1 // Copyright 2009 The Go Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style 3 // license that can be found in the LICENSE file. 4 5 // HTTP Request reading and parsing. 6 7 package http 8 9 import ( 10 "bufio" 11 "bytes" 12 "context" 13 "crypto/tls" 14 "encoding/base64" 15 "errors" 16 "fmt" 17 "io" 18 "mime" 19 "mime/multipart" 20 "net" 21 "net/http/httptrace" 22 "net/http/internal/ascii" 23 "net/textproto" 24 "net/url" 25 urlpkg "net/url" 26 "strconv" 27 "strings" 28 "sync" 29 30 "golang.org/x/net/idna" 31 ) 32 33 const ( 34 defaultMaxMemory = 32 << 20 // 32 MB 35 ) 36 37 // ErrMissingFile is returned by FormFile when the provided file field name 38 // is either not present in the request or not a file field. 39 var ErrMissingFile = errors.New("http: no such file") 40 41 // ProtocolError represents an HTTP protocol error. 42 // 43 // Deprecated: Not all errors in the http package related to protocol errors 44 // are of type ProtocolError. 45 type ProtocolError struct { 46 ErrorString string 47 } 48 49 func (pe *ProtocolError) Error() string { return pe.ErrorString } 50 51 var ( 52 // ErrNotSupported is returned by the Push method of Pusher 53 // implementations to indicate that HTTP/2 Push support is not 54 // available. 55 ErrNotSupported = &ProtocolError{"feature not supported"} 56 57 // Deprecated: ErrUnexpectedTrailer is no longer returned by 58 // anything in the net/http package. Callers should not 59 // compare errors against this variable. 60 ErrUnexpectedTrailer = &ProtocolError{"trailer header without chunked transfer encoding"} 61 62 // ErrMissingBoundary is returned by Request.MultipartReader when the 63 // request's Content-Type does not include a "boundary" parameter. 64 ErrMissingBoundary = &ProtocolError{"no multipart boundary param in Content-Type"} 65 66 // ErrNotMultipart is returned by Request.MultipartReader when the 67 // request's Content-Type is not multipart/form-data. 68 ErrNotMultipart = &ProtocolError{"request Content-Type isn't multipart/form-data"} 69 70 // Deprecated: ErrHeaderTooLong is no longer returned by 71 // anything in the net/http package. Callers should not 72 // compare errors against this variable. 73 ErrHeaderTooLong = &ProtocolError{"header too long"} 74 75 // Deprecated: ErrShortBody is no longer returned by 76 // anything in the net/http package. Callers should not 77 // compare errors against this variable. 78 ErrShortBody = &ProtocolError{"entity body too short"} 79 80 // Deprecated: ErrMissingContentLength is no longer returned by 81 // anything in the net/http package. Callers should not 82 // compare errors against this variable. 83 ErrMissingContentLength = &ProtocolError{"missing ContentLength in HEAD response"} 84 ) 85 86 func badStringError(what, val string) error { return fmt.Errorf("%s %q", what, val) } 87 88 // Headers that Request.Write handles itself and should be skipped. 89 var reqWriteExcludeHeader = map[string]bool{ 90 "Host": true, // not in Header map anyway 91 "User-Agent": true, 92 "Content-Length": true, 93 "Transfer-Encoding": true, 94 "Trailer": true, 95 } 96 97 // A Request represents an HTTP request received by a server 98 // or to be sent by a client. 99 // 100 // The field semantics differ slightly between client and server 101 // usage. In addition to the notes on the fields below, see the 102 // documentation for Request.Write and RoundTripper. 103 type Request struct { 104 // Method specifies the HTTP method (GET, POST, PUT, etc.). 105 // For client requests, an empty string means GET. 106 // 107 // Go's HTTP client does not support sending a request with 108 // the CONNECT method. See the documentation on Transport for 109 // details. 110 Method string 111 112 // URL specifies either the URI being requested (for server 113 // requests) or the URL to access (for client requests). 114 // 115 // For server requests, the URL is parsed from the URI 116 // supplied on the Request-Line as stored in RequestURI. For 117 // most requests, fields other than Path and RawQuery will be 118 // empty. (See RFC 7230, Section 5.3) 119 // 120 // For client requests, the URL's Host specifies the server to 121 // connect to, while the Request's Host field optionally 122 // specifies the Host header value to send in the HTTP 123 // request. 124 URL *url.URL 125 126 // The protocol version for incoming server requests. 127 // 128 // For client requests, these fields are ignored. The HTTP 129 // client code always uses either HTTP/1.1 or HTTP/2. 130 // See the docs on Transport for details. 131 Proto string // "HTTP/1.0" 132 ProtoMajor int // 1 133 ProtoMinor int // 0 134 135 // Header contains the request header fields either received 136 // by the server or to be sent by the client. 137 // 138 // If a server received a request with header lines, 139 // 140 // Host: example.com 141 // accept-encoding: gzip, deflate 142 // Accept-Language: en-us 143 // fOO: Bar 144 // foo: two 145 // 146 // then 147 // 148 // Header = map[string][]string{ 149 // "Accept-Encoding": {"gzip, deflate"}, 150 // "Accept-Language": {"en-us"}, 151 // "Foo": {"Bar", "two"}, 152 // } 153 // 154 // For incoming requests, the Host header is promoted to the 155 // Request.Host field and removed from the Header map. 156 // 157 // HTTP defines that header names are case-insensitive. The 158 // request parser implements this by using CanonicalHeaderKey, 159 // making the first character and any characters following a 160 // hyphen uppercase and the rest lowercase. 161 // 162 // For client requests, certain headers such as Content-Length 163 // and Connection are automatically written when needed and 164 // values in Header may be ignored. See the documentation 165 // for the Request.Write method. 166 Header Header 167 168 // Body is the request's body. 169 // 170 // For client requests, a nil body means the request has no 171 // body, such as a GET request. The HTTP Client's Transport 172 // is responsible for calling the Close method. 173 // 174 // For server requests, the Request Body is always non-nil 175 // but will return EOF immediately when no body is present. 176 // The Server will close the request body. The ServeHTTP 177 // Handler does not need to. 178 // 179 // Body must allow Read to be called concurrently with Close. 180 // In particular, calling Close should unblock a Read waiting 181 // for input. 