Source file src/net/http/request.go
1 // Copyright 2009 The Go Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style 3 // license that can be found in the LICENSE file. 4 5 // HTTP Request reading and parsing. 6 7 package http 8 9 import ( 10 "bufio" 11 "bytes" 12 "context" 13 "crypto/tls" 14 "encoding/base64" 15 "errors" 16 "fmt" 17 "io" 18 "maps" 19 "mime" 20 "mime/multipart" 21 "net/http/httptrace" 22 "net/http/internal/ascii" 23 "net/textproto" 24 "net/url" 25 urlpkg "net/url" 26 "strconv" 27 "strings" 28 "sync" 29 _ "unsafe" // for linkname 30 31 "golang.org/x/net/http/httpguts" 32 "golang.org/x/net/idna" 33 ) 34 35 const ( 36 defaultMaxMemory = 32 << 20 // 32 MB 37 ) 38 39 // ErrMissingFile is returned by FormFile when the provided file field name 40 // is either not present in the request or not a file field. 41 var ErrMissingFile = errors.New("http: no such file") 42 43 // ProtocolError represents an HTTP protocol error. 44 // 45 // Deprecated: Not all errors in the http package related to protocol errors 46 // are of type ProtocolError. 47 type ProtocolError struct { 48 ErrorString string 49 } 50 51 func (pe *ProtocolError) Error() string { return pe.ErrorString } 52 53 // Is lets http.ErrNotSupported match errors.ErrUnsupported. 54 func (pe *ProtocolError) Is(err error) bool { 55 return pe == ErrNotSupported && err == errors.ErrUnsupported 56 } 57 58 var ( 59 // ErrNotSupported indicates that a feature is not supported. 60 // 61 // It is returned by ResponseController methods to indicate that 62 // the handler does not support the method, and by the Push method 63 // of Pusher implementations to indicate that HTTP/2 Push support 64 // is not available. 65 ErrNotSupported = &ProtocolError{"feature not supported"} 66 67 // Deprecated: ErrUnexpectedTrailer is no longer returned by 68 // anything in the net/http package. Callers should not 69 // compare errors against this variable. 70 ErrUnexpectedTrailer = &ProtocolError{"trailer header without chunked transfer encoding"} 71 72 // ErrMissingBoundary is returned by Request.MultipartReader when the 73 // request's Content-Type does not include a "boundary" parameter. 74 ErrMissingBoundary = &ProtocolError{"no multipart boundary param in Content-Type"} 75 76 // ErrNotMultipart is returned by Request.MultipartReader when the 77 // request's Content-Type is not multipart/form-data. 78 ErrNotMultipart = &ProtocolError{"request Content-Type isn't multipart/form-data"} 79 80 // Deprecated: ErrHeaderTooLong is no longer returned by 81 // anything in the net/http package. Callers should not 82 // compare errors against this variable. 83 ErrHeaderTooLong = &ProtocolError{"header too long"} 84 85 // Deprecated: ErrShortBody is no longer returned by 86 // anything in the net/http package. Callers should not 87 // compare errors against this variable. 88 ErrShortBody = &ProtocolError{"entity body too short"} 89 90 // Deprecated: ErrMissingContentLength is no longer returned by 91 // anything in the net/http package. Callers should not 92 // compare errors against this variable. 93 ErrMissingContentLength = &ProtocolError{"missing ContentLength in HEAD response"} 94 ) 95 96 func badStringError(what, val string) error { return fmt.Errorf("%s %q", what, val) } 97 98 // Headers that Request.Write handles itself and should be skipped. 99 var reqWriteExcludeHeader = map[string]bool{ 100 "Host": true, // not in Header map anyway 101 "User-Agent": true, 102 "Content-Length": true, 103 "Transfer-Encoding": true, 104 "Trailer": true, 105 } 106 107 // A Request represents an HTTP request received by a server 108 // or to be sent by a client. 109 // 110 // The field semantics differ slightly between client and server 111 // usage. In addition to the notes on the fields below, see the 112 // documentation for [Request.Write] and [RoundTripper]. 113 type Request struct { 114 // Method specifies the HTTP method (GET, POST, PUT, etc.). 115 // For client requests, an empty string means GET. 116 Method string 117 118 // URL specifies either the URI being requested (for server 119 // requests) or the URL to access (for client requests). 120 // 121 // For server requests, the URL is parsed from the URI 122 // supplied on the Request-Line as stored in RequestURI. For 123 // most requests, fields other than Path and RawQuery will be 124 // empty. (See RFC 7230, Section 5.3) 125 // 126 // For client requests, the URL's Host specifies the server to 127 // connect to, while the Request's Host field optionally 128 // specifies the Host header value to send in the HTTP 129 // request. 130 URL *url.URL 131 132 // The protocol version for incoming server requests. 133 // 134 // For client requests, these fields are ignored. The HTTP 135 // client code always uses either HTTP/1.1 or HTTP/2. 136 // See the docs on Transport for details. 137 Proto string // "HTTP/1.0" 138 ProtoMajor int // 1 139 ProtoMinor int // 0 140 141 // Header contains the request header fields either received 142 // by the server or to be sent by the client. 143 // 144 // If a server received a request with header lines, 145 // 146 // Host: example.com 147 // accept-encoding: gzip, deflate 148 // Accept-Language: en-us 149 // fOO: Bar 150 // foo: two 151 // 152 // then 153 // 154 // Header = map[string][]string{ 155 // "Accept-Encoding": {"gzip, deflate"}, 156 // "Accept-Language": {"en-us"}, 157 // "Foo": {"Bar", "two"}, 158 // } 159 // 160 // For incoming requests, the Host header is promoted to the 161 // Request.Host field and removed from the Header map. 162 // 163 // HTTP defines that header names are case-insensitive. The 164 // request parser implements this by using CanonicalHeaderKey, 165 // making the first character and any characters following a 166 // hyphen uppercase and the rest lowercase. 167 // 168 // For client requests, certain headers such as Content-Length 169 // and Connection are automatically written when needed and 170 // values in Header may be ignored. See the documentation 171 // for the Request.Write method. 172 Header Header 173 174 // Body is the request's body. 175 // 176 // For client requests, a nil body means the request has no 177 // body, such as a GET request. The HTTP Client's Transport 178 // is responsible for calling the Close method. 179 // 180 // For server requests, the Request Body is always non-nil 181 // but will return EOF immediately when no body is present. 182 // The Server will close the request body. The ServeHTTP 183 // Handler does not need to. 184 // 185 // Body must allow Read to be called concurrently with Close. 186 // In particular, calling Close should unblock a Read waiting 187 // for input. 188 Body io.ReadCloser 189 190 // GetBody defines an optional func to return a new copy of 191 // Body. It is used for client requests when a redirect requires 192 // reading the body more than once. Use of GetBody still 193 // requires setting Body. 194 // 195 // For server requests, it is unused. 