qbit/go
1
0
Fork 0
mirror of https://github.com/golang/go synced 2024-09-29 19:34:38 -06:00
Code Releases Activity

net/http: respond with 400 Bad Request for empty hex number of chunk length

Browse Source 
Fixes #64517

Change-Id: I78b8a6a83301deee05c3ff052a6adcd1f965aef2
Reviewed-on: https://go-review.googlesource.com/c/go/+/553835
Auto-Submit: Damien Neil <dneil@google.com>
Commit-Queue: Damien Neil <dneil@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Bryan Mills <bcmills@google.com>
This commit is contained in:
Andy Pan 2024-01-04 15:28:14 +08:00 committed by Gopher Robot
parent 1e07c144c3
commit ead47b0ab3
2 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/net/http/internal/chunked.go
View File

@ -263,6 +263,9 @@ type FlushAfterChunkWriter struct {
}
func parseHexUint(v []byte) (n uint64, err error) {
if len(v) == 0 {
return 0, errors.New("empty hex number for chunk length")
}
for i, b := range v {
switch {
case '0' <= b && b <= '9':

1
src/net/http/internal/chunked_test.go
View File

@ -153,6 +153,7 @@ func TestParseHexUint(t *testing.T) {
{"00000000000000000", 0, "http chunk length too large"}, // could accept if we wanted
{"10000000000000000", 0, "http chunk length too large"},
{"00000000000000001", 0, "http chunk length too large"}, // could accept if we wanted
{"", 0, "empty hex number for chunk length"},
}
for i := uint64(0); i <= 1234; i++ {
tests = append(tests, testCase{in: fmt.Sprintf("%x", i), want: i})