182 Body io.ReadCloser 183 184 // GetBody defines an optional func to return a new copy of 185 // Body. It is used for client requests when a redirect requires 186 // reading the body more than once. Use of GetBody still 187 // requires setting Body. 188 // 189 // For server requests, it is unused. 190 GetBody func() (io.ReadCloser, error) 191 192 // ContentLength records the length of the associated content. 193 // The value -1 indicates that the length is unknown. 194 // Values >= 0 indicate that the given number of bytes may 195 // be read from Body. 196 // 197 // For client requests, a value of 0 with a non-nil Body is 198 // also treated as unknown. 199 ContentLength int64 200 201 // TransferEncoding lists the transfer encodings from outermost to 202 // innermost. An empty list denotes the "identity" encoding. 203 // TransferEncoding can usually be ignored; chunked encoding is 204 // automatically added and removed as necessary when sending and 205 // receiving requests. 206 TransferEncoding []string 207 208 // Close indicates whether to close the connection after 209 // replying to this request (for servers) or after sending this 210 // request and reading its response (for clients). 211 // 212 // For server requests, the HTTP server handles this automatically 213 // and this field is not needed by Handlers. 214 // 215 // For client requests, setting this field prevents re-use of 216 // TCP connections between requests to the same hosts, as if 217 // Transport.DisableKeepAlives were set. 218 Close bool 219 220 // For server requests, Host specifies the host on which the 221 // URL is sought. For HTTP/1 (per RFC 7230, section 5.4), this 222 // is either the value of the "Host" header or the host name 223 // given in the URL itself. For HTTP/2, it is the value of the 224 // ":authority" pseudo-header field. 225 // It may be of the form "host:port". For international domain 226 // names, Host may be in Punycode or Unicode form. Use 227 // golang.org/x/net/idna to convert it to either format if 228 // needed. 229 // To prevent DNS rebinding attacks, server Handlers should 230 // validate that the Host header has a value for which the 231 // Handler considers itself authoritative. The included 232 // ServeMux supports patterns registered to particular host 233 // names and thus protects its registered Handlers. 234 // 235 // For client requests, Host optionally overrides the Host 236 // header to send. If empty, the Request.Write method uses 237 // the value of URL.Host. Host may contain an international 238 // domain name. 239 Host string 240 241 // Form contains the parsed form data, including both the URL 242 // field's query parameters and the PATCH, POST, or PUT form data. 243 // This field is only available after ParseForm is called. 244 // The HTTP client ignores Form and uses Body instead. 245 Form url.Values 246 247 // PostForm contains the parsed form data from PATCH, POST 248 // or PUT body parameters. 249 // 250 // This field is only available after ParseForm is called. 251 // The HTTP client ignores PostForm and uses Body instead. 252 PostForm url.Values 253 254 // MultipartForm is the parsed multipart form, including file uploads. 255 // This field is only available after ParseMultipartForm is called. 256 // The HTTP client ignores MultipartForm and uses Body instead. 257 MultipartForm *multipart.Form 258 259 // Trailer specifies additional headers that are sent after the request 260 // body. 261 // 262 // For server requests, the Trailer map initially contains only the 263 // trailer keys, with nil values. (The client declares which trailers it 264 // will later send.) While the handler is reading from Body, it must 265 // not reference Trailer. After reading from Body returns EOF, Trailer 266 // can be read again and will contain non-nil values, if they were sent 267 // by the client. 268 // 269 // For client requests, Trailer must be initialized to a map containing 270 // the trailer keys to later send. The values may be nil or their final 271 // values. The ContentLength must be 0 or -1, to send a chunked request. 272 // After the HTTP request is sent the map values can be updated while 273 // the request body is read. Once the body returns EOF, the caller must 274 // not mutate Trailer. 275 // 276 // Few HTTP clients, servers, or proxies support HTTP trailers. 277 Trailer Header 278 279 // RemoteAddr allows HTTP servers and other software to record 280 // the network address that sent the request, usually for 281 // logging. This field is not filled in by ReadRequest and 282 // has no defined format. The HTTP server in this package 283 // sets RemoteAddr to an "IP:port" address before invoking a 284 // handler. 285 // This field is ignored by the HTTP client. 286 RemoteAddr string 287 288 // RequestURI is the unmodified request-target of the 289 // Request-Line (RFC 7230, Section 3.1.1) as sent by the client 290 // to a server. Usually the URL field should be used instead. 291 // It is an error to set this field in an HTTP client request. 292 RequestURI string 293 294 // TLS allows HTTP servers and other software to record 295 // information about the TLS connection on which the request 296 // was received. This field is not filled in by ReadRequest. 297 // The HTTP server in this package sets the field for 298 // TLS-enabled connections before invoking a handler; 299 // otherwise it leaves the field nil. 300 // This field is ignored by the HTTP client. 301 TLS *tls.ConnectionState 302 303 // Cancel is an optional channel whose closure indicates that the client 304 // request should be regarded as canceled. Not all implementations of 305 // RoundTripper may support Cancel. 306 // 307 // For server requests, this field is not applicable. 308 // 309 // Deprecated: Set the Request's context with NewRequestWithContext 310 // instead. If a Request's Cancel field and context are both 311 // set, it is undefined whether Cancel is respected. 312 Cancel <-chan struct{} 313 314 // Response is the redirect response which caused this request 315 // to be created. This field is only populated during client 316 // redirects. 317 Response *Response 318 319 // ctx is either the client or server context. It should only 320 // be modified via copying the whole Request using WithContext. 321 // It is unexported to prevent people from using Context wrong 322 // and mutating the contexts held by callers of the same request. 