196 GetBody func() (io.ReadCloser, error) 197 198 // ContentLength records the length of the associated content. 199 // The value -1 indicates that the length is unknown. 200 // Values >= 0 indicate that the given number of bytes may 201 // be read from Body. 202 // 203 // For client requests, a value of 0 with a non-nil Body is 204 // also treated as unknown. 205 ContentLength int64 206 207 // TransferEncoding lists the transfer encodings from outermost to 208 // innermost. An empty list denotes the "identity" encoding. 209 // TransferEncoding can usually be ignored; chunked encoding is 210 // automatically added and removed as necessary when sending and 211 // receiving requests. 212 TransferEncoding []string 213 214 // Close indicates whether to close the connection after 215 // replying to this request (for servers) or after sending this 216 // request and reading its response (for clients). 217 // 218 // For server requests, the HTTP server handles this automatically 219 // and this field is not needed by Handlers. 220 // 221 // For client requests, setting this field prevents re-use of 222 // TCP connections between requests to the same hosts, as if 223 // Transport.DisableKeepAlives were set. 224 Close bool 225 226 // For server requests, Host specifies the host on which the 227 // URL is sought. For HTTP/1 (per RFC 7230, section 5.4), this 228 // is either the value of the "Host" header or the host name 229 // given in the URL itself. For HTTP/2, it is the value of the 230 // ":authority" pseudo-header field. 231 // It may be of the form "host:port". For international domain 232 // names, Host may be in Punycode or Unicode form. Use 233 // golang.org/x/net/idna to convert it to either format if 234 // needed. 235 // To prevent DNS rebinding attacks, server Handlers should 236 // validate that the Host header has a value for which the 237 // Handler considers itself authoritative. The included 238 // ServeMux supports patterns registered to particular host 239 // names and thus protects its registered Handlers. 240 // 241 // For client requests, Host optionally overrides the Host 242 // header to send. If empty, the Request.Write method uses 243 // the value of URL.Host. Host may contain an international 244 // domain name. 245 Host string 246 247 // Form contains the parsed form data, including both the URL 248 // field's query parameters and the PATCH, POST, or PUT form data. 249 // This field is only available after ParseForm is called. 250 // The HTTP client ignores Form and uses Body instead. 251 Form url.Values 252 253 // PostForm contains the parsed form data from PATCH, POST 254 // or PUT body parameters. 255 // 256 // This field is only available after ParseForm is called. 257 // The HTTP client ignores PostForm and uses Body instead. 258 PostForm url.Values 259 260 // MultipartForm is the parsed multipart form, including file uploads. 261 // This field is only available after ParseMultipartForm is called. 262 // The HTTP client ignores MultipartForm and uses Body instead. 263 MultipartForm *multipart.Form 264 265 // Trailer specifies additional headers that are sent after the request 266 // body. 267 // 268 // For server requests, the Trailer map initially contains only the 269 // trailer keys, with nil values. (The client declares which trailers it 270 // will later send.) While the handler is reading from Body, it must 271 // not reference Trailer. After reading from Body returns EOF, Trailer 272 // can be read again and will contain non-nil values, if they were sent 273 // by the client. 274 // 275 // For client requests, Trailer must be initialized to a map containing 276 // the trailer keys to later send. The values may be nil or their final 277 // values. The ContentLength must be 0 or -1, to send a chunked request. 278 // After the HTTP request is sent the map values can be updated while 279 // the request body is read. Once the body returns EOF, the caller must 280 // not mutate Trailer. 281 // 282 // Few HTTP clients, servers, or proxies support HTTP trailers. 283 Trailer Header 284 285 // RemoteAddr allows HTTP servers and other software to record 286 // the network address that sent the request, usually for 287 // logging. This field is not filled in by ReadRequest and 288 // has no defined format. The HTTP server in this package 289 // sets RemoteAddr to an "IP:port" address before invoking a 290 // handler. 291 // This field is ignored by the HTTP client. 292 RemoteAddr string 293 294 // RequestURI is the unmodified request-target of the 295 // Request-Line (RFC 7230, Section 3.1.1) as sent by the client 296 // to a server. Usually the URL field should be used instead. 297 // It is an error to set this field in an HTTP client request. 298 RequestURI string 299 300 // TLS allows HTTP servers and other software to record 301 // information about the TLS connection on which the request 302 // was received. This field is not filled in by ReadRequest. 303 // The HTTP server in this package sets the field for 304 // TLS-enabled connections before invoking a handler; 305 // otherwise it leaves the field nil. 306 // This field is ignored by the HTTP client. 307 TLS *tls.ConnectionState 308 309 // Cancel is an optional channel whose closure indicates that the client 310 // request should be regarded as canceled. Not all implementations of 311 // RoundTripper may support Cancel. 312 // 313 // For server requests, this field is not applicable. 314 // 315 // Deprecated: Set the Request's context with NewRequestWithContext 316 // instead. If a Request's Cancel field and context are both 317 // set, it is undefined whether Cancel is respected. 318 Cancel <-chan struct{} 319 320 // Response is the redirect response which caused this request 321 // to be created. This field is only populated during client 322 // redirects. 323 Response *Response 324 325 // Pattern is the [ServeMux] pattern that matched the request. 326 // It is empty if the request was not matched against a pattern. 327 Pattern string 328 329 // ctx is either the client or server context. It should only 330 // be modified via copying the whole Request using Clone or WithContext. 331 // It is unexported to prevent people from using Context wrong 332 // and mutating the contexts held by callers of the same request. 333 ctx context.Context 334 335 // The following fields are for requests matched by ServeMux. 336 pat *pattern // the pattern that matched 337 matches []string // values for the matching wildcards in pat 338 otherValues map[string]string // for calls to SetPathValue that don't match a wildcard 339 } 340 341 // Context returns the request's context. To change the context, use 342 // [Request.Clone] or [Request.WithContext]. 343 // 344 // The returned context is always non-nil; it defaults to the 345 // background context. 346 // 347 // For outgoing client requests, the context controls cancellation. 