n) 1243 l.n = 0 1244 1245 // The server code and client code both use 1246 // maxBytesReader. This "requestTooLarge" check is 1247 // only used by the server code. To prevent binaries 1248 // which only using the HTTP Client code (such as 1249 // cmd/go) from also linking in the HTTP server, don't 1250 // use a static type assertion to the server 1251 // "*response" type. Check this interface instead: 1252 type requestTooLarger interface { 1253 requestTooLarge() 1254 } 1255 if res, ok := l.w.(requestTooLarger); ok { 1256 res.requestTooLarge() 1257 } 1258 l.err = &MaxBytesError{l.i} 1259 return n, l.err 1260 } 1261 1262 func (l *maxBytesReader) Close() error { 1263 return l.r.Close() 1264 } 1265 1266 func copyValues(dst, src url.Values) { 1267 for k, vs := range src { 1268 dst[k] = append(dst[k], vs...) 1269 } 1270 } 1271 1272 func parsePostForm(r *Request) (vs url.Values, err error) { 1273 if r.Body == nil { 1274 err = errors.New("missing form body") 1275 return 1276 } 1277 ct := r.Header.Get("Content-Type") 1278 // RFC 7231, section 3.1.1.5 - empty type 1279 // MAY be treated as application/octet-stream 1280 if ct == "" { 1281 ct = "application/octet-stream" 1282 } 1283 ct, _, err = mime.ParseMediaType(ct) 1284 switch { 1285 case ct == "application/x-www-form-urlencoded": 1286 var reader io.Reader = r.Body 1287 maxFormSize := int64(1<<63 - 1) 1288 if _, ok := r.Body.(*maxBytesReader); !ok { 1289 maxFormSize = int64(10 << 20) // 10 MB is a lot of text. 1290 reader = io.LimitReader(r.Body, maxFormSize+1) 1291 } 1292 b, e := io.ReadAll(reader) 1293 if e != nil { 1294 if err == nil { 1295 err = e 1296 } 1297 break 1298 } 1299 if int64(len(b)) > maxFormSize { 1300 err = errors.New("http: POST too large") 1301 return 1302 } 1303 vs, e = url.ParseQuery(string(b)) 1304 if err == nil { 1305 err = e 1306 } 1307 case ct == "multipart/form-data": 1308 // handled by ParseMultipartForm (which is calling us, or should be) 1309 // TODO(bradfitz): there are too many possible 1310 // orders to call too many functions here. 1311 // Clean this up and write more tests. 1312 // request_test.go contains the start of this, 1313 // in TestParseMultipartFormOrder and others. 1314 } 1315 return 1316 } 1317 1318 // ParseForm populates r.Form and r.PostForm. 1319 // 1320 // For all requests, ParseForm parses the raw query from the URL and updates 1321 // r.Form. 1322 // 1323 // For POST, PUT, and PATCH requests, it also reads the request body, parses it 1324 // as a form and puts the results into both r.PostForm and r.Form. Request body 1325 // parameters take precedence over URL query string values in r.Form. 1326 // 1327 // If the request Body's size has not already been limited by [MaxBytesReader], 1328 // the size is capped at 10MB. 1329 // 1330 // For other HTTP methods, or when the Content-Type is not 1331 // application/x-www-form-urlencoded, the request Body is not read, and 1332 // r.PostForm is initialized to a non-nil, empty value. 1333 // 1334 // [Request.ParseMultipartForm] calls ParseForm automatically. 1335 // ParseForm is idempotent. 1336 func (r *Request) ParseForm() error { 1337 var err error 1338 if r.PostForm == nil { 1339 if r.Method == "POST" || r.Method == "PUT" || r.Method == "PATCH" { 1340 r.PostForm, err = parsePostForm(r) 1341 } 1342 if r.PostForm == nil { 1343 r.PostForm = make(url.Values) 1344 } 1345 } 1346 if r.Form == nil { 1347 if len(r.PostForm) > 0 { 1348 r.Form = make(url.Values) 1349 copyValues(r.Form, r.PostForm) 1350 } 1351 var newValues url.Values 1352 if r.URL != nil { 1353 var e error 1354 newValues, e = url.ParseQuery(r.URL.RawQuery) 1355 if err == nil { 1356 err = e 1357 } 1358 } 1359 if newValues == nil { 1360 newValues = make(url.Values) 1361 } 1362 if r.Form == nil { 1363 r.Form = newValues 1364 } else { 1365 copyValues(r.Form, newValues) 1366 } 1367 } 1368 return err 1369 } 1370 1371 // ParseMultipartForm parses a request body as multipart/form-data. 1372 // The whole request body is parsed and up to a total of maxMemory bytes of 1373 // its file parts are stored in memory, with the remainder stored on 1374 // disk in temporary files. 