323 ctx context.Context 324 } 325 326 // Context returns the request's context. To change the context, use 327 // WithContext. 328 // 329 // The returned context is always non-nil; it defaults to the 330 // background context. 331 // 332 // For outgoing client requests, the context controls cancellation. 333 // 334 // For incoming server requests, the context is canceled when the 335 // client's connection closes, the request is canceled (with HTTP/2), 336 // or when the ServeHTTP method returns. 337 func (r *Request) Context() context.Context { 338 if r.ctx != nil { 339 return r.ctx 340 } 341 return context.Background() 342 } 343 344 // WithContext returns a shallow copy of r with its context changed 345 // to ctx. The provided ctx must be non-nil. 346 // 347 // For outgoing client request, the context controls the entire 348 // lifetime of a request and its response: obtaining a connection, 349 // sending the request, and reading the response headers and body. 350 // 351 // To create a new request with a context, use NewRequestWithContext. 352 // To change the context of a request, such as an incoming request you 353 // want to modify before sending back out, use Request.Clone. Between 354 // those two uses, it's rare to need WithContext. 355 func (r *Request) WithContext(ctx context.Context) *Request { 356 if ctx == nil { 357 panic("nil context") 358 } 359 r2 := new(Request) 360 *r2 = *r 361 r2.ctx = ctx 362 return r2 363 } 364 365 // Clone returns a deep copy of r with its context changed to ctx. 366 // The provided ctx must be non-nil. 367 // 368 // For an outgoing client request, the context controls the entire 369 // lifetime of a request and its response: obtaining a connection, 370 // sending the request, and reading the response headers and body. 371 func (r *Request) Clone(ctx context.Context) *Request { 372 if ctx == nil { 373 panic("nil context") 374 } 375 r2 := new(Request) 376 *r2 = *r 377 r2.ctx = ctx 378 r2.URL = cloneURL(r.URL) 379 if r.Header != nil { 380 r2.Header = r.Header.Clone() 381 } 382 if r.Trailer != nil { 383 r2.Trailer = r.Trailer.Clone() 384 } 385 if s := r.TransferEncoding; s != nil { 386 s2 := make([]string, len(s)) 387 copy(s2, s) 388 r2.TransferEncoding = s2 389 } 390 r2.Form = cloneURLValues(r.Form) 391 r2.PostForm = cloneURLValues(r.PostForm) 392 r2.MultipartForm = cloneMultipartForm(r.MultipartForm) 393 return r2 394 } 395 396 // ProtoAtLeast reports whether the HTTP protocol used 397 // in the request is at least major.minor. 398 func (r *Request) ProtoAtLeast(major, minor int) bool { 399 return r.ProtoMajor > major || 400 r.ProtoMajor == major && r.ProtoMinor >= minor 401 } 402 403 // UserAgent returns the client's User-Agent, if sent in the request. 404 func (r *Request) UserAgent() string { 405 return r.Header.Get("User-Agent") 406 } 407 408 // Cookies parses and returns the HTTP cookies sent with the request. 409 func (r *Request) Cookies() []*Cookie { 410 return readCookies(r.Header, "") 411 } 412 413 // ErrNoCookie is returned by Request's Cookie method when a cookie is not found. 414 var ErrNoCookie = errors.New("http: named cookie not present") 415 416 // Cookie returns the named cookie provided in the request or 417 // ErrNoCookie if not found. 418 // If multiple cookies match the given name, only one cookie will 419 // be returned. 420 func (r *Request) Cookie(name string) (*Cookie, error) { 421 for _, c := range readCookies(r.Header, name) { 422 return c, nil 423 } 424 return nil, ErrNoCookie 425 } 426 427 // AddCookie adds a cookie to the request. Per RFC 6265 section 5.4, 428 // AddCookie does not attach more than one Cookie header field. That 429 // means all cookies, if any, are written into the same line, 430 // separated by semicolon. 431 // AddCookie only sanitizes c's name and value, and does not sanitize 432 // a Cookie header already present in the request. 433 func (r *Request) AddCookie(c *Cookie) { 434 s := fmt.Sprintf("%s=%s", sanitizeCookieName(c.Name), sanitizeCookieValue(c.Value)) 435 if c := r.Header.Get("Cookie"); c != "" { 436 r.Header.Set("Cookie", c+"; "+s) 437 } else { 438 r.Header.Set("Cookie", s) 439 } 440 } 441 442 // Referer returns the referring URL, if sent in the request. 443 // 444 // Referer is misspelled as in the request itself, a mistake from the 445 // earliest days of HTTP. This value can also be fetched from the 446 // Header map as Header["Referer"]; the benefit of making it available 447 // as a method is that the compiler can diagnose programs that use the 448 // alternate (correct English) spelling req.Referrer() but cannot 449 // diagnose programs that use Header["Referrer"]. 450 func (r *Request) Referer() string { 451 return r.Header.Get("Referer") 452 } 453 454 // multipartByReader is a sentinel value. 455 // Its presence in Request.MultipartForm indicates that parsing of the request 456 // body has been handed off to a MultipartReader instead of ParseMultipartForm. 457 var multipartByReader = &multipart.Form{ 458 Value: make(map[string][]string), 459 File: make(map[string][]*multipart.FileHeader), 460 } 461 462 // MultipartReader returns a MIME multipart reader if this is a 463 // multipart/form-data or a multipart/mixed POST request, else returns nil and an error. 464 // Use this function instead of ParseMultipartForm to 465 // process the request body as a stream. 466 func (r *Request) MultipartReader() (*multipart.Reader, error) { 467 if r.MultipartForm == multipartByReader { 468 return nil, errors.New("http: MultipartReader called twice") 469 } 470 if r.MultipartForm != nil { 471 return nil, errors.New("http: multipart handled by ParseMultipartForm") 472 } 473 r.MultipartForm = multipartByReader 474 return r.multipartReader(true) 475 } 476 477 func (r *Request) multipartReader(allowMixed bool) (*multipart.Reader, error) { 478 v := r.Header.Get("Content-Type") 479 if v == "" { 480 return nil, ErrNotMultipart 481 } 482 if r.Body == nil { 483 return nil, errors.New("missing form body") 484 } 485 d, params, err := mime.ParseMediaType(v) 486 if err != nil || !(d == "multipart/form-data" || allowMixed && d == "multipart/mixed") { 487 return nil, ErrNotMultipart 488 } 489 boundary, ok := params["boundary"] 490 if !ok { 491 return nil, ErrMissingBoundary 492 } 493 return multipart.NewReader(r.Body, boundary), nil 494 } 495 496 // isH2Upgrade reports whether r represents the http2 "client preface" 497 // magic string. 