348 // 349 // For incoming server requests, the context is canceled when the 350 // client's connection closes, the request is canceled (with HTTP/2), 351 // or when the ServeHTTP method returns. 352 func (r *Request) Context() context.Context { 353 if r.ctx != nil { 354 return r.ctx 355 } 356 return context.Background() 357 } 358 359 // WithContext returns a shallow copy of r with its context changed 360 // to ctx. The provided ctx must be non-nil. 361 // 362 // For outgoing client request, the context controls the entire 363 // lifetime of a request and its response: obtaining a connection, 364 // sending the request, and reading the response headers and body. 365 // 366 // To create a new request with a context, use [NewRequestWithContext]. 367 // To make a deep copy of a request with a new context, use [Request.Clone]. 368 func (r *Request) WithContext(ctx context.Context) *Request { 369 if ctx == nil { 370 panic("nil context") 371 } 372 r2 := new(Request) 373 *r2 = *r 374 r2.ctx = ctx 375 return r2 376 } 377 378 // Clone returns a deep copy of r with its context changed to ctx. 379 // The provided ctx must be non-nil. 380 // 381 // Clone only makes a shallow copy of the Body field. 382 // 383 // For an outgoing client request, the context controls the entire 384 // lifetime of a request and its response: obtaining a connection, 385 // sending the request, and reading the response headers and body. 386 func (r *Request) Clone(ctx context.Context) *Request { 387 if ctx == nil { 388 panic("nil context") 389 } 390 r2 := new(Request) 391 *r2 = *r 392 r2.ctx = ctx 393 r2.URL = cloneURL(r.URL) 394 r2.Header = r.Header.Clone() 395 r2.Trailer = r.Trailer.Clone() 396 if s := r.TransferEncoding; s != nil { 397 s2 := make([]string, len(s)) 398 copy(s2, s) 399 r2.TransferEncoding = s2 400 } 401 r2.Form = cloneURLValues(r.Form) 402 r2.PostForm = cloneURLValues(r.PostForm) 403 r2.MultipartForm = cloneMultipartForm(r.MultipartForm) 404 405 // Copy matches and otherValues. See issue 61410. 406 if s := r.matches; s != nil { 407 s2 := make([]string, len(s)) 408 copy(s2, s) 409 r2.matches = s2 410 } 411 r2.otherValues = maps.Clone(r.otherValues) 412 return r2 413 } 414 415 // ProtoAtLeast reports whether the HTTP protocol used 416 // in the request is at least major.minor. 417 func (r *Request) ProtoAtLeast(major, minor int) bool { 418 return r.ProtoMajor > major || 419 r.ProtoMajor == major && r.ProtoMinor >= minor 420 } 421 422 // UserAgent returns the client's User-Agent, if sent in the request. 423 func (r *Request) UserAgent() string { 424 return r.Header.Get("User-Agent") 425 } 426 427 // Cookies parses and returns the HTTP cookies sent with the request. 428 func (r *Request) Cookies() []*Cookie { 429 return readCookies(r.Header, "") 430 } 431 432 // CookiesNamed parses and returns the named HTTP cookies sent with the request 433 // or an empty slice if none matched. 434 func (r *Request) CookiesNamed(name string) []*Cookie { 435 if name == "" { 436 return []*Cookie{} 437 } 438 return readCookies(r.Header, name) 439 } 440 441 // ErrNoCookie is returned by Request's Cookie method when a cookie is not found. 442 var ErrNoCookie = errors.New("http: named cookie not present") 443 444 // Cookie returns the named cookie provided in the request or 445 // [ErrNoCookie] if not found. 446 // If multiple cookies match the given name, only one cookie will 447 // be returned. 448 func (r *Request) Cookie(name string) (*Cookie, error) { 449 if name == "" { 450 return nil, ErrNoCookie 451 } 452 for _, c := range readCookies(r.Header, name) { 453 return c, nil 454 } 455 return nil, ErrNoCookie 456 } 457 458 // AddCookie adds a cookie to the request. Per RFC 6265 section 5.4, 459 // AddCookie does not attach more than one [Cookie] header field. That 460 // means all cookies, if any, are written into the same line, 461 // separated by semicolon. 462 // AddCookie only sanitizes c's name and value, and does not sanitize 463 // a Cookie header already present in the request. 464 func (r *Request) AddCookie(c *Cookie) { 465 s := fmt.Sprintf("%s=%s", sanitizeCookieName(c.Name), sanitizeCookieValue(c.Value, c.Quoted)) 466 if c := r.Header.Get("Cookie"); c != "" { 467 r.Header.Set("Cookie", c+"; "+s) 468 } else { 469 r.Header.Set("Cookie", s) 470 } 471 } 472 473 // Referer returns the referring URL, if sent in the request. 474 // 475 // Referer is misspelled as in the request itself, a mistake from the 476 // earliest days of HTTP. This value can also be fetched from the 477 // [Header] map as Header["Referer"]; the benefit of making it available 478 // as a method is that the compiler can diagnose programs that use the 479 // alternate (correct English) spelling req.Referrer() but cannot 480 // diagnose programs that use Header["Referrer"]. 481 func (r *Request) Referer() string { 482 return r.Header.Get("Referer") 483 } 484 485 // multipartByReader is a sentinel value. 486 // Its presence in Request.MultipartForm indicates that parsing of the request 487 // body has been handed off to a MultipartReader instead of ParseMultipartForm. 488 var multipartByReader = &multipart.Form{ 489 Value: make(map[string][]string), 490 File: make(map[string][]*multipart.FileHeader), 491 } 492 493 // MultipartReader returns a MIME multipart reader if this is a 494 // multipart/form-data or a multipart/mixed POST request, else returns nil and an error. 495 // Use this function instead of [Request.ParseMultipartForm] to 496 // process the request body as a stream. 497 func (r *Request) MultipartReader() (*multipart.Reader, error) { 498 if r.MultipartForm == multipartByReader { 499 return nil, errors.New("http: MultipartReader called twice") 500 } 501 if r.MultipartForm != nil { 502 return nil, errors.New("http: multipart handled by ParseMultipartForm") 503 } 504 r.MultipartForm = multipartByReader 505 return r.multipartReader(true) 506 } 507 508 func (r *Request) multipartReader(allowMixed bool) (*multipart.Reader, error) { 509 v := r.Header.Get("Content-Type") 510 if v == "" { 511 return nil, ErrNotMultipart 512 } 513 if r.Body == nil { 514 return nil, errors.New("missing form body") 515 } 516 d, params, err := mime.ParseMediaType(v) 517 if err != nil || !(d == "multipart/form-data" || allowMixed && d == "multipart/mixed") { 518 return nil, ErrNotMultipart 519 } 520 boundary, ok := params["boundary"] 521 if !ok { 522 return nil, ErrMissingBoundary 523 } 524 return multipart.NewReader(r.Body, boundary), nil 525 } 526 527 // isH2Upgrade reports whether r represents the http2 "client preface" 528 // magic string. 529 func (r *Request) isH2Upgrade() bool { 530 return r.Method == "PRI" && len(r.Header) == 0 && r.URL.Path == "*" && r.Proto == "HTTP/2.0" 531 } 532 533 // Return value if nonempty, def otherwise. 