1
0
mirror of https://github.com/golang/go synced 2024-11-23 17:50:06 -07:00
The Go programming language
Go to file
Russ Cox 617c93ce74 net/url: reject space in host; do not escape < > " in host
Host names in URLs must not use %-escaping for ASCII bytes, per RFC 3986.

url.Parse has historically allowed spaces and < > " in the URL host.
In Go 1.5, URL's String method started escaping those,
but then Parse would rejects the escaped form.
This CL is an attempt at some consistency between Parse and String
as far as the accepted host characters and the encoding of host characters,
so that if Parse succeeds, then Parse -> String -> Parse also succeeds.

Allowing space seems like a mistake, so reject that in Parse.
(Similarly, reject \t, \x01, and so on, all of which were being allowed.)

Allowing < > " doesn't seem awful, so continue to do that,
and go back to the Go 1.4 behavior of not escaping them in String.

Fixes #11302.

Change-Id: I0bf65b874cd936598f20694574364352a5abbe5f
Reviewed-on: https://go-review.googlesource.com/17387
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Russ Cox <rsc@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
2015-12-11 05:17:38 +00:00
api api: update next.txt 2015-11-13 09:26:18 +00:00
doc doc: go1.6.txt: go doc searches in breadth-first order 2015-12-10 18:10:32 +00:00
lib/time lib/time: update to IANA release 2015e. 2015-07-22 02:56:31 +00:00
misc misc/cgo/stdio: reenable tests 2015-12-05 21:24:30 +00:00
src net/url: reject space in host; do not escape < > " in host 2015-12-11 05:17:38 +00:00
test cmd/compile: don't truncate tiny float constants to 0 in error messages 2015-12-10 16:39:46 +00:00
.gitattributes .gitattributes: prevent all magic line ending changes 2014-12-12 23:14:54 +00:00
.gitignore runtime: break out system-specific constants into package sys 2015-11-12 17:04:45 +00:00
AUTHORS A+C: automated updates 2015-11-13 14:07:05 +00:00
CONTRIBUTING.md doc: suggest security@golang.org for reporting security issues 2015-06-26 09:53:36 +00:00
CONTRIBUTORS A+C: add Steve Newman (Google CLA) 2015-11-13 15:51:00 +00:00
favicon.ico
LICENSE
PATENTS
README.md readme: emphasize issue tracker is for bugs/proposals 2015-10-02 18:44:14 +00:00
robots.txt

The Go Programming Language

Go is an open source programming language that makes it easy to build simple, reliable, and efficient software.

Gopher image

For documentation about how to install and use Go, visit https://golang.org/ or load doc/install-source.html in your web browser.

Our canonical Git repository is located at https://go.googlesource.com/go. There is a mirror of the repository at https://github.com/golang/go.

Go is the work of hundreds of contributors. We appreciate your help!

To contribute, please read the contribution guidelines: https://golang.org/doc/contribute.html

Note that we do not accept pull requests and that we use the issue tracker for bug reports and proposals only. Please ask questions on https://forum.golangbridge.org or https://groups.google.com/forum/#!forum/golang-nuts.

Unless otherwise noted, the Go source files are distributed under the BSD-style license found in the LICENSE file.

--

Binary Distribution Notes

If you have just untarred a binary Go distribution, you need to set the environment variable $GOROOT to the full path of the go directory (the one containing this file). You can omit the variable if you unpack it into /usr/local/go, or if you rebuild from sources by running all.bash (see doc/install-source.html). You should also add the Go binary directory $GOROOT/bin to your shell's path.

For example, if you extracted the tar file into $HOME/go, you might put the following in your .profile:

export GOROOT=$HOME/go
export PATH=$PATH:$GOROOT/bin

See https://golang.org/doc/install or doc/install.html for more details.