498 func (r *Request) isH2Upgrade() bool { 499 return r.Method == "PRI" && len(r.Header) == 0 && r.URL.Path == "*" && r.Proto == "HTTP/2.0" 500 } 501 502 // Return value if nonempty, def otherwise. 503 func valueOrDefault(value, def string) string { 504 if value != "" { 505 return value 506 } 507 return def 508 } 509 510 // NOTE: This is not intended to reflect the actual Go version being used. 511 // It was changed at the time of Go 1.1 release because the former User-Agent 512 // had ended up blocked by some intrusion detection systems. 513 // See https://codereview.appspot.com/7532043. 514 const defaultUserAgent = "Go-http-client/1.1" 515 516 // Write writes an HTTP/1.1 request, which is the header and body, in wire format. 517 // This method consults the following fields of the request: 518 // 519 // Host 520 // URL 521 // Method (defaults to "GET") 522 // Header 523 // ContentLength 524 // TransferEncoding 525 // Body 526 // 527 // If Body is present, Content-Length is <= 0 and TransferEncoding 528 // hasn't been set to "identity", Write adds "Transfer-Encoding: 529 // chunked" to the header. Body is closed after it is sent. 530 func (r *Request) Write(w io.Writer) error { 531 return r.write(w, false, nil, nil) 532 } 533 534 // WriteProxy is like Write but writes the request in the form 535 // expected by an HTTP proxy. In particular, WriteProxy writes the 536 // initial Request-URI line of the request with an absolute URI, per 537 // section 5.3 of RFC 7230, including the scheme and host. 538 // In either case, WriteProxy also writes a Host header, using 539 // either r.Host or r.URL.Host. 540 func (r *Request) WriteProxy(w io.Writer) error { 541 return r.write(w, true, nil, nil) 542 } 543 544 // errMissingHost is returned by Write when there is no Host or URL present in 545 // the Request. 546 var errMissingHost = errors.New("http: Request.Write on Request with no Host or URL set") 547 548 // extraHeaders may be nil 549 // waitForContinue may be nil 550 // always closes body 551 func (r *Request) write(w io.Writer, usingProxy bool, extraHeaders Header, waitForContinue func() bool) (err error) { 552 trace := httptrace.ContextClientTrace(r.Context()) 553 if trace != nil && trace.WroteRequest != nil { 554 defer func() { 555 trace.WroteRequest(httptrace.WroteRequestInfo{ 556 Err: err, 557 }) 558 }() 559 } 560 closed := false 561 defer func() { 562 if closed { 563 return 564 } 565 if closeErr := r.closeBody(); closeErr != nil && err == nil { 566 err = closeErr 567 } 568 }() 569 570 // Find the target host. Prefer the Host: header, but if that 571 // is not given, use the host from the request URL. 572 // 573 // Clean the host, in case it arrives with unexpected stuff in it. 574 host := cleanHost(r.Host) 575 if host == "" { 576 if r.URL == nil { 577 return errMissingHost 578 } 579 host = cleanHost(r.URL.Host) 580 } 581 582 // According to RFC 6874, an HTTP client, proxy, or other 583 // intermediary must remove any IPv6 zone identifier attached 584 // to an outgoing URI. 585 host = removeZone(host) 586 587 ruri := r.URL.RequestURI() 588 if usingProxy && r.URL.Scheme != "" && r.URL.Opaque == "" { 589 ruri = r.URL.Scheme + "://" + host + ruri 590 } else if r.Method == "CONNECT" && r.URL.Path == "" { 591 // CONNECT requests normally give just the host and port, not a full URL. 592 ruri = host 593 if r.URL.Opaque != "" { 594 ruri = r.URL.Opaque 595 } 596 } 597 if stringContainsCTLByte(ruri) { 598 return errors.New("net/http: can't write control character in Request.URL") 599 } 600 // TODO: validate r.Method too? At least it's less likely to 601 // come from an attacker (more likely to be a constant in 602 // code). 603 604 // Wrap the writer in a bufio Writer if it's not already buffered. 605 // Don't always call NewWriter, as that forces a bytes.Buffer 606 // and other small bufio Writers to have a minimum 4k buffer 607 // size. 608 var bw *bufio.Writer 609 if _, ok := w.(io.ByteWriter); !ok { 610 bw = bufio.NewWriter(w) 611 w = bw 612 } 613 614 _, err = fmt.Fprintf(w, "%s %s HTTP/1.1\r\n", valueOrDefault(r.Method, "GET"), ruri) 615 if err != nil { 616 return err 617 } 618 619 // Header lines 620 _, err = fmt.Fprintf(w, "Host: %s\r\n", host) 621 if err != nil { 622 return err 623 } 624 if trace != nil && trace.WroteHeaderField != nil { 625 trace.WroteHeaderField("Host", []string{host}) 626 } 627 628 // Use the defaultUserAgent unless the Header contains one, which 629 // may be blank to not send the header. 630 userAgent := defaultUserAgent 631 if r.Header.has("User-Agent") { 632 userAgent = r.Header.Get("User-Agent") 633 } 634 if userAgent != "" { 635 _, err = fmt.Fprintf(w, "User-Agent: %s\r\n", userAgent) 636 if err != nil { 637 return err 638 } 639 if trace != nil && trace.WroteHeaderField != nil { 640 trace.WroteHeaderField("User-Agent", []string{userAgent}) 641 } 642 } 643 644 // Process Body,ContentLength,Close,Trailer 645 tw, err := newTransferWriter(r) 646 if err != nil { 647 return err 648 } 649 err = tw.writeHeader(w, trace) 650 if err != nil { 651 return err 652 } 653 654 err = r.Header.writeSubset(w, reqWriteExcludeHeader, trace) 655 if err != nil { 656 return err 657 } 658 659 if extraHeaders != nil { 660 err = extraHeaders.write(w, trace) 661 if err != nil { 662 return err 663 } 664 } 665 666 _, err = io.WriteString(w, "\r\n") 667 if err != nil { 668 return err 669 } 670 671 if trace != nil && trace.WroteHeaders != nil { 672 trace.WroteHeaders() 673 } 674 675 // Flush and wait for 100-continue if expected. 676 if waitForContinue != nil { 677 if bw, ok := w.(*bufio.Writer); ok { 678 err = bw.Flush() 679 if err != nil { 680 return err 681 } 682 } 683 if trace != nil && trace.Wait100Continue != nil { 684 trace.Wait100Continue() 685 } 686 if !waitForContinue() { 687 closed = true 688 r.closeBody() 689 return nil 690 } 691 } 692 693 if bw, ok := w.(*bufio.Writer); ok && tw.FlushHeaders { 694 if err := bw.Flush(); err != nil { 695 return err 696 } 697 } 698 699 // Write body and trailer 700 closed = true 701 err = tw.writeBody(w) 702 if err != nil { 703 if tw.bodyReadError == err { 704 err = requestBodyReadError{err} 705 } 706 return err 707 } 708 709 if bw != nil { 710 return bw.Flush() 711 } 712 return nil 713 } 714 715 // requestBodyReadError wraps an error from (*Request).write to indicate 716 // that the error came from a Read call on the Request.Body. 717 // This error type should not escape the net/http package to users. 