534 func valueOrDefault(value, def string) string { 535 if value != "" { 536 return value 537 } 538 return def 539 } 540 541 // NOTE: This is not intended to reflect the actual Go version being used. 542 // It was changed at the time of Go 1.1 release because the former User-Agent 543 // had ended up blocked by some intrusion detection systems. 544 // See https://codereview.appspot.com/7532043. 545 const defaultUserAgent = "Go-http-client/1.1" 546 547 // Write writes an HTTP/1.1 request, which is the header and body, in wire format. 548 // This method consults the following fields of the request: 549 // 550 // Host 551 // URL 552 // Method (defaults to "GET") 553 // Header 554 // ContentLength 555 // TransferEncoding 556 // Body 557 // 558 // If Body is present, Content-Length is <= 0 and [Request.TransferEncoding] 559 // hasn't been set to "identity", Write adds "Transfer-Encoding: 560 // chunked" to the header. Body is closed after it is sent. 561 // 562 // Header values for Host, Content-Length, Transfer-Encoding, 563 // and Trailer are not used; these are derived from other Request fields. 564 // If the Header does not contain a User-Agent value, Write uses 565 // "Go-http-client/1.1". 566 func (r *Request) Write(w io.Writer) error { 567 return r.write(w, false, nil, nil) 568 } 569 570 // WriteProxy is like [Request.Write] but writes the request in the form 571 // expected by an HTTP proxy. In particular, [Request.WriteProxy] writes the 572 // initial Request-URI line of the request with an absolute URI, per 573 // section 5.3 of RFC 7230, including the scheme and host. 574 // In either case, WriteProxy also writes a Host header, using 575 // either r.Host or r.URL.Host. 576 func (r *Request) WriteProxy(w io.Writer) error { 577 return r.write(w, true, nil, nil) 578 } 579 580 // errMissingHost is returned by Write when there is no Host or URL present in 581 // the Request. 582 var errMissingHost = errors.New("http: Request.Write on Request with no Host or URL set") 583 584 // extraHeaders may be nil 585 // waitForContinue may be nil 586 // always closes body 587 func (r *Request) write(w io.Writer, usingProxy bool, extraHeaders Header, waitForContinue func() bool) (err error) { 588 trace := httptrace.ContextClientTrace(r.Context()) 589 if trace != nil && trace.WroteRequest != nil { 590 defer func() { 591 trace.WroteRequest(httptrace.WroteRequestInfo{ 592 Err: err, 593 }) 594 }() 595 } 596 closed := false 597 defer func() { 598 if closed { 599 return 600 } 601 if closeErr := r.closeBody(); closeErr != nil && err == nil { 602 err = closeErr 603 } 604 }() 605 606 // Find the target host. Prefer the Host: header, but if that 607 // is not given, use the host from the request URL. 608 // 609 // Clean the host, in case it arrives with unexpected stuff in it. 610 host := r.Host 611 if host == "" { 612 if r.URL == nil { 613 return errMissingHost 614 } 615 host = r.URL.Host 616 } 617 host, err = httpguts.PunycodeHostPort(host) 618 if err != nil { 619 return err 620 } 621 // Validate that the Host header is a valid header in general, 622 // but don't validate the host itself. This is sufficient to avoid 623 // header or request smuggling via the Host field. 624 // The server can (and will, if it's a net/http server) reject 625 // the request if it doesn't consider the host valid. 626 if !httpguts.ValidHostHeader(host) { 627 // Historically, we would truncate the Host header after '/' or ' '. 628 // Some users have relied on this truncation to convert a network 629 // address such as Unix domain socket path into a valid, ignored 630 // Host header (see https://go.dev/issue/61431). 631 // 632 // We don't preserve the truncation, because sending an altered 633 // header field opens a smuggling vector. Instead, zero out the 634 // Host header entirely if it isn't valid. (An empty Host is valid; 635 // see RFC 9112 Section 3.2.) 636 // 637 // Return an error if we're sending to a proxy, since the proxy 638 // probably can't do anything useful with an empty Host header. 639 if !usingProxy { 640 host = "" 641 } else { 642 return errors.New("http: invalid Host header") 643 } 644 } 645 646 // According to RFC 6874, an HTTP client, proxy, or other 647 // intermediary must remove any IPv6 zone identifier attached 648 // to an outgoing URI. 649 host = removeZone(host) 650 651 ruri := r.URL.RequestURI() 652 if usingProxy && r.URL.Scheme != "" && r.URL.Opaque == "" { 653 ruri = r.URL.Scheme + "://" + host + ruri 654 } else if r.Method == "CONNECT" && r.URL.Path == "" { 655 // CONNECT requests normally give just the host and port, not a full URL. 656 ruri = host 657 if r.URL.Opaque != "" { 658 ruri = r.URL.Opaque 659 } 660 } 661 if stringContainsCTLByte(ruri) { 662 return errors.New("net/http: can't write control character in Request.URL") 663 } 664 // TODO: validate r.Method too? At least it's less likely to 665 // come from an attacker (more likely to be a constant in 666 // code). 667 668 // Wrap the writer in a bufio Writer if it's not already buffered. 669 // Don't always call NewWriter, as that forces a bytes.Buffer 670 // and other small bufio Writers to have a minimum 4k buffer 671 // size. 672 var bw *bufio.Writer 673 if _, ok := w.(io.ByteWriter); !ok { 674 bw = bufio.NewWriter(w) 675 w = bw 676 } 677 678 _, err = fmt.Fprintf(w, "%s %s HTTP/1.1\r\n", valueOrDefault(r.Method, "GET"), ruri) 679 if err != nil { 680 return err 681 } 682 683 // Header lines 684 _, err = fmt.Fprintf(w, "Host: %s\r\n", host) 685 if err != nil { 686 return err 687 } 688 if trace != nil && trace.WroteHeaderField != nil { 689 trace.WroteHeaderField("Host", []string{host}) 690 } 691 692 // Use the defaultUserAgent unless the Header contains one, which 693 // may be blank to not send the header. 694 userAgent := defaultUserAgent 695 if r.Header.has("User-Agent") { 696 userAgent = r.Header.Get("User-Agent") 697 } 698 if userAgent != "" { 699 userAgent = headerNewlineToSpace.Replace(userAgent) 700 userAgent = textproto.TrimString(userAgent) 701 _, err = fmt.Fprintf(w, "User-Agent: %s\r\n", userAgent) 702 if err != nil { 703 return err 704 } 705 if trace != nil && trace.WroteHeaderField != nil { 706 trace.WroteHeaderField("User-Agent", []string{userAgent}) 707 } 708 } 709 710 // Process Body,ContentLength,Close,Trailer 711 tw, err := newTransferWriter(r) 712 if err != nil { 713 return err 714 } 715 err = tw.writeHeader(w, trace) 716 if err != nil { 717 return err 718 } 719 720 err = r.Header.writeSubset(w, reqWriteExcludeHeader, trace) 721 if err != nil { 722 return err 723 } 724 725 if extraHeaders != nil { 726 err = extraHeaders.write(w, trace) 727 if err != nil { 728 return err 729 } 730 } 731 732 _, err = io.WriteString(w, "\r\n") 733 if err != nil { 734 return err 735 } 736 737 if trace != nil && trace.WroteHeaders != nil { 738 trace.WroteHeaders() 739 } 740 741 // Flush and wait for 100-continue if expected. 742 if waitForContinue != nil { 743 if bw, ok := w.