Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

net/http: incorrectly redirect (301) if request payload include port number #51892

Open
whswork opened this issue Mar 23, 2022 · 6 comments
Open

net/http: incorrectly redirect (301) if request payload include port number #51892

whswork opened this issue Mar 23, 2022 · 6 comments
Labels
NeedsInvestigation
Milestone

Comments

@whswork
Copy link

@whswork whswork commented Mar 23, 2022

What version of Go are you using (go version)?

$ go version
go version go1.18 linux/arm64

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (go env)?

go env Output
$ go env
GO111MODULE=""
GOARCH="arm64"
GOBIN=""
GOCACHE="/home/admin/.cache/go-build"
GOENV="/home/admin/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="arm64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/home/admin/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/admin/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_arm64"
GOVCS=""
GOVERSION="go1.18"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/home/admin/go.mod"
GOWORK=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build3281198030=/tmp/go-build -gno-record-gcc-switches"

What did you do?

server.go

package main

import (
	"io"
	"log"
	"net/http"
)

func main() {
	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
		io.WriteString(w, "hello world")
	})

	log.Fatal(http.ListenAndServe(":80", nil))
}

client.go

package main

import (
	"bufio"
	"fmt"
	"io"
	"log"
	"net"
)

func main() {
	// conn, err := net.Dial("tcp", "1.1.1.1:80")
	conn, err := net.Dial("tcp", "127.0.0.1:80")
	if err != nil {
		log.Fatal(err)
	}
	defer conn.Close()

	var payload = "GET localhost:80 HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n"

	_, err = conn.Write([]byte(payload))
	if err != nil {
		log.Fatal(err)
	}

	reader := bufio.NewReader(conn)

	for {
		message, err := reader.ReadString('\n')
		fmt.Print(message)

		if err == io.EOF {
			break
		}
	}
}

What did you expect to see?

HTTP/1.1 400 Bad Request

What did you see instead?

HTTP/1.1 301 Moved Permanently

@mknyszek
Copy link
Contributor

@mknyszek mknyszek commented Mar 23, 2022

CC @neild

@mknyszek mknyszek added the NeedsInvestigation label Mar 23, 2022
@mknyszek
Copy link
Contributor

@mknyszek mknyszek commented Mar 23, 2022

Is this issue new in 1.18, or does it reproduce with older releases?

@mknyszek mknyszek added this to the Backlog milestone Mar 23, 2022
@whswork
Copy link
Author

@whswork whswork commented Mar 23, 2022

exists in go1.17.8 windows/amd64 too

@seankhliao
Copy link
Contributor

@seankhliao seankhliao commented Mar 23, 2022

The authority form is only valid for CONNECT, looks like with other methods, net/http just passes the url straight to net/url.ParseRequestURI which parses localhost:80 as scheme: localhost and opaque: 80. Without a parse error, net/http doesn't return a BadRequest.

@neild
Copy link
Contributor

@neild neild commented Mar 23, 2022

Is this actually a problem? And if so, what should the correct behavior be?

The surprise is that you can provide a URL with a non-http scheme as the request-target of GET. Given that, is the current behavior wrong?

@seankhliao
Copy link
Contributor

@seankhliao seankhliao commented Mar 24, 2022

The correct behavior is probably to reject the request like we do if the request line doesn't contain a port. RFC 7230 Section 5.3.3 says the authority form is only used for CONNECT.

request line current behavior
CONNECT localhost HTTP/1.1 accepted
CONNECT localhost:80 HTTP/1.1 accepted
GET localhost HTTP/1.1 400 Bad Request
GET localhost:80 HTTP/1.1 301 Moved Permanently

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
NeedsInvestigation
Projects
None yet
Development

No branches or pull requests

4 participants