Skip to content

Commit

Permalink
net/http: omit invalid header value from error message
Browse files Browse the repository at this point in the history
Updates #43631

Change-Id: I0fe3aafdf7ef889fed1a830128721393f8d020e6
GitHub-Last-Rev: c359542
GitHub-Pull-Request: #48979
Reviewed-on: https://go-review.googlesource.com/c/go/+/355929
Reviewed-by: Dmitri Shuralyov <[email protected]>
Run-TryBot: Cherry Mui <[email protected]>
Reviewed-by: Damien Neil <[email protected]>
Reviewed-by: David Chase <[email protected]>
TryBot-Result: Gopher Robot <[email protected]>
  • Loading branch information
AlexanderYastrebov authored and neild committed Jul 1, 2022
1 parent 4a2a3bc commit e822b1e
Show file tree
Hide file tree
Showing 2 changed files with 10 additions and 9 deletions.
3 changes: 2 additions & 1 deletion src/net/http/transport.go
Original file line number Diff line number Diff line change
Expand Up @@ -525,7 +525,8 @@ func (t *Transport) roundTrip(req *Request) (*Response, error) {
for _, v := range vv {
if !httpguts.ValidHeaderFieldValue(v) {
req.closeBody()
return nil, fmt.Errorf("net/http: invalid header field value %q for key %v", v, k)
// Don't include the value in the error, because it may be sensitive.
return nil, fmt.Errorf("net/http: invalid header field value for %q", k)
}
}
}
Expand Down
16 changes: 8 additions & 8 deletions src/net/http/transport_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -6085,14 +6085,14 @@ func TestTransportClosesBodyOnInvalidRequests(t *testing.T) {
Method: " ",
URL: u,
},
wantErr: "invalid method",
wantErr: `invalid method " "`,
},
{
name: "nil URL",
req: &Request{
Method: "GET",
},
wantErr: "nil Request.URL",
wantErr: `nil Request.URL`,
},
{
name: "invalid header key",
Expand All @@ -6101,7 +6101,7 @@ func TestTransportClosesBodyOnInvalidRequests(t *testing.T) {
Header: Header{"💡": {"emoji"}},
URL: u,
},
wantErr: "invalid header field name",
wantErr: `invalid header field name "💡"`,
},
{
name: "invalid header value",
Expand All @@ -6110,23 +6110,23 @@ func TestTransportClosesBodyOnInvalidRequests(t *testing.T) {
Header: Header{"key": {"\x19"}},
URL: u,
},
wantErr: "invalid header field value",
wantErr: `invalid header field value for "key"`,
},
{
name: "non HTTP(s) scheme",
req: &Request{
Method: "POST",
URL: &url.URL{Scheme: "faux"},
},
wantErr: "unsupported protocol scheme",
wantErr: `unsupported protocol scheme "faux"`,
},
{
name: "no Host in URL",
req: &Request{
Method: "POST",
URL: &url.URL{Scheme: "http"},
},
wantErr: "no Host",
wantErr: `no Host in request URL`,
},
}

Expand All @@ -6142,8 +6142,8 @@ func TestTransportClosesBodyOnInvalidRequests(t *testing.T) {
if !bc {
t.Fatal("Expected body to have been closed")
}
if g, w := err.Error(), tt.wantErr; !strings.Contains(g, w) {
t.Fatalf("Error mismatch\n\t%q\ndoes not contain\n\t%q", g, w)
if g, w := err.Error(), tt.wantErr; !strings.HasSuffix(g, w) {
t.Fatalf("Error mismatch: %q does not end with %q", g, w)
}
})
}
Expand Down

0 comments on commit e822b1e

Please sign in to comment.