net/http/cgi: PATH_INFO should be empty or start with a slash

Fixed PATH_INFO not starting with a slash as described in RFC 3875 for PATH_INFO Fixes golang#63925
aimuz · Nov 3, 2023 · de79aa7 · de79aa7
1 parent 450f469
commit de79aa7
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 6 deletions.
diff --git a/src/net/http/cgi/host.go b/src/net/http/cgi/host.go
@@ -116,8 +116,8 @@ func removeLeadingDuplicates(env []string) (ret []string) {
 
 func (h *Handler) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 	root := h.Root
-	if root == "" {
-		root = "/"
+	if strings.HasSuffix(root, "/") {
+		root = root[:len(root)-1]
 	}
 
 	if len(req.TransferEncoding) > 0 && req.TransferEncoding[0] == "chunked" {
@@ -127,7 +127,7 @@ func (h *Handler) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 	}
 
 	pathInfo := req.URL.Path
-	if root != "/" && strings.HasPrefix(pathInfo, root) {
+	if strings.HasPrefix(pathInfo, root) {
 		pathInfo = pathInfo[len(root):]
 	}
 

diff --git a/src/net/http/cgi/host_test.go b/src/net/http/cgi/host_test.go
@@ -213,11 +213,11 @@ func TestPathInfoDirRoot(t *testing.T) {
 		Root: "/myscript/",
 	}
 	expectedMap := map[string]string{
-		"env-PATH_INFO":       "bar",
+		"env-PATH_INFO":       "/bar",
 		"env-QUERY_STRING":    "a=b",
 		"env-REQUEST_URI":     "/myscript/bar?a=b",
 		"env-SCRIPT_FILENAME": "testdata/test.cgi",
-		"env-SCRIPT_NAME":     "/myscript/",
+		"env-SCRIPT_NAME":     "/myscript",
 	}
 	runCgiTest(t, h, "GET /myscript/bar?a=b HTTP/1.0\nHost: example.com\n\n", expectedMap)
 }
@@ -278,7 +278,7 @@ func TestPathInfoNoRoot(t *testing.T) {
 		"env-QUERY_STRING":    "a=b",
 		"env-REQUEST_URI":     "/bar?a=b",
 		"env-SCRIPT_FILENAME": "testdata/test.cgi",
-		"env-SCRIPT_NAME":     "/",
+		"env-SCRIPT_NAME":     "",
 	}
 	runCgiTest(t, h, "GET /bar?a=b HTTP/1.0\nHost: example.com\n\n", expectedMap)
 }