(*bufio.Writer); ok { 744 err = bw.Flush() 745 if err != nil { 746 return err 747 } 748 } 749 if trace != nil && trace.Wait100Continue != nil { 750 trace.Wait100Continue() 751 } 752 if !waitForContinue() { 753 closed = true 754 r.closeBody() 755 return nil 756 } 757 } 758 759 if bw, ok := w.(*bufio.Writer); ok && tw.FlushHeaders { 760 if err := bw.Flush(); err != nil { 761 return err 762 } 763 } 764 765 // Write body and trailer 766 closed = true 767 err = tw.writeBody(w) 768 if err != nil { 769 if tw.bodyReadError == err { 770 err = requestBodyReadError{err} 771 } 772 return err 773 } 774 775 if bw != nil { 776 return bw.Flush() 777 } 778 return nil 779 } 780 781 // requestBodyReadError wraps an error from (*Request).write to indicate 782 // that the error came from a Read call on the Request.Body. 783 // This error type should not escape the net/http package to users. 784 type requestBodyReadError struct{ error } 785 786 func idnaASCII(v string) (string, error) { 787 // TODO: Consider removing this check after verifying performance is okay. 788 // Right now punycode verification, length checks, context checks, and the 789 // permissible character tests are all omitted. It also prevents the ToASCII 790 // call from salvaging an invalid IDN, when possible. As a result it may be 791 // possible to have two IDNs that appear identical to the user where the 792 // ASCII-only version causes an error downstream whereas the non-ASCII 793 // version does not. 794 // Note that for correct ASCII IDNs ToASCII will only do considerably more 795 // work, but it will not cause an allocation. 796 if ascii.Is(v) { 797 return v, nil 798 } 799 return idna.Lookup.ToASCII(v) 800 } 801 802 // removeZone removes IPv6 zone identifier from host. 803 // E.g., "[fe80::1%en0]:8080" to "[fe80::1]:8080" 804 func removeZone(host string) string { 805 if !strings.HasPrefix(host, "[") { 806 return host 807 } 808 i := strings.LastIndex(host, "]") 809 if i < 0 { 810 return host 811 } 812 j := strings.LastIndex(host[:i], "%") 813 if j < 0 { 814 return host 815 } 816 return host[:j] + host[i:] 817 } 818 819 // ParseHTTPVersion parses an HTTP version string according to RFC 7230, section 2.6. 820 // "HTTP/1.0" returns (1, 0, true). Note that strings without 821 // a minor version, such as "HTTP/2", are not valid. 822 func ParseHTTPVersion(vers string) (major, minor int, ok bool) { 823 switch vers { 824 case "HTTP/1.1": 825 return 1, 1, true 826 case "HTTP/1.0": 827 return 1, 0, true 828 } 829 if !strings.HasPrefix(vers, "HTTP/") { 830 return 0, 0, false 831 } 832 if len(vers) != len("HTTP/X.Y") { 833 return 0, 0, false 834 } 835 if vers[6] != '.' { 836 return 0, 0, false 837 } 838 maj, err := strconv.ParseUint(vers[5:6], 10, 0) 839 if err != nil { 840 return 0, 0, false 841 } 842 min, err := strconv.ParseUint(vers[7:8], 10, 0) 843 if err != nil { 844 return 0, 0, false 845 } 846 return int(maj), int(min), true 847 } 848 849 func validMethod(method string) bool { 850 /* 851 Method = "OPTIONS" ; Section 9.2 852 | "GET" ; Section 9.3 853 | "HEAD" ; Section 9.4 854 | "POST" ; Section 9.5 855 | "PUT" ; Section 9.6 856 | "DELETE" ; Section 9.7 857 | "TRACE" ; Section 9.8 858 | "CONNECT" ; Section 9.9 859 | extension-method 860 extension-method = token 861 token = 1*<any CHAR except CTLs or separators> 862 */ 863 return isToken(method) 864 } 865 866 // NewRequest wraps [NewRequestWithContext] using [context.Background]. 867 func NewRequest(method, url string, body io.Reader) (*Request, error) { 868 return NewRequestWithContext(context.Background(), method, url, body) 869 } 870 871 // NewRequestWithContext returns a new [Request] given a method, URL, and 872 // optional body. 873 // 874 // If the provided body is also an [io.Closer], the returned 875 // [Request.Body] is set to body and will be closed (possibly 876 // asynchronously) by the Client methods Do, Post, and PostForm, 877 // and [Transport.RoundTrip]. 878 // 879 // NewRequestWithContext returns a Request suitable for use with 880 // [Client.Do] or [Transport.RoundTrip]. To create a request for use with 881 // testing a Server Handler, either use the [net/http/httptest.NewRequest] function, 882 // use [ReadRequest], or manually update the Request fields. 883 // For an outgoing client request, the context 884 // controls the entire lifetime of a request and its response: 885 // obtaining a connection, sending the request, and reading the 886 // response headers and body. See the [Request] type's documentation for 887 // the difference between inbound and outbound request fields. 888 // 889 // If body is of type [*bytes.Buffer], [*bytes.Reader], or 890 // [*strings.Reader], the returned request's ContentLength is set to its 891 // exact value (instead of -1), GetBody is populated (so 307 and 308 892 // redirects can replay the body), and Body is set to [NoBody] if the 893 // ContentLength is 0. 894 func NewRequestWithContext(ctx context.Context, method, url string, body io.Reader) (*Request, error) { 895 if method == "" { 896 // We document that "" means "GET" for Request.Method, and people have 897 // relied on that from NewRequest, so keep that working. 898 // We still enforce validMethod for non-empty methods. 899 method = "GET" 900 } 901 if !validMethod(method) { 902 return nil, fmt.Errorf("net/http: invalid method %q", method) 903 } 904 if ctx == nil { 905 return nil, errors.New("net/http: nil Context") 906 } 907 u, err := urlpkg.Parse(url) 908 if err != nil { 909 return nil, err 910 } 911 rc, ok := body.(io.ReadCloser) 912 if !ok && body != nil { 913 rc = io.NopCloser(body) 914 } 915 // The host's colon:port should be normalized. See Issue 14836. 916 u.Host = strings.TrimSuffix(u.Host, ":") 917 req := &Request{ 918 ctx: ctx, 919 Method: method, 920 URL: u, 921 Proto: "HTTP/1.1", 922 ProtoMajor: 1, 923 ProtoMinor: 1, 924 Header: make(Header), 925 Body: rc, 926 Host: u.Host, 927 } 928 if body != nil { 929 switch v := body.(type) { 930 case *bytes.Buffer: 931 req.ContentLength = int64(v.Len()) 932 buf := v.Bytes() 933 req.GetBody = func() (io.ReadCloser, error) { 934 r := bytes.NewReader(buf) 935 return io.NopCloser(r), nil 936 } 937 case *bytes.Reader: 938 req.ContentLength = int64(v.Len()) 939 snapshot := *v 940 req.GetBody = func() (io.ReadCloser, error) { 941 r := snapshot 942 return io.NopCloser(&r), nil 943 } 944 case *strings.Reader: 945 req.ContentLength = int64(v.Len()) 946 snapshot := *v 947 req.GetBody = func() (io.ReadCloser, error) { 948 r := snapshot 949 return io.NopCloser(&r), nil 950 } 951 default: 952 // This is where we'd set it to -1 (at least 953 // if body != NoBody) to mean unknown, but 954 // that broke people during the Go 1.8 testing 955 // period. People depend on it being 0 I 956 // guess. Maybe retry later. See Issue 18117. 