718 type requestBodyReadError struct{ error } 719 720 func idnaASCII(v string) (string, error) { 721 // TODO: Consider removing this check after verifying performance is okay. 722 // Right now punycode verification, length checks, context checks, and the 723 // permissible character tests are all omitted. It also prevents the ToASCII 724 // call from salvaging an invalid IDN, when possible. As a result it may be 725 // possible to have two IDNs that appear identical to the user where the 726 // ASCII-only version causes an error downstream whereas the non-ASCII 727 // version does not. 728 // Note that for correct ASCII IDNs ToASCII will only do considerably more 729 // work, but it will not cause an allocation. 730 if ascii.Is(v) { 731 return v, nil 732 } 733 return idna.Lookup.ToASCII(v) 734 } 735 736 // cleanHost cleans up the host sent in request's Host header. 737 // 738 // It both strips anything after '/' or ' ', and puts the value 739 // into Punycode form, if necessary. 740 // 741 // Ideally we'd clean the Host header according to the spec: 742 // 743 // https://tools.ietf.org/html/rfc7230#section-5.4 (Host = uri-host [ ":" port ]") 744 // https://tools.ietf.org/html/rfc7230#section-2.7 (uri-host -> rfc3986's host) 745 // https://tools.ietf.org/html/rfc3986#section-3.2.2 (definition of host) 746 // 747 // But practically, what we are trying to avoid is the situation in 748 // issue 11206, where a malformed Host header used in the proxy context 749 // would create a bad request. So it is enough to just truncate at the 750 // first offending character. 751 func cleanHost(in string) string { 752 if i := strings.IndexAny(in, " /"); i != -1 { 753 in = in[:i] 754 } 755 host, port, err := net.SplitHostPort(in) 756 if err != nil { // input was just a host 757 a, err := idnaASCII(in) 758 if err != nil { 759 return in // garbage in, garbage out 760 } 761 return a 762 } 763 a, err := idnaASCII(host) 764 if err != nil { 765 return in // garbage in, garbage out 766 } 767 return net.JoinHostPort(a, port) 768 } 769 770 // removeZone removes IPv6 zone identifier from host. 771 // E.g., "[fe80::1%en0]:8080" to "[fe80::1]:8080" 772 func removeZone(host string) string { 773 if !strings.HasPrefix(host, "[") { 774 return host 775 } 776 i := strings.LastIndex(host, "]") 777 if i < 0 { 778 return host 779 } 780 j := strings.LastIndex(host[:i], "%") 781 if j < 0 { 782 return host 783 } 784 return host[:j] + host[i:] 785 } 786 787 // ParseHTTPVersion parses an HTTP version string according to RFC 7230, section 2.6. 788 // "HTTP/1.0" returns (1, 0, true). Note that strings without 789 // a minor version, such as "HTTP/2", are not valid. 790 func ParseHTTPVersion(vers string) (major, minor int, ok bool) { 791 switch vers { 792 case "HTTP/1.1": 793 return 1, 1, true 794 case "HTTP/1.0": 795 return 1, 0, true 796 } 797 if !strings.HasPrefix(vers, "HTTP/") { 798 return 0, 0, false 799 } 800 if len(vers) != len("HTTP/X.Y") { 801 return 0, 0, false 802 } 803 if vers[6] != '.' { 804 return 0, 0, false 805 } 806 maj, err := strconv.ParseUint(vers[5:6], 10, 0) 807 if err != nil { 808 return 0, 0, false 809 } 810 min, err := strconv.ParseUint(vers[7:8], 10, 0) 811 if err != nil { 812 return 0, 0, false 813 } 814 return int(maj), int(min), true 815 } 816 817 func validMethod(method string) bool { 818 /* 819 Method = "OPTIONS" ; Section 9.2 820 | "GET" ; Section 9.3 821 | "HEAD" ; Section 9.4 822 | "POST" ; Section 9.5 823 | "PUT" ; Section 9.6 824 | "DELETE" ; Section 9.7 825 | "TRACE" ; Section 9.8 826 | "CONNECT" ; Section 9.9 827 | extension-method 828 extension-method = token 829 token = 1*<any CHAR except CTLs or separators> 830 */ 831 return len(method) > 0 && strings.IndexFunc(method, isNotToken) == -1 832 } 833 834 // NewRequest wraps NewRequestWithContext using context.Background. 835 func NewRequest(method, url string, body io.Reader) (*Request, error) { 836 return NewRequestWithContext(context.Background(), method, url, body) 837 } 838 839 // NewRequestWithContext returns a new Request given a method, URL, and 840 // optional body. 841 // 842 // If the provided body is also an io.Closer, the returned 843 // Request.Body is set to body and will be closed by the Client 844 // methods Do, Post, and PostForm, and Transport.RoundTrip. 845 // 846 // NewRequestWithContext returns a Request suitable for use with 847 // Client.Do or Transport.RoundTrip. To create a request for use with 848 // testing a Server Handler, either use the NewRequest function in the 849 // net/http/httptest package, use ReadRequest, or manually update the 850 // Request fields. For an outgoing client request, the context 851 // controls the entire lifetime of a request and its response: 852 // obtaining a connection, sending the request, and reading the 853 // response headers and body. See the Request type's documentation for 854 // the difference between inbound and outbound request fields. 855 // 856 // If body is of type *bytes.Buffer, *bytes.Reader, or 857 // *strings.Reader, the returned request's ContentLength is set to its 858 // exact value (instead of -1), GetBody is populated (so 307 and 308 859 // redirects can replay the body), and Body is set to NoBody if the 860 // ContentLength is 0. 861 func NewRequestWithContext(ctx context.Context, method, url string, body io.Reader) (*Request, error) { 862 if method == "" { 863 // We document that "" means "GET" for Request.Method, and people have 864 // relied on that from NewRequest, so keep that working. 865 // We still enforce validMethod for non-empty methods. 866 method = "GET" 867 } 868 if !validMethod(method) { 869 return nil, fmt.Errorf("net/http: invalid method %q", method) 870 } 871 if ctx == nil { 872 return nil, errors.New("net/http: nil Context") 873 } 874 u, err := urlpkg.Parse(url) 875 if err != nil { 876 return nil, err 877 } 878 rc, ok := body.(io.ReadCloser) 879 if !ok && body != nil { 880 rc = io.NopCloser(body) 881 } 882 // The host's colon:port should be normalized. See Issue 14836. 883 u.Host = removeEmptyPort(u.Host) 884 req := &Request{ 885 ctx: ctx, 886 Method: method, 887 URL: u, 888 Proto: "HTTP/1.1", 889 ProtoMajor: 1, 890 ProtoMinor: 1, 891 Header: make(Header), 892 Body: rc, 893 Host: u.Host, 894 } 895 if body != nil { 896 switch v := body.