1375 // ParseMultipartForm calls [Request.ParseForm] if necessary. 1376 // If ParseForm returns an error, ParseMultipartForm returns it but also 1377 // continues parsing the request body. 1378 // After one call to ParseMultipartForm, subsequent calls have no effect. 1379 func (r *Request) ParseMultipartForm(maxMemory int64) error { 1380 if r.MultipartForm == multipartByReader { 1381 return errors.New("http: multipart handled by MultipartReader") 1382 } 1383 var parseFormErr error 1384 if r.Form == nil { 1385 // Let errors in ParseForm fall through, and just 1386 // return it at the end. 1387 parseFormErr = r.ParseForm() 1388 } 1389 if r.MultipartForm != nil { 1390 return nil 1391 } 1392 1393 mr, err := r.multipartReader(false) 1394 if err != nil { 1395 return err 1396 } 1397 1398 f, err := mr.ReadForm(maxMemory) 1399 if err != nil { 1400 return err 1401 } 1402 1403 if r.PostForm == nil { 1404 r.PostForm = make(url.Values) 1405 } 1406 for k, v := range f.Value { 1407 r.Form[k] = append(r.Form[k], v...) 1408 // r.PostForm should also be populated. See Issue 9305. 1409 r.PostForm[k] = append(r.PostForm[k], v...) 1410 } 1411 1412 r.MultipartForm = f 1413 1414 return parseFormErr 1415 } 1416 1417 // FormValue returns the first value for the named component of the query. 1418 // The precedence order: 1419 // 1. application/x-www-form-urlencoded form body (POST, PUT, PATCH only) 1420 // 2. query parameters (always) 1421 // 3. multipart/form-data form body (always) 1422 // 1423 // FormValue calls [Request.ParseMultipartForm] and [Request.ParseForm] 1424 // if necessary and ignores any errors returned by these functions. 1425 // If key is not present, FormValue returns the empty string. 1426 // To access multiple values of the same key, call ParseForm and 1427 // then inspect [Request.Form] directly. 1428 func (r *Request) FormValue(key string) string { 1429 if r.Form == nil { 1430 r.ParseMultipartForm(defaultMaxMemory) 1431 } 1432 if vs := r.Form[key]; len(vs) > 0 { 1433 return vs[0] 1434 } 1435 return "" 1436 } 1437 1438 // PostFormValue returns the first value for the named component of the POST, 1439 // PUT, or PATCH request body. URL query parameters are ignored. 1440 // PostFormValue calls [Request.ParseMultipartForm] and [Request.ParseForm] if necessary and ignores 1441 // any errors returned by these functions. 1442 // If key is not present, PostFormValue returns the empty string. 1443 func (r *Request) PostFormValue(key string) string { 1444 if r.PostForm == nil { 1445 r.ParseMultipartForm(defaultMaxMemory) 1446 } 1447 if vs := r.PostForm[key]; len(vs) > 0 { 1448 return vs[0] 1449 } 1450 return "" 1451 } 1452 1453 // FormFile returns the first file for the provided form key. 1454 // FormFile calls [Request.ParseMultipartForm] and [Request.ParseForm] if necessary. 1455 func (r *Request) FormFile(key string) (multipart.File, *multipart.FileHeader, error) { 1456 if r.MultipartForm == multipartByReader { 1457 return nil, nil, errors.New("http: multipart handled by MultipartReader") 1458 } 1459 if r.MultipartForm == nil { 1460 err := r.ParseMultipartForm(defaultMaxMemory) 1461 if err != nil { 1462 return nil, nil, err 1463 } 1464 } 1465 if r.MultipartForm != nil && r.MultipartForm.File != nil { 1466 if fhs := r.MultipartForm.File[key]; len(fhs) > 0 { 1467 f, err := fhs[0].Open() 1468 return f, fhs[0], err 1469 } 1470 } 1471 return nil, nil, ErrMissingFile 1472 } 1473 1474 // PathValue returns the value for the named path wildcard in the [ServeMux] pattern 1475 // that matched the request. 