net/http: readRequest doesn't check URL length

[System-Glitch]

What version of Go are you using (go version)?

$ go version
go version go1.14.2 linux/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/jeremy/.cache/go-build"
GOENV="/home/jeremy/.config/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/jeremy/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/lib/go-1.14"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/lib/go-1.14/pkg/tool/linux_amd64"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build264402416=/tmp/go-build -gno-record-gcc-switches"

What did you do?

I was exploring the net/http package to see if the HTTP 431 Request Header Fields Too Large and 414 URI Too Long codes were handled already so I don't have to do it myself. I found out that 431 is handled, but 414 URI Too Long is not.

What did you expect to see?

The server should return a 414 URI Too Long error code if the request URI is longer than a MaxURIBytes field added to the Server struct, in the same fashion as MaxHeaderBytes for 431 Request Header Fields Too Large.

A good default value would be 8190 bytes, as it's the default one in Apache.

What did you see instead?

Nothing. This feature is not implemented.

[dmitshur]

/cc @bradfitz @FiloSottile

[System-Glitch]

If you agree on the change, I can make a PR for this.

[bradfitz]

I think the existing https://golang.org/pkg/net/http/#Server.MaxHeaderBytes is probably sufficient here:

    // MaxHeaderBytes controls the maximum number of bytes the
    // server will read parsing the request header's keys and
    // values, including the request line. It does not limit the
    // size of the request body.
    // If zero, DefaultMaxHeaderBytes is used.
    MaxHeaderBytes int

I'm having a hard time imagining somebody who wants to bound the request-line separately from the header lengths.

If so, they can do it in their Handler.

[System-Glitch]

You may want to have a higer limit for the length of the cookies than for the URI. But this is probably a marginal case. You can close the issue.