(type) { 897 case *bytes.Buffer: 898 req.ContentLength = int64(v.Len()) 899 buf := v.Bytes() 900 req.GetBody = func() (io.ReadCloser, error) { 901 r := bytes.NewReader(buf) 902 return io.NopCloser(r), nil 903 } 904 case *bytes.Reader: 905 req.ContentLength = int64(v.Len()) 906 snapshot := *v 907 req.GetBody = func() (io.ReadCloser, error) { 908 r := snapshot 909 return io.NopCloser(&r), nil 910 } 911 case *strings.Reader: 912 req.ContentLength = int64(v.Len()) 913 snapshot := *v 914 req.GetBody = func() (io.ReadCloser, error) { 915 r := snapshot 916 return io.NopCloser(&r), nil 917 } 918 default: 919 // This is where we'd set it to -1 (at least 920 // if body != NoBody) to mean unknown, but 921 // that broke people during the Go 1.8 testing 922 // period. People depend on it being 0 I 923 // guess. Maybe retry later. See Issue 18117. 924 } 925 // For client requests, Request.ContentLength of 0 926 // means either actually 0, or unknown. The only way 927 // to explicitly say that the ContentLength is zero is 928 // to set the Body to nil. But turns out too much code 929 // depends on NewRequest returning a non-nil Body, 930 // so we use a well-known ReadCloser variable instead 931 // and have the http package also treat that sentinel 932 // variable to mean explicitly zero. 933 if req.GetBody != nil && req.ContentLength == 0 { 934 req.Body = NoBody 935 req.GetBody = func() (io.ReadCloser, error) { return NoBody, nil } 936 } 937 } 938 939 return req, nil 940 } 941 942 // BasicAuth returns the username and password provided in the request's 943 // Authorization header, if the request uses HTTP Basic Authentication. 944 // See RFC 2617, Section 2. 945 func (r *Request) BasicAuth() (username, password string, ok bool) { 946 auth := r.Header.Get("Authorization") 947 if auth == "" { 948 return "", "", false 949 } 950 return parseBasicAuth(auth) 951 } 952 953 // parseBasicAuth parses an HTTP Basic Authentication string. 954 // "Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==" returns ("Aladdin", "open sesame", true). 955 func parseBasicAuth(auth string) (username, password string, ok bool) { 956 const prefix = "Basic " 957 // Case insensitive prefix match. See Issue 22736. 958 if len(auth) < len(prefix) || !ascii.EqualFold(auth[:len(prefix)], prefix) { 959 return "", "", false 960 } 961 c, err := base64.StdEncoding.DecodeString(auth[len(prefix):]) 962 if err != nil { 963 return "", "", false 964 } 965 cs := string(c) 966 username, password, ok = strings.Cut(cs, ":") 967 if !ok { 968 return "", "", false 969 } 970 return username, password, true 971 } 972 973 // SetBasicAuth sets the request's Authorization header to use HTTP 974 // Basic Authentication with the provided username and password. 975 // 976 // With HTTP Basic Authentication the provided username and password 977 // are not encrypted. It should generally only be used in an HTTPS 978 // request. 979 // 980 // The username may not contain a colon. Some protocols may impose 981 // additional requirements on pre-escaping the username and 982 // password. For instance, when used with OAuth2, both arguments must 983 // be URL encoded first with url.QueryEscape. 984 func (r *Request) SetBasicAuth(username, password string) { 985 r.Header.Set("Authorization", "Basic "+basicAuth(username, password)) 986 } 987 988 // parseRequestLine parses "GET /foo HTTP/1.1" into its three parts. 989 func parseRequestLine(line string) (method, requestURI, proto string, ok bool) { 990 method, rest, ok1 := strings.Cut(line, " ") 991 requestURI, proto, ok2 := strings.Cut(rest, " ") 992 if !ok1 || !ok2 { 993 return "", "", "", false 994 } 995 return method, requestURI, proto, true 996 } 997 998 var textprotoReaderPool sync.Pool 999 1000 func newTextprotoReader(br *bufio.Reader) *textproto.Reader { 1001 if v := textprotoReaderPool.Get(); v != nil { 1002 tr := v.(*textproto.Reader) 1003 tr.R = br 1004 return tr 1005 } 1006 return textproto.NewReader(br) 1007 } 1008 1009 func putTextprotoReader(r *textproto.Reader) { 1010 r.R = nil 1011 textprotoReaderPool.Put(r) 1012 } 1013 1014 // ReadRequest reads and parses an incoming request from b. 1015 // 1016 // ReadRequest is a low-level function and should only be used for 1017 // specialized applications; most code should use the Server to read 1018 // requests and handle them via the Handler interface. ReadRequest 1019 // only supports HTTP/1.x requests. For HTTP/2, use golang.org/x/net/http2. 1020 func ReadRequest(b *bufio.Reader) (*Request, error) { 1021 req, err := readRequest(b) 1022 if err != nil { 1023 return nil, err 1024 } 1025 1026 delete(req.Header, "Host") 1027 return req, err 1028 } 1029 1030 func readRequest(b *bufio.Reader) (req *Request, err error) { 1031 tp := newTextprotoReader(b) 1032 req = new(Request) 1033 1034 // First line: GET /index.html HTTP/1.0 1035 var s string 1036 if s, err = tp.ReadLine(); err != nil { 1037 return nil, err 1038 } 1039 defer func() { 1040 putTextprotoReader(tp) 1041 if err == io.EOF { 1042 err = io.ErrUnexpectedEOF 1043 } 1044 }() 1045 1046 var ok bool 1047 req.Method, req.RequestURI, req.Proto, ok = parseRequestLine(s) 1048 if !ok { 1049 return nil, badStringError("malformed HTTP request", s) 1050 } 1051 if !validMethod(req.Method) { 1052 return nil, badStringError("invalid method", req.Method) 1053 } 1054 rawurl := req.RequestURI 1055 if req.ProtoMajor, req.ProtoMinor, ok = ParseHTTPVersion(req.Proto); !ok { 1056 return nil, badStringError("malformed HTTP version", req.Proto) 1057 } 1058 1059 // CONNECT requests are used two different ways, and neither uses a full URL: 1060 // The standard use is to tunnel HTTPS through an HTTP proxy. 1061 // It looks like "CONNECT www.google.com:443 HTTP/1.1", and the parameter is 1062 // just the authority section of a URL. This information should go in req.URL.Host. 1063 // 1064 // The net/rpc package also uses CONNECT, but there the parameter is a path 1065 // that starts with a slash. It can be parsed with the regular URL parser, 1066 // and the path will end up in req.URL.Path, where it needs to be in order for 1067 // RPC to work. 1068 justAuthority := req.Method == "CONNECT" && !strings.HasPrefix(rawurl, "/") 1069 if justAuthority { 1070 rawurl = "http://" + rawurl 1071 } 1072 1073 if req.URL, err = url.ParseRequestURI(rawurl); err != nil { 1074 return nil, err 1075 } 1076 1077 if justAuthority { 1078 // Strip the bogus "http://" back off. 1079 req.URL.Scheme = "" 1080 } 1081 1082 // Subsequent lines: Key: value. 