957 } 958 // For client requests, Request.ContentLength of 0 959 // means either actually 0, or unknown. The only way 960 // to explicitly say that the ContentLength is zero is 961 // to set the Body to nil. But turns out too much code 962 // depends on NewRequest returning a non-nil Body, 963 // so we use a well-known ReadCloser variable instead 964 // and have the http package also treat that sentinel 965 // variable to mean explicitly zero. 966 if req.GetBody != nil && req.ContentLength == 0 { 967 req.Body = NoBody 968 req.GetBody = func() (io.ReadCloser, error) { return NoBody, nil } 969 } 970 } 971 972 return req, nil 973 } 974 975 // BasicAuth returns the username and password provided in the request's 976 // Authorization header, if the request uses HTTP Basic Authentication. 977 // See RFC 2617, Section 2. 978 func (r *Request) BasicAuth() (username, password string, ok bool) { 979 auth := r.Header.Get("Authorization") 980 if auth == "" { 981 return "", "", false 982 } 983 return parseBasicAuth(auth) 984 } 985 986 // parseBasicAuth parses an HTTP Basic Authentication string. 987 // "Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==" returns ("Aladdin", "open sesame", true). 988 // 989 // parseBasicAuth should be an internal detail, 990 // but widely used packages access it using linkname. 991 // Notable members of the hall of shame include: 992 // - github.com/sagernet/sing 993 // 994 // Do not remove or change the type signature. 995 // See go.dev/issue/67401. 996 // 997 //go:linkname parseBasicAuth 998 func parseBasicAuth(auth string) (username, password string, ok bool) { 999 const prefix = "Basic " 1000 // Case insensitive prefix match. See Issue 22736. 1001 if len(auth) < len(prefix) || !ascii.EqualFold(auth[:len(prefix)], prefix) { 1002 return "", "", false 1003 } 1004 c, err := base64.StdEncoding.DecodeString(auth[len(prefix):]) 1005 if err != nil { 1006 return "", "", false 1007 } 1008 cs := string(c) 1009 username, password, ok = strings.Cut(cs, ":") 1010 if !ok { 1011 return "", "", false 1012 } 1013 return username, password, true 1014 } 1015 1016 // SetBasicAuth sets the request's Authorization header to use HTTP 1017 // Basic Authentication with the provided username and password. 1018 // 1019 // With HTTP Basic Authentication the provided username and password 1020 // are not encrypted. It should generally only be used in an HTTPS 1021 // request. 1022 // 1023 // The username may not contain a colon. Some protocols may impose 1024 // additional requirements on pre-escaping the username and 1025 // password. For instance, when used with OAuth2, both arguments must 1026 // be URL encoded first with [url.QueryEscape]. 1027 func (r *Request) SetBasicAuth(username, password string) { 1028 r.Header.Set("Authorization", "Basic "+basicAuth(username, password)) 1029 } 1030 1031 // parseRequestLine parses "GET /foo HTTP/1.1" into its three parts. 1032 func parseRequestLine(line string) (method, requestURI, proto string, ok bool) { 1033 method, rest, ok1 := strings.Cut(line, " ") 1034 requestURI, proto, ok2 := strings.Cut(rest, " ") 1035 if !ok1 || !ok2 { 1036 return "", "", "", false 1037 } 1038 return method, requestURI, proto, true 1039 } 1040 1041 var textprotoReaderPool sync.Pool 1042 1043 func newTextprotoReader(br *bufio.Reader) *textproto.Reader { 1044 if v := textprotoReaderPool.Get(); v != nil { 1045 tr := v.(*textproto.Reader) 1046 tr.R = br 1047 return tr 1048 } 1049 return textproto.NewReader(br) 1050 } 1051 1052 func putTextprotoReader(r *textproto.Reader) { 1053 r.R = nil 1054 textprotoReaderPool.Put(r) 1055 } 1056 1057 // ReadRequest reads and parses an incoming request from b. 1058 // 1059 // ReadRequest is a low-level function and should only be used for 1060 // specialized applications; most code should use the [Server] to read 1061 // requests and handle them via the [Handler] interface. ReadRequest 1062 // only supports HTTP/1.x requests. For HTTP/2, use golang.org/x/net/http2. 1063 func ReadRequest(b *bufio.Reader) (*Request, error) { 1064 req, err := readRequest(b) 1065 if err != nil { 1066 return nil, err 1067 } 1068 1069 delete(req.Header, "Host") 1070 return req, nil 1071 } 1072 1073 // readRequest should be an internal detail, 1074 // but widely used packages access it using linkname. 1075 // Notable members of the hall of shame include: 1076 // - github.com/sagernet/sing 1077 // - github.com/v2fly/v2ray-core/v4 1078 // - github.com/v2fly/v2ray-core/v5 1079 // 1080 // Do not remove or change the type signature. 1081 // See go.dev/issue/67401. 1082 // 1083 //go:linkname readRequest 1084 func readRequest(b *bufio.Reader) (req *Request, err error) { 1085 tp := newTextprotoReader(b) 1086 defer putTextprotoReader(tp) 1087 1088 req = new(Request) 1089 1090 // First line: GET /index.html HTTP/1.0 1091 var s string 1092 if s, err = tp.ReadLine(); err != nil { 1093 return nil, err 1094 } 1095 defer func() { 1096 if err == io.EOF { 1097 err = io.ErrUnexpectedEOF 1098 } 1099 }() 1100 1101 var ok bool 1102 req.Method, req.RequestURI, req.Proto, ok = parseRequestLine(s) 1103 if !ok { 1104 return nil, badStringError("malformed HTTP request", s) 1105 } 1106 if !validMethod(req.Method) { 1107 return nil, badStringError("invalid method", req.Method) 1108 } 1109 rawurl := req.RequestURI 1110 if req.ProtoMajor, req.ProtoMinor, ok = ParseHTTPVersion(req.Proto); !ok { 1111 return nil, badStringError("malformed HTTP version", req.Proto) 1112 } 1113 1114 // CONNECT requests are used two different ways, and neither uses a full URL: 1115 // The standard use is to tunnel HTTPS through an HTTP proxy. 1116 // It looks like "CONNECT www.google.com:443 HTTP/1.1", and the parameter is 1117 // just the authority section of a URL. This information should go in req.URL.Host. 1118 // 1119 // The net/rpc package also uses CONNECT, but there the parameter is a path 1120 // that starts with a slash. It can be parsed with the regular URL parser, 1121 // and the path will end up in req.URL.Path, where it needs to be in order for 1122 // RPC to work. 1123 justAuthority := req.Method == "CONNECT" && !strings.HasPrefix(rawurl, "/") 1124 if justAuthority { 1125 rawurl = "http://" + rawurl 1126 } 1127 1128 if req.URL, err = url.ParseRequestURI(rawurl); err != nil { 1129 return nil, err 1130 } 1131 1132 if justAuthority { 1133 // Strip the bogus "http://" back off. 1134 req.URL.Scheme = "" 1135 } 1136 1137 // Subsequent lines: Key: value. 1138 mimeHeader, err := tp.ReadMIMEHeader() 1139 if err != nil { 1140 return nil, err 1141 } 1142 req.Header = Header(mimeHeader) 1143 if len(req.Header["Host"]) > 1 { 1144 return nil, fmt.Errorf("too many Host headers") 1145 } 1146 1147 // RFC 7230, section 5.3: Must treat 1148 // GET /index.html HTTP/1.1 1149 // Host: www.google.com 1150 // and 1151 // GET http://www.google.com/index.html HTTP/1.1 1152 // Host: doesntmatter 1153 // the same. In the second case, any Host line is ignored. 