net/http: fix Request.Clone with SetPathValue

Fixes #64911

src/net/http/request.go

@@ -397,6 +397,20 @@ func (r *Request) Clone(ctx context.Context) *Request {
 	r2.Form = cloneURLValues(r.Form)
 	r2.PostForm = cloneURLValues(r.PostForm)
 	r2.MultipartForm = cloneMultipartForm(r.MultipartForm)
+
+	// See issue 64911.
+	if s := r.matches; s != nil {
+		s2 := make([]string, len(s))
+		copy(s2, s)
+		r2.matches = s2
+	}
+	if s := r2.otherValues; s != nil {
+		s2 := make(map[string]string, len(s))
+		for k, v := range s {
+			s2[k] = v
+		}
+		r2.otherValues = s2
+	}
 	return r2
 }
 

src/net/http/request_test.go

@@ -1053,6 +1053,21 @@ func TestRequestCloneTransferEncoding(t *testing.T) {
 	}
 }
 
+func TestRequestClonePathValues(t *testing.T) {
+	orig, err := http.NewRequest("GET", "https://example.com/", nil)
+	if err != nil {
+		panic(err)
+	}
+	orig.SetPathValue("orig", "orig")
+
+	copy := orig.Clone(context.Background())
+	copy.SetPathValue("copy", "copy")
+
+	if orig.PathValue("copy") != "" {
+		t.Fatal("orig.PathValue is changed")
+	}
+}
+
 // Issue 34878: verify we don't panic when including basic auth (Go 1.13 regression)
 func TestNoPanicOnRoundTripWithBasicAuth(t *testing.T) { run(t, testNoPanicWithBasicAuth) }
 func testNoPanicWithBasicAuth(t *testing.T, mode testMode) {