-
Notifications
You must be signed in to change notification settings - Fork 18.3k
Closed
Labels
FrozenDueToAgeNeedsFixThe path to resolution is known, but the work has not been done.The path to resolution is known, but the work has not been done.
Milestone
Description
What version of Go are you using (go version
)?
$ go version go version go1.14.2 linux/amd64
Does this issue reproduce with the latest release?
Yes
What operating system and processor architecture are you using (go env
)?
go env
Output
$ go env GO111MODULE="on" GOARCH="amd64" GOBIN="" GOCACHE="/home/juliens/.cache/go-build" GOENV="/home/juliens/.config/go/env" GOEXE="" GOFLAGS="" GOHOSTARCH="amd64" GOHOSTOS="linux" GOINSECURE="" GONOPROXY="" GOOS="linux" GOPATH="/home/juliens/dev/go" GOPRIVATE="" GOPROXY="direct" GOROOT="/home/juliens/go-current" GOSUMDB="sum.golang.org" GOTMPDIR="" GOTOOLDIR="/home/juliens/go-current/pkg/tool/linux_amd64" GCCGO="gccgo" AR="ar" CC="gcc" CXX="g++" CGO_ENABLED="1" GOMOD="/dev/null" CGO_CFLAGS="-g -O2" CGO_CPPFLAGS="" CGO_CXXFLAGS="-g -O2" CGO_FFLAGS="-g -O2" CGO_LDFLAGS="-g -O2" PKG_CONFIG="pkg-config" GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build262375258=/tmp/go-build -gno-record-gcc-switches"
What did you do?
I launch a server using
http.ListenAndServe(":8080", http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
fmt.Println(req.ContentLength)
}))
and after that, I make a call with a Content-Length: +3
echo -ne "POST / HTTP/1.1\r\nContent-Length: +3\r\nHost: 127.0.0.1\r\n\r\naaa\r\n" | nc 127.0.0.1 8083
What did you expect to see?
A bad request ( because of the RFC https://tools.ietf.org/html/rfc2616#section-14.13 )
What did you see instead?
A valid request, the Content-Length is parsed as just 3
More
For what I saw, it's because the Content-Length
is parsed by using strconv.ParseInt
and so +3
is valid and becomes 3
zhangyoufu
Metadata
Metadata
Assignees
Labels
FrozenDueToAgeNeedsFixThe path to resolution is known, but the work has not been done.The path to resolution is known, but the work has not been done.