1154 req.Host = req.URL.Host 1155 if req.Host == "" { 1156 req.Host = req.Header.get("Host") 1157 } 1158 1159 fixPragmaCacheControl(req.Header) 1160 1161 req.Close = shouldClose(req.ProtoMajor, req.ProtoMinor, req.Header, false) 1162 1163 err = readTransfer(req, b) 1164 if err != nil { 1165 return nil, err 1166 } 1167 1168 if req.isH2Upgrade() { 1169 // Because it's neither chunked, nor declared: 1170 req.ContentLength = -1 1171 1172 // We want to give handlers a chance to hijack the 1173 // connection, but we need to prevent the Server from 1174 // dealing with the connection further if it's not 1175 // hijacked. Set Close to ensure that: 1176 req.Close = true 1177 } 1178 return req, nil 1179 } 1180 1181 // MaxBytesReader is similar to [io.LimitReader] but is intended for 1182 // limiting the size of incoming request bodies. In contrast to 1183 // io.LimitReader, MaxBytesReader's result is a ReadCloser, returns a 1184 // non-nil error of type [*MaxBytesError] for a Read beyond the limit, 1185 // and closes the underlying reader when its Close method is called. 1186 // 1187 // MaxBytesReader prevents clients from accidentally or maliciously 1188 // sending a large request and wasting server resources. If possible, 1189 // it tells the [ResponseWriter] to close the connection after the limit 1190 // has been reached. 1191 func MaxBytesReader(w ResponseWriter, r io.ReadCloser, n int64) io.ReadCloser { 1192 if n < 0 { // Treat negative limits as equivalent to 0. 1193 n = 0 1194 } 1195 return &maxBytesReader{w: w, r: r, i: n, n: n} 1196 } 1197 1198 // MaxBytesError is returned by [MaxBytesReader] when its read limit is exceeded. 1199 type MaxBytesError struct { 1200 Limit int64 1201 } 1202 1203 func (e *MaxBytesError) Error() string { 1204 // Due to Hyrum's law, this text cannot be changed. 1205 return "http: request body too large" 1206 } 1207 1208 type maxBytesReader struct { 1209 w ResponseWriter 1210 r io.ReadCloser // underlying reader 1211 i int64 // max bytes initially, for MaxBytesError 1212 n int64 // max bytes remaining 1213 err error // sticky error 1214 } 1215 1216 func (l *maxBytesReader) Read(p []byte) (n int, err error) { 1217 if l.err != nil { 1218 return 0, l.err 1219 } 1220 if len(p) == 0 { 1221 return 0, nil 1222 } 1223 // If they asked for a 32KB byte read but only 5 bytes are 1224 // remaining, no need to read 32KB. 6 bytes will answer the 1225 // question of the whether we hit the limit or go past it. 1226 // 0 < len(p) < 2^63 1227 if int64(len(p))-1 > l.n { 1228 p = p[:l.n+1] 1229 } 1230 n, err = l.r.Read(p) 1231 1232 if int64(n) <= l.n { 1233 l.n -= int64(n) 1234 l.err = err 1235 return n, err 1236 } 1237 1238 n = int(l.n) 1239 l.n = 0 1240 1241 // The server code and client code both use 1242 // maxBytesReader. This "requestTooLarge" check is 1243 // only used by the server code. To prevent binaries 1244 // which only using the HTTP Client code (such as 1245 // cmd/go) from also linking in the HTTP server, don't 1246 // use a static type assertion to the server 1247 // "*response" type. Check this interface instead: 1248 type requestTooLarger interface { 1249 requestTooLarge() 1250 } 1251 if res, ok := l.w.(requestTooLarger); ok { 1252 res.requestTooLarge() 1253 } 1254 l.err = &MaxBytesError{l.i} 1255 return n, l.err 1256 } 1257 1258 func (l *maxBytesReader) Close() error { 1259 return l.r.Close() 1260 } 1261 1262 func copyValues(dst, src url.Values) { 1263 for k, vs := range src { 1264 dst[k] = append(dst[k], vs...) 1265 } 1266 } 1267 1268 func parsePostForm(r *Request) (vs url.Values, err error) { 1269 if r.Body == nil { 1270 err = errors.New("missing form body") 1271 return 1272 } 1273 ct := r.Header.Get("Content-Type") 1274 // RFC 7231, section 3.1.1.5 - empty type 1275 // MAY be treated as application/octet-stream 1276 if ct == "" { 1277 ct = "application/octet-stream" 1278 } 1279 ct, _, err = mime.ParseMediaType(ct) 1280 switch { 1281 case ct == "application/x-www-form-urlencoded": 1282 var reader io.Reader = r.Body 1283 maxFormSize := int64(1<<63 - 1) 1284 if _, ok := r.Body.(*maxBytesReader); !ok { 1285 maxFormSize = int64(10 << 20) // 10 MB is a lot of text. 1286 reader = io.LimitReader(r.Body, maxFormSize+1) 1287 } 1288 b, e := io.ReadAll(reader) 1289 if e != nil { 1290 if err == nil { 1291 err = e 1292 } 1293 break 1294 } 1295 if int64(len(b)) > maxFormSize { 1296 err = errors.New("http: POST too large") 1297 return 1298 } 1299 vs, e = url.ParseQuery(string(b)) 1300 if err == nil { 1301 err = e 1302 } 1303 case ct == "multipart/form-data": 1304 // handled by ParseMultipartForm (which is calling us, or should be) 1305 // TODO(bradfitz): there are too many possible 1306 // orders to call too many functions here. 1307 // Clean this up and write more tests. 1308 // request_test.go contains the start of this, 1309 // in TestParseMultipartFormOrder and others. 1310 } 1311 return 1312 } 1313 1314 // ParseForm populates r.Form and r.PostForm. 1315 // 1316 // For all requests, ParseForm parses the raw query from the URL and updates 1317 // r.Form. 1318 // 1319 // For POST, PUT, and PATCH requests, it also reads the request body, parses it 1320 // as a form and puts the results into both r.PostForm and r.Form. Request body 1321 // parameters take precedence over URL query string values in r.Form. 1322 // 1323 // If the request Body's size has not already been limited by [MaxBytesReader], 1324 // the size is capped at 10MB. 1325 // 1326 // For other HTTP methods, or when the Content-Type is not 1327 // application/x-www-form-urlencoded, the request Body is not read, and 1328 // r.PostForm is initialized to a non-nil, empty value. 1329 // 1330 // [Request.ParseMultipartForm] calls ParseForm automatically. 1331 // ParseForm is idempotent. 1332 func (r *Request) ParseForm() error { 1333 var err error 1334 if r.PostForm == nil { 1335 if r.Method == "POST" || r.Method == "PUT" || r.Method == "PATCH" { 1336 r.PostForm, err = parsePostForm(r) 1337 } 1338 if r.PostForm == nil { 1339 r.PostForm = make(url.Values) 1340 } 1341 } 1342 if r.Form == nil { 1343 if len(r.PostForm) > 0 { 1344 r.Form = make(url.Values) 1345 copyValues(r.Form, r.PostForm) 1346 } 1347 var newValues url.Values 1348 if r.URL != nil { 1349 var e error 1350 newValues, e = url.ParseQuery(r.URL.RawQuery) 1351 if err == nil { 1352 err = e 1353 } 1354 } 1355 if newValues == nil { 1356 newValues = make(url.Values) 1357 } 1358 if r.Form == nil { 1359 r.Form = newValues 1360 } else { 1361 copyValues(r.Form, newValues) 1362 } 1363 } 1364 return err 1365 } 1366 1367 // ParseMultipartForm parses a request body as multipart/form-data. 1368 // The whole request body is parsed and up to a total of maxMemory bytes of 1369 // its file parts are stored in memory, with the remainder stored on 1370 // disk in temporary files. 1371 // ParseMultipartForm calls [Request.ParseForm] if necessary. 1372 // If ParseForm returns an error, ParseMultipartForm returns it but also 1373 // continues parsing the request body. 1374 // After one call to ParseMultipartForm, subsequent calls have no effect. 