{"action":"created","issue":{"url":"https://api.github.com/repos/golang/go/issues/14353","repository_url":"https://api.github.com/repos/golang/go","labels_url":"https://api.github.com/repos/golang/go/issues/14353/labels{/name}","comments_url":"https://api.github.com/repos/golang/go/issues/14353/comments","events_url":"https://api.github.com/repos/golang/go/issues/14353/events","html_url":"https://github.com/golang/go/issues/14353","id":134117107,"number":14353,"title":"net/http: arbitrary string between port and path in url is silently accepted","user":{"login":"mpl","id":626071,"avatar_url":"https://avatars.githubusercontent.com/u/626071?v=3","gravatar_id":"","url":"https://api.github.com/users/mpl","html_url":"https://github.com/mpl","followers_url":"https://api.github.com/users/mpl/followers","following_url":"https://api.github.com/users/mpl/following{/other_user}","gists_url":"https://api.github.com/users/mpl/gists{/gist_id}","starred_url":"https://api.github.com/users/mpl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mpl/subscriptions","organizations_url":"https://api.github.com/users/mpl/orgs","repos_url":"https://api.github.com/users/mpl/repos","events_url":"https://api.github.com/users/mpl/events{/privacy}","received_events_url":"https://api.github.com/users/mpl/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/golang/go/milestones/38","html_url":"https://github.com/golang/go/milestones/Go1.8","labels_url":"https://api.github.com/repos/golang/go/milestones/38/labels","id":1709363,"number":38,"title":"Go1.8","description":"","creator":{"login":"griesemer","id":8528975,"avatar_url":"https://avatars.githubusercontent.com/u/8528975?v=3","gravatar_id":"","url":"https://api.github.com/users/griesemer","html_url":"https://github.com/griesemer","followers_url":"https://api.github.com/users/griesemer/followers","following_url":"https://api.github.com/users/griesemer/following{/other_user}","gists_url":"https://api.github.com/users/griesemer/gists{/gist_id}","starred_url":"https://api.github.com/users/griesemer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/griesemer/subscriptions","organizations_url":"https://api.github.com/users/griesemer/orgs","repos_url":"https://api.github.com/users/griesemer/repos","events_url":"https://api.github.com/users/griesemer/events{/privacy}","received_events_url":"https://api.github.com/users/griesemer/received_events","type":"User","site_admin":false},"open_issues":470,"closed_issues":234,"state":"open","created_at":"2016-04-15T16:30:23Z","updated_at":"2016-10-05T03:53:34Z","due_on":"2017-02-01T08:00:00Z","closed_at":null},"comments":8,"created_at":"2016-02-16T22:41:58Z","updated_at":"2016-10-05T14:42:40Z","closed_at":null,"body":"1) Run a (Go) webserver (on e.g. localhost:8080)\r\n\r\n2) Run this as client:\r\n\r\n\tpackage main\r\n\t\r\n\timport (\r\n\t\t\"io\"\r\n\t\t\"log\"\r\n\t\t\"os\"\r\n\t\t\"net/http\"\r\n\t)\r\n\t\r\n\tfunc main() {\r\n\t\t // works with \"http://localhost:8080foobar/valid_path\" too\r\n\t\tresp, err := http.Get(\"http://localhost:8080foobar/\")\r\n\t\tif err != nil {\r\n\t\t\tlog.Fatal(err)\r\n\t\t}\r\n\t\tdefer resp.Body.Close()\r\n\t\tif _, err := io.Copy(os.Stdout, resp.Body); err != nil {\r\n\t\t\tlog.Fatal(err)\r\n\t\t}\r\n\t}\r\n\r\n3) Notice how the \"foobar\" string between the port and the url path does not seem to be a problem.\r\nI was expecting to get an error with such an URL.\r\n\r\nI did not dig any further to see where that leniency comes from, because maybe that's not an actual concern. Let me know and I can look into it.\r\n\r\ngo version: go1.6beta2 linux/amd64\r\n"},"comment":{"url":"https://api.github.com/repos/golang/go/issues/comments/251695216","html_url":"https://github.com/golang/go/issues/14353#issuecomment-251695216","issue_url":"https://api.github.com/repos/golang/go/issues/14353","id":251695216,"user":{"login":"bradfitz","id":2621,"avatar_url":"https://avatars.githubusercontent.com/u/2621?v=3","gravatar_id":"","url":"https://api.github.com/users/bradfitz","html_url":"https://github.com/bradfitz","followers_url":"https://api.github.com/users/bradfitz/followers","following_url":"https://api.github.com/users/bradfitz/following{/other_user}","gists_url":"https://api.github.com/users/bradfitz/gists{/gist_id}","starred_url":"https://api.github.com/users/bradfitz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bradfitz/subscriptions","organizations_url":"https://api.github.com/users/bradfitz/orgs","repos_url":"https://api.github.com/users/bradfitz/repos","events_url":"https://api.github.com/users/bradfitz/events{/privacy}","received_events_url":"https://api.github.com/users/bradfitz/received_events","type":"User","site_admin":false},"created_at":"2016-10-05T14:42:40Z","updated_at":"2016-10-05T14:42:40Z","body":"No, CL 19720 is too late. If we're doing a DNS lookup, we've already lost.\r\n\r\nThe original fix was https://go-review.googlesource.com/22351 (for #14860) but it was rolled back in https://go-review.googlesource.com/22861\r\n\r\nWe should move the validation to `net/http` if we can't move it to `net/url`.\r\n"}}
{"actor":{"display_login":"bradfitz"}}