1083 mimeHeader, err := tp.ReadMIMEHeader() 1084 if err != nil { 1085 return nil, err 1086 } 1087 req.Header = Header(mimeHeader) 1088 if len(req.Header["Host"]) > 1 { 1089 return nil, fmt.Errorf("too many Host headers") 1090 } 1091 1092 // RFC 7230, section 5.3: Must treat 1093 // GET /index.html HTTP/1.1 1094 // Host: www.google.com 1095 // and 1096 // GET http://www.google.com/index.html HTTP/1.1 1097 // Host: doesntmatter 1098 // the same. In the second case, any Host line is ignored. 1099 req.Host = req.URL.Host 1100 if req.Host == "" { 1101 req.Host = req.Header.get("Host") 1102 } 1103 1104 fixPragmaCacheControl(req.Header) 1105 1106 req.Close = shouldClose(req.ProtoMajor, req.ProtoMinor, req.Header, false) 1107 1108 err = readTransfer(req, b) 1109 if err != nil { 1110 return nil, err 1111 } 1112 1113 if req.isH2Upgrade() { 1114 // Because it's neither chunked, nor declared: 1115 req.ContentLength = -1 1116 1117 // We want to give handlers a chance to hijack the 1118 // connection, but we need to prevent the Server from 1119 // dealing with the connection further if it's not 1120 // hijacked. Set Close to ensure that: 1121 req.Close = true 1122 } 1123 return req, nil 1124 } 1125 1126 // MaxBytesReader is similar to io.LimitReader but is intended for 1127 // limiting the size of incoming request bodies. In contrast to 1128 // io.LimitReader, MaxBytesReader's result is a ReadCloser, returns a 1129 // non-nil error of type *MaxBytesError for a Read beyond the limit, 1130 // and closes the underlying reader when its Close method is called. 1131 // 1132 // MaxBytesReader prevents clients from accidentally or maliciously 1133 // sending a large request and wasting server resources. If possible, 1134 // it tells the ResponseWriter to close the connection after the limit 1135 // has been reached. 1136 func MaxBytesReader(w ResponseWriter, r io.ReadCloser, n int64) io.ReadCloser { 1137 if n < 0 { // Treat negative limits as equivalent to 0. 1138 n = 0 1139 } 1140 return &maxBytesReader{w: w, r: r, i: n, n: n} 1141 } 1142 1143 // MaxBytesError is returned by MaxBytesReader when its read limit is exceeded. 1144 type MaxBytesError struct { 1145 Limit int64 1146 } 1147 1148 func (e *MaxBytesError) Error() string { 1149 // Due to Hyrum's law, this text cannot be changed. 1150 return "http: request body too large" 1151 } 1152 1153 type maxBytesReader struct { 1154 w ResponseWriter 1155 r io.ReadCloser // underlying reader 1156 i int64 // max bytes initially, for MaxBytesError 1157 n int64 // max bytes remaining 1158 err error // sticky error 1159 } 1160 1161 func (l *maxBytesReader) Read(p []byte) (n int, err error) { 1162 if l.err != nil { 1163 return 0, l.err 1164 } 1165 if len(p) == 0 { 1166 return 0, nil 1167 } 1168 // If they asked for a 32KB byte read but only 5 bytes are 1169 // remaining, no need to read 32KB. 6 bytes will answer the 1170 // question of the whether we hit the limit or go past it. 1171 if int64(len(p)) > l.n+1 { 1172 p = p[:l.n+1] 1173 } 1174 n, err = l.r.Read(p) 1175 1176 if int64(n) <= l.n { 1177 l.n -= int64(n) 1178 l.err = err 1179 return n, err 1180 } 1181 1182 n = int(l.n) 1183 l.n = 0 1184 1185 // The server code and client code both use 1186 // maxBytesReader. This "requestTooLarge" check is 1187 // only used by the server code. To prevent binaries 1188 // which only using the HTTP Client code (such as 1189 // cmd/go) from also linking in the HTTP server, don't 1190 // use a static type assertion to the server 1191 // "*response" type. Check this interface instead: 1192 type requestTooLarger interface { 1193 requestTooLarge() 1194 } 1195 if res, ok := l.w.(requestTooLarger); ok { 1196 res.requestTooLarge() 1197 } 1198 l.err = &MaxBytesError{l.i} 1199 return n, l.err 1200 } 1201 1202 func (l *maxBytesReader) Close() error { 1203 return l.r.Close() 1204 } 1205 1206 func copyValues(dst, src url.Values) { 1207 for k, vs := range src { 1208 dst[k] = append(dst[k], vs...) 1209 } 1210 } 1211 1212 func parsePostForm(r *Request) (vs url.Values, err error) { 1213 if r.Body == nil { 1214 err = errors.New("missing form body") 1215 return 1216 } 1217 ct := r.Header.Get("Content-Type") 1218 // RFC 7231, section 3.1.1.5 - empty type 1219 // MAY be treated as application/octet-stream 1220 if ct == "" { 1221 ct = "application/octet-stream" 1222 } 1223 ct, _, err = mime.ParseMediaType(ct) 1224 switch { 1225 case ct == "application/x-www-form-urlencoded": 1226 var reader io.Reader = r.Body 1227 maxFormSize := int64(1<<63 - 1) 1228 if _, ok := r.Body.(*maxBytesReader); !ok { 1229 maxFormSize = int64(10 << 20) // 10 MB is a lot of text. 1230 reader = io.LimitReader(r.Body, maxFormSize+1) 1231 } 1232 b, e := io.ReadAll(reader) 1233 if e != nil { 1234 if err == nil { 1235 err = e 1236 } 1237 break 1238 } 1239 if int64(len(b)) > maxFormSize { 1240 err = errors.New("http: POST too large") 1241 return 1242 } 1243 vs, e = url.ParseQuery(string(b)) 1244 if err == nil { 1245 err = e 1246 } 1247 case ct == "multipart/form-data": 1248 // handled by ParseMultipartForm (which is calling us, or should be) 1249 // TODO(bradfitz): there are too many possible 1250 // orders to call too many functions here. 1251 // Clean this up and write more tests. 1252 // request_test.go contains the start of this, 1253 // in TestParseMultipartFormOrder and others. 1254 } 1255 return 1256 } 1257 1258 // ParseForm populates r.Form and r.PostForm. 1259 // 1260 // For all requests, ParseForm parses the raw query from the URL and updates 1261 // r.Form. 1262 // 1263 // For POST, PUT, and PATCH requests, it also reads the request body, parses it 1264 // as a form and puts the results into both r.PostForm and r.Form. Request body 1265 // parameters take precedence over URL query string values in r.Form. 1266 // 1267 // If the request Body's size has not already been limited by MaxBytesReader, 1268 // the size is capped at 10MB. 1269 // 1270 // For other HTTP methods, or when the Content-Type is not 1271 // application/x-www-form-urlencoded, the request Body is not read, and 1272 // r.PostForm is initialized to a non-nil, empty value. 1273 // 1274 // ParseMultipartForm calls ParseForm automatically. 1275 // ParseForm is idempotent. 