delta/go-git.git/src/net/http/httputil, branch dev.boringcrypto

net/http/httputil: ignore CloseNotify when a non-background context is present

2022-03-24T21:51:49+00:00

If the http.Request passed to ReverseProxy.ServeHTTP has a context
with a non-nil Done channel, don't watch the ResponseWriter's
CloseNotify channel.

Avoids starting an extra background goroutine in the common case.

Change-Id: I1328f3e02d3025caa0f446a2f20dfc14ef604c64
Reviewed-on: https://go-review.googlesource.com/c/go/+/376415
Trust: Brad Fitzpatrick 
Reviewed-by: Brad Fitzpatrick 
Trust: Damien Neil

all: gofmt -w -r 'interface{} -> any' src

2021-12-13T18:45:54+00:00

And then revert the bootstrap cmd directories and certain testdata.
And adjust tests as needed.

Not reverting the changes in std that are bootstrapped,
because some of those changes would appear in API docs,
and we want to use any consistently.
Instead, rewrite 'any' to 'interface{}' in cmd/dist for those directories
when preparing the bootstrap copy.

A few files changed as a result of running gofmt -w
not because of interface{} -> any but because they
hadn't been updated for the new //go:build lines.

Fixes #49884.

Change-Id: Ie8045cba995f65bd79c694ec77a1b3d1fe01bb09
Reviewed-on: https://go-review.googlesource.com/c/go/+/368254
Trust: Russ Cox 
Run-TryBot: Russ Cox 
Reviewed-by: Robert Griesemer 
TryBot-Result: Gopher Robot

net/http: fix spelling in documentation

2021-11-07T04:57:22+00:00

Change-Id: I8b0924300eafe27de98975512a78a6527a92e446
Reviewed-on: https://go-review.googlesource.com/c/go/+/354729
Reviewed-by: Ian Lance Taylor 
Trust: Damien Neil

net/http/httputil: allow MIME parameters when detecting SSE in ReverseProxy

2021-10-13T17:16:12+00:00

This change allows httputil.ReverseProxy to detect SSE (server-sent events)
content when the response's Content-Type header includes MIME parameters,
such as "text/event-stream;charset=utf-8".

Prior to this change the value of the Content-Type header was compared
directly to the literal "text/event-stream". This caused a false-negative
which failed to set the FlushInterval correctly when MIME parameters were
present.

Change-Id: If8bb43efb78787b6519d7fe7599ca018a0da0023
GitHub-Last-Rev: 224518c5eb9686ee050c79f5f853ebacfdf6fc42
GitHub-Pull-Request: golang/go#48427
Reviewed-on: https://go-review.googlesource.com/c/go/+/350509
Trust: Alexander Rakoczy 
Trust: Damien Neil 
Run-TryBot: Alexander Rakoczy 
TryBot-Result: Go Bot 
Reviewed-by: Damien Neil

net/http/httputil: close incoming ReverseProxy request body

2021-07-30T14:01:30+00:00

Reading from an incoming request body after the request handler aborts
with a panic can cause a panic, becuse http.Server does not (contrary
to its documentation) close the request body in this case.

Always close the incoming request body in ReverseProxy.ServeHTTP to
ensure that any in-flight outgoing requests using the body do not
read from it.

Updates #46866
Fixes CVE-2021-36221

Change-Id: I310df269200ad8732c5d9f1a2b00de68725831df
Reviewed-on: https://go-review.googlesource.com/c/go/+/333191
Trust: Damien Neil 
Reviewed-by: Brad Fitzpatrick 
Reviewed-by: Filippo Valsorda

net/http/httputil: always remove hop-by-hop headers

2021-05-27T15:00:58+00:00

Previously, we'd fail to remove the Connection header from a request
like this:

    Connection:
    Connection: x-header

Fixes #46313
Fixes CVE-2021-33197

Change-Id: Ie3009e926ceecfa86dfa6bcc6fe14ff01086be7d
Reviewed-on: https://go-review.googlesource.com/c/go/+/321929
Run-TryBot: Filippo Valsorda 
Reviewed-by: Katie Hockman 
Trust: Katie Hockman 
Trust: Filippo Valsorda 
TryBot-Result: Go Bot

all: fix spelling

2021-05-14T00:56:24+00:00

Change-Id: Id991d8e81e04835cabfb02d07a2199bfb553726c
GitHub-Last-Rev: 5d0b55d49127a2e2ba3148d20a58c52debcae12b
GitHub-Pull-Request: golang/go#44802
Reviewed-on: https://go-review.googlesource.com/c/go/+/299069
Run-TryBot: Ian Lance Taylor 
TryBot-Result: Go Bot 
Reviewed-by: Ian Lance Taylor 
Trust: Heschi Kreinick

net/http: switch HTTP1 to ASCII equivalents of string functions

2021-05-10T23:42:56+00:00

The current implementation uses UTF-aware functions
like strings.EqualFold and strings.ToLower.

This could, in some cases, cause http smuggling.

Change-Id: I0e76a993470a1e1b1b472f4b2859ea0a2b22ada0
Reviewed-on: https://go-review.googlesource.com/c/go/+/308009
Run-TryBot: Filippo Valsorda 
TryBot-Result: Go Bot 
Trust: Roberto Clapis 
Reviewed-by: Filippo Valsorda

all: fix spellings

2021-04-10T01:46:41+00:00

This follows the spelling choices that the Go project has made for English words.
https://github.com/golang/go/wiki/Spelling

Change-Id: Ie7c586d2cf23020cb492cfff58c0831d2d8d3a78
GitHub-Last-Rev: e16a32cd225a275f73d236bcb33703986d110ded
GitHub-Pull-Request: golang/go#45442
Reviewed-on: https://go-review.googlesource.com/c/go/+/308291
Run-TryBot: Ian Lance Taylor 
TryBot-Result: Go Bot 
Reviewed-by: Ian Lance Taylor 
Trust: Emmanuel Odeke

net/http/httputil: fix deadlock in DumpRequestOut

2021-01-06T15:02:50+00:00

Fix a deadlock in DumpRequestOut which can occur if the request is
cancelled between response being sent and it being processed.

Also:
* Ensure we don't get a reader leak when an error is reported by the
  transport before the body is consumed.
* Add leaked goroutine retries to avoid false test failures.

Fixes #38352

Change-Id: I83710791b2985b997f61fe5b49eadee0bb51bdee
Reviewed-on: https://go-review.googlesource.com/c/go/+/232798
Reviewed-by: Bryan C. Mills 
Run-TryBot: Bryan C. Mills 
TryBot-Result: Go Bot 
Trust: Damien Neil