1476 // It returns the empty string if the request was not matched against a pattern 1477 // or there is no such wildcard in the pattern. 1478 func (r *Request) PathValue(name string) string { 1479 if i := r.patIndex(name); i >= 0 { 1480 return r.matches[i] 1481 } 1482 return r.otherValues[name] 1483 } 1484 1485 // SetPathValue sets name to value, so that subsequent calls to r.PathValue(name) 1486 // return value. 1487 func (r *Request) SetPathValue(name, value string) { 1488 if i := r.patIndex(name); i >= 0 { 1489 r.matches[i] = value 1490 } else { 1491 if r.otherValues == nil { 1492 r.otherValues = map[string]string{} 1493 } 1494 r.otherValues[name] = value 1495 } 1496 } 1497 1498 // patIndex returns the index of name in the list of named wildcards of the 1499 // request's pattern, or -1 if there is no such name. 1500 func (r *Request) patIndex(name string) int { 1501 // The linear search seems expensive compared to a map, but just creating the map 1502 // takes a lot of time, and most patterns will just have a couple of wildcards. 1503 if r.pat == nil { 1504 return -1 1505 } 1506 i := 0 1507 for _, seg := range r.pat.segments { 1508 if seg.wild && seg.s != "" { 1509 if name == seg.s { 1510 return i 1511 } 1512 i++ 1513 } 1514 } 1515 return -1 1516 } 1517 1518 func (r *Request) expectsContinue() bool { 1519 return hasToken(r.Header.get("Expect"), "100-continue") 1520 } 1521 1522 func (r *Request) wantsHttp10KeepAlive() bool { 1523 if r.ProtoMajor != 1 || r.ProtoMinor != 0 { 1524 return false 1525 } 1526 return hasToken(r.Header.get("Connection"), "keep-alive") 1527 } 1528 1529 func (r *Request) wantsClose() bool { 1530 if r.Close { 1531 return true 1532 } 1533 return hasToken(r.Header.get("Connection"), "close") 1534 } 1535 1536 func (r *Request) closeBody() error { 1537 if r.Body == nil { 1538 return nil 1539 } 1540 return r.Body.Close() 1541 } 1542 1543 func (r *Request) isReplayable() bool { 1544 if r.Body == nil || r.Body == NoBody || r.GetBody != nil { 1545 switch valueOrDefault(r.Method, "GET") { 1546 case "GET", "HEAD", "OPTIONS", "TRACE": 1547 return true 1548 } 1549 // The Idempotency-Key, while non-standard, is widely used to 1550 // mean a POST or other request is idempotent. See 1551 // https://golang.org/issue/19943#issuecomment-421092421 1552 if r.Header.has("Idempotency-Key") || r.Header.has("X-Idempotency-Key") { 1553 return true 1554 } 1555 } 1556 return false 1557 } 1558 1559 // outgoingLength reports the Content-Length of this outgoing (Client) request. 1560 // It maps 0 into -1 (unknown) when the Body is non-nil. 1561 func (r *Request) outgoingLength() int64 { 1562 if r.Body == nil || r.Body == NoBody { 1563 return 0 1564 } 1565 if r.ContentLength != 0 { 1566 return r.ContentLength 1567 } 1568 return -1 1569 } 1570 1571 // requestMethodUsuallyLacksBody reports whether the given request 1572 // method is one that typically does not involve a request body. 1573 // This is used by the Transport (via 1574 // transferWriter.shouldSendChunkedRequestBody) to determine whether 1575 // we try to test-read a byte from a non-nil Request.Body when 1576 // Request.outgoingLength() returns -1. See the comments in 1577 // shouldSendChunkedRequestBody. 1578 func requestMethodUsuallyLacksBody(method string) bool { 1579 switch method { 1580 case "GET", "HEAD", "DELETE", "OPTIONS", "PROPFIND", "SEARCH": 1581 return true 1582 } 1583 return false 1584 } 1585 1586 // requiresHTTP1 reports whether this request requires being sent on 1587 // an HTTP/1 connection. 1588 func (r *Request) requiresHTTP1() bool { 1589 return hasToken(r.Header.Get("Connection"), "upgrade") && 1590 ascii.EqualFold(r.Header.Get("Upgrade"), "websocket") 1591 } 1592