1276 func (r *Request) ParseForm() error { 1277 var err error 1278 if r.PostForm == nil { 1279 if r.Method == "POST" || r.Method == "PUT" || r.Method == "PATCH" { 1280 r.PostForm, err = parsePostForm(r) 1281 } 1282 if r.PostForm == nil { 1283 r.PostForm = make(url.Values) 1284 } 1285 } 1286 if r.Form == nil { 1287 if len(r.PostForm) > 0 { 1288 r.Form = make(url.Values) 1289 copyValues(r.Form, r.PostForm) 1290 } 1291 var newValues url.Values 1292 if r.URL != nil { 1293 var e error 1294 newValues, e = url.ParseQuery(r.URL.RawQuery) 1295 if err == nil { 1296 err = e 1297 } 1298 } 1299 if newValues == nil { 1300 newValues = make(url.Values) 1301 } 1302 if r.Form == nil { 1303 r.Form = newValues 1304 } else { 1305 copyValues(r.Form, newValues) 1306 } 1307 } 1308 return err 1309 } 1310 1311 // ParseMultipartForm parses a request body as multipart/form-data. 1312 // The whole request body is parsed and up to a total of maxMemory bytes of 1313 // its file parts are stored in memory, with the remainder stored on 1314 // disk in temporary files. 1315 // ParseMultipartForm calls ParseForm if necessary. 1316 // If ParseForm returns an error, ParseMultipartForm returns it but also 1317 // continues parsing the request body. 1318 // After one call to ParseMultipartForm, subsequent calls have no effect. 1319 func (r *Request) ParseMultipartForm(maxMemory int64) error { 1320 if r.MultipartForm == multipartByReader { 1321 return errors.New("http: multipart handled by MultipartReader") 1322 } 1323 var parseFormErr error 1324 if r.Form == nil { 1325 // Let errors in ParseForm fall through, and just 1326 // return it at the end. 1327 parseFormErr = r.ParseForm() 1328 } 1329 if r.MultipartForm != nil { 1330 return nil 1331 } 1332 1333 mr, err := r.multipartReader(false) 1334 if err != nil { 1335 return err 1336 } 1337 1338 f, err := mr.ReadForm(maxMemory) 1339 if err != nil { 1340 return err 1341 } 1342 1343 if r.PostForm == nil { 1344 r.PostForm = make(url.Values) 1345 } 1346 for k, v := range f.Value { 1347 r.Form[k] = append(r.Form[k], v...) 1348 // r.PostForm should also be populated. See Issue 9305. 1349 r.PostForm[k] = append(r.PostForm[k], v...) 1350 } 1351 1352 r.MultipartForm = f 1353 1354 return parseFormErr 1355 } 1356 1357 // FormValue returns the first value for the named component of the query. 1358 // POST and PUT body parameters take precedence over URL query string values. 1359 // FormValue calls ParseMultipartForm and ParseForm if necessary and ignores 1360 // any errors returned by these functions. 1361 // If key is not present, FormValue returns the empty string. 1362 // To access multiple values of the same key, call ParseForm and 1363 // then inspect Request.Form directly. 1364 func (r *Request) FormValue(key string) string { 1365 if r.Form == nil { 1366 r.ParseMultipartForm(defaultMaxMemory) 1367 } 1368 if vs := r.Form[key]; len(vs) > 0 { 1369 return vs[0] 1370 } 1371 return "" 1372 } 1373 1374 // PostFormValue returns the first value for the named component of the POST, 1375 // PATCH, or PUT request body. URL query parameters are ignored. 1376 // PostFormValue calls ParseMultipartForm and ParseForm if necessary and ignores 1377 // any errors returned by these functions. 1378 // If key is not present, PostFormValue returns the empty string. 1379 func (r *Request) PostFormValue(key string) string { 1380 if r.PostForm == nil { 1381 r.ParseMultipartForm(defaultMaxMemory) 1382 } 1383 if vs := r.PostForm[key]; len(vs) > 0 { 1384 return vs[0] 1385 } 1386 return "" 1387 } 1388 1389 // FormFile returns the first file for the provided form key. 1390 // FormFile calls ParseMultipartForm and ParseForm if necessary. 1391 func (r *Request) FormFile(key string) (multipart.File, *multipart.FileHeader, error) { 1392 if r.MultipartForm == multipartByReader { 1393 return nil, nil, errors.New("http: multipart handled by MultipartReader") 1394 } 1395 if r.MultipartForm == nil { 1396 err := r.ParseMultipartForm(defaultMaxMemory) 1397 if err != nil { 1398 return nil, nil, err 1399 } 1400 } 1401 if r.MultipartForm != nil && r.MultipartForm.File != nil { 1402 if fhs := r.MultipartForm.File[key]; len(fhs) > 0 { 1403 f, err := fhs[0].Open() 1404 return f, fhs[0], err 1405 } 1406 } 1407 return nil, nil, ErrMissingFile 1408 } 1409 1410 func (r *Request) expectsContinue() bool { 1411 return hasToken(r.Header.get("Expect"), "100-continue") 1412 } 1413 1414 func (r *Request) wantsHttp10KeepAlive() bool { 1415 if r.ProtoMajor != 1 || r.ProtoMinor != 0 { 1416 return false 1417 } 1418 return hasToken(r.Header.get("Connection"), "keep-alive") 1419 } 1420 1421 func (r *Request) wantsClose() bool { 1422 if r.Close { 1423 return true 1424 } 1425 return hasToken(r.Header.get("Connection"), "close") 1426 } 1427 1428 func (r *Request) closeBody() error { 1429 if r.Body == nil { 1430 return nil 1431 } 1432 return r.Body.Close() 1433 } 1434 1435 func (r *Request) isReplayable() bool { 1436 if r.Body == nil || r.Body == NoBody || r.GetBody != nil { 1437 switch valueOrDefault(r.Method, "GET") { 1438 case "GET", "HEAD", "OPTIONS", "TRACE": 1439 return true 1440 } 1441 // The Idempotency-Key, while non-standard, is widely used to 1442 // mean a POST or other request is idempotent. See 1443 // https://golang.org/issue/19943#issuecomment-421092421 1444 if r.Header.has("Idempotency-Key") || r.Header.has("X-Idempotency-Key") { 1445 return true 1446 } 1447 } 1448 return false 1449 } 1450 1451 // outgoingLength reports the Content-Length of this outgoing (Client) request. 1452 // It maps 0 into -1 (unknown) when the Body is non-nil. 1453 func (r *Request) outgoingLength() int64 { 1454 if r.Body == nil || r.Body == NoBody { 1455 return 0 1456 } 1457 if r.ContentLength != 0 { 1458 return r.ContentLength 1459 } 1460 return -1 1461 } 1462 1463 // requestMethodUsuallyLacksBody reports whether the given request 1464 // method is one that typically does not involve a request body. 1465 // This is used by the Transport (via 1466 // transferWriter.shouldSendChunkedRequestBody) to determine whether 1467 // we try to test-read a byte from a non-nil Request.Body when 1468 // Request.outgoingLength() returns -1. See the comments in 1469 // shouldSendChunkedRequestBody. 1470 func requestMethodUsuallyLacksBody(method string) bool { 1471 switch method { 1472 case "GET", "HEAD", "DELETE", "OPTIONS", "PROPFIND", "SEARCH": 1473 return true 1474 } 1475 return false 1476 } 1477 1478 // requiresHTTP1 reports whether this request requires being sent on 1479 // an HTTP/1 connection. 1480 func (r *Request) requiresHTTP1() bool { 1481 return hasToken(r.Header.Get("Connection"), "upgrade") && 1482 ascii.EqualFold(r.Header.Get("Upgrade"), "websocket") 1483 } 1484