1375 func (r *Request) ParseMultipartForm(maxMemory int64) error { 1376 if r.MultipartForm == multipartByReader { 1377 return errors.New("http: multipart handled by MultipartReader") 1378 } 1379 var parseFormErr error 1380 if r.Form == nil { 1381 // Let errors in ParseForm fall through, and just 1382 // return it at the end. 1383 parseFormErr = r.ParseForm() 1384 } 1385 if r.MultipartForm != nil { 1386 return nil 1387 } 1388 1389 mr, err := r.multipartReader(false) 1390 if err != nil { 1391 return err 1392 } 1393 1394 f, err := mr.ReadForm(maxMemory) 1395 if err != nil { 1396 return err 1397 } 1398 1399 if r.PostForm == nil { 1400 r.PostForm = make(url.Values) 1401 } 1402 for k, v := range f.Value { 1403 r.Form[k] = append(r.Form[k], v...) 1404 // r.PostForm should also be populated. See Issue 9305. 1405 r.PostForm[k] = append(r.PostForm[k], v...) 1406 } 1407 1408 r.MultipartForm = f 1409 1410 return parseFormErr 1411 } 1412 1413 // FormValue returns the first value for the named component of the query. 1414 // The precedence order: 1415 // 1. application/x-www-form-urlencoded form body (POST, PUT, PATCH only) 1416 // 2. query parameters (always) 1417 // 3. multipart/form-data form body (always) 1418 // 1419 // FormValue calls [Request.ParseMultipartForm] and [Request.ParseForm] 1420 // if necessary and ignores any errors returned by these functions. 1421 // If key is not present, FormValue returns the empty string. 1422 // To access multiple values of the same key, call ParseForm and 1423 // then inspect [Request.Form] directly. 1424 func (r *Request) FormValue(key string) string { 1425 if r.Form == nil { 1426 r.ParseMultipartForm(defaultMaxMemory) 1427 } 1428 if vs := r.Form[key]; len(vs) > 0 { 1429 return vs[0] 1430 } 1431 return "" 1432 } 1433 1434 // PostFormValue returns the first value for the named component of the POST, 1435 // PUT, or PATCH request body. URL query parameters are ignored. 1436 // PostFormValue calls [Request.ParseMultipartForm] and [Request.ParseForm] if necessary and ignores 1437 // any errors returned by these functions. 1438 // If key is not present, PostFormValue returns the empty string. 1439 func (r *Request) PostFormValue(key string) string { 1440 if r.PostForm == nil { 1441 r.ParseMultipartForm(defaultMaxMemory) 1442 } 1443 if vs := r.PostForm[key]; len(vs) > 0 { 1444 return vs[0] 1445 } 1446 return "" 1447 } 1448 1449 // FormFile returns the first file for the provided form key. 1450 // FormFile calls [Request.ParseMultipartForm] and [Request.ParseForm] if necessary. 1451 func (r *Request) FormFile(key string) (multipart.File, *multipart.FileHeader, error) { 1452 if r.MultipartForm == multipartByReader { 1453 return nil, nil, errors.New("http: multipart handled by MultipartReader") 1454 } 1455 if r.MultipartForm == nil { 1456 err := r.ParseMultipartForm(defaultMaxMemory) 1457 if err != nil { 1458 return nil, nil, err 1459 } 1460 } 1461 if r.MultipartForm != nil && r.MultipartForm.File != nil { 1462 if fhs := r.MultipartForm.File[key]; len(fhs) > 0 { 1463 f, err := fhs[0].Open() 1464 return f, fhs[0], err 1465 } 1466 } 1467 return nil, nil, ErrMissingFile 1468 } 1469 1470 // PathValue returns the value for the named path wildcard in the [ServeMux] pattern 1471 // that matched the request. 1472 // It returns the empty string if the request was not matched against a pattern 1473 // or there is no such wildcard in the pattern. 1474 func (r *Request) PathValue(name string) string { 1475 if i := r.patIndex(name); i >= 0 { 1476 return r.matches[i] 1477 } 1478 return r.otherValues[name] 1479 } 1480 1481 // SetPathValue sets name to value, so that subsequent calls to r.PathValue(name) 1482 // return value. 1483 func (r *Request) SetPathValue(name, value string) { 1484 if i := r.patIndex(name); i >= 0 { 1485 r.matches[i] = value 1486 } else { 1487 if r.otherValues == nil { 1488 r.otherValues = map[string]string{} 1489 } 1490 r.otherValues[name] = value 1491 } 1492 } 1493 1494 // patIndex returns the index of name in the list of named wildcards of the 1495 // request's pattern, or -1 if there is no such name. 1496 func (r *Request) patIndex(name string) int { 1497 // The linear search seems expensive compared to a map, but just creating the map 1498 // takes a lot of time, and most patterns will just have a couple of wildcards. 1499 if r.pat == nil { 1500 return -1 1501 } 1502 i := 0 1503 for _, seg := range r.pat.segments { 1504 if seg.wild && seg.s != "" { 1505 if name == seg.s { 1506 return i 1507 } 1508 i++ 1509 } 1510 } 1511 return -1 1512 } 1513 1514 func (r *Request) expectsContinue() bool { 1515 return hasToken(r.Header.get("Expect"), "100-continue") 1516 } 1517 1518 func (r *Request) wantsHttp10KeepAlive() bool { 1519 if r.ProtoMajor != 1 || r.ProtoMinor != 0 { 1520 return false 1521 } 1522 return hasToken(r.Header.get("Connection"), "keep-alive") 1523 } 1524 1525 func (r *Request) wantsClose() bool { 1526 if r.Close { 1527 return true 1528 } 1529 return hasToken(r.Header.get("Connection"), "close") 1530 } 1531 1532 func (r *Request) closeBody() error { 1533 if r.Body == nil { 1534 return nil 1535 } 1536 return r.Body.Close() 1537 } 1538 1539 func (r *Request) isReplayable() bool { 1540 if r.Body == nil || r.Body == NoBody || r.GetBody != nil { 1541 switch valueOrDefault(r.Method, "GET") { 1542 case "GET", "HEAD", "OPTIONS", "TRACE": 1543 return true 1544 } 1545 // The Idempotency-Key, while non-standard, is widely used to 1546 // mean a POST or other request is idempotent. See 1547 // https://golang.org/issue/19943#issuecomment-421092421 1548 if r.Header.has("Idempotency-Key") || r.Header.has("X-Idempotency-Key") { 1549 return true 1550 } 1551 } 1552 return false 1553 } 1554 1555 // outgoingLength reports the Content-Length of this outgoing (Client) request. 1556 // It maps 0 into -1 (unknown) when the Body is non-nil. 1557 func (r *Request) outgoingLength() int64 { 1558 if r.Body == nil || r.Body == NoBody { 1559 return 0 1560 } 1561 if r.ContentLength != 0 { 1562 return r.ContentLength 1563 } 1564 return -1 1565 } 1566 1567 // requestMethodUsuallyLacksBody reports whether the given request 1568 // method is one that typically does not involve a request body. 1569 // This is used by the Transport (via 1570 // transferWriter.shouldSendChunkedRequestBody) to determine whether 1571 // we try to test-read a byte from a non-nil Request.Body when 1572 // Request.outgoingLength() returns -1. See the comments in 1573 // shouldSendChunkedRequestBody. 1574 func requestMethodUsuallyLacksBody(method string) bool { 1575 switch method { 1576 case "GET", "HEAD", "DELETE", "OPTIONS", "PROPFIND", "SEARCH": 1577 return true 1578 } 1579 return false 1580 } 1581 1582 // requiresHTTP1 reports whether this request requires being sent on 1583 // an HTTP/1 connection. 1584 func (r *Request) requiresHTTP1() bool { 1585 return hasToken(r.Header.Get("Connection"), "upgrade") && 1586 ascii.EqualFold(r.Header.Get("Upgrade"), "websocket") 1587 } 1588