Skip to content

net/http: bad handling of HEAD requests with a body [1.18 backport] #56323

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
dr2chase opened this issue Oct 19, 2022 · 5 comments
Closed

net/http: bad handling of HEAD requests with a body [1.18 backport] #56323

dr2chase opened this issue Oct 19, 2022 · 5 comments
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge
Milestone
Go1.18.10

Comments

@dr2chase
Copy link
Contributor

This is a by-hand backport request to 1.18 for #53960.
We approved the #56154 (1.19 backport today) and by default backports target the last two releases, so this backport is also approved.
@dr2chase dr2chase added the CherryPickApproved Used during the release process for point releases label Oct 19, 2022
@gopherbot gopherbot added this to the Go1.18.8 milestone Oct 19, 2022
@dr2chase dr2chase mentioned this issue Oct 19, 2022
Closed
@gopherbot gopherbot modified the milestones: Go1.18.8, Go1.18.9 Nov 1, 2022
@gopherbot gopherbot modified the milestones: Go1.18.9, Go1.18.10 Dec 6, 2022
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/457275 mentions this issue: [release-branch.go1.18] net/http: accept HEAD requests with a body

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/457416 mentions this issue: [internal-branch.go1.18-vendor] http2: accept HEAD requests with a body

gopherbot pushed a commit to golang/net that referenced this issue Dec 14, 2022
@neild @thanm
[internal-branch.go1.18-vendor] http2: accept HEAD requests with a body
6143a13 
RFC 7231 permits HEAD requests to contain a body, although it does
state there are no defined semantics for payloads of HEAD requests
and that some servers may reject HEAD requests with a payload.

Accept HEAD requests with a body.

Test is in net/http CL 418614.

For golang/go#53960.
For golang/go#56323.

Change-Id: I946d3ec796054c3908beb8a69cc78aa51c04c972
Reviewed-on: https://go-review.googlesource.com/c/net/+/418634
Run-TryBot: Damien Neil <dneil@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Reviewed-by: Cherry Mui <cherryyz@google.com>
(cherry picked from commit f8f703f)
Reviewed-on: https://go-review.googlesource.com/c/net/+/457416
Reviewed-by: Than McIntosh <thanm@google.com>
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/457596 mentions this issue: [release-branch.go1.18] all: upgrade golang.org/x/net to v0.0.0-20221214163811-6143a133e5c9

@gopherbot
Copy link
Contributor

Closed by merging d17cf56 to release-branch.go1.18.

gopherbot pushed a commit that referenced this issue Dec 19, 2022
@neild @dr2chase
[release-branch.go1.18] all: upgrade golang.org/x/net to v0.0.0-20221…
d17cf56 
…214163811-6143a133e5c9

Update x/net to include the fix for #53960.

For #53960
For #56323

Change-Id: I825212ecdf7bf2f52c2fda1faf1739b593063653
Reviewed-on: https://go-review.googlesource.com/c/go/+/457596
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Than McIntosh <thanm@google.com>
Run-TryBot: Damien Neil <dneil@google.com>
@neild
Copy link
Contributor

neild commented Jan 26, 2023

The backport for the HTTP/1 fix was never merged, thanks to none of us noticing that Gopherbot had prematurely closed this issue (#29599). Since there won't be another 1.18 minor release, this is unfortunate but there's not much to be done about that at this point.

@golang golang locked and limited conversation to collaborators Jan 26, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge
Projects
None yet
Milestone
Go1.18.10
Development

No branches or pull requests
3 participants
@neild @dr2chase @gopherbot