1
0
mirror of https://github.com/golang/go synced 2024-11-23 01:50:04 -07:00
The Go programming language
Go to file
Jens Frederich f739b77508 net/http: fix authentication info leakage in Referer header (potential security risk)
http.Client calls URL.String() to fill in the Referer header, which may
contain authentication info. This patch removes authentication info from
the Referer header without introducing any API changes.

A new test for net/http is also provided.

This is the polished version of Alberto García Hierro's
https://golang.org/cl/9766046/

It should handle https Referer right.

Fixes #8417

LGTM=bradfitz
R=golang-codereviews, gobot, bradfitz, mikioh.mikioh
CC=golang-codereviews
https://golang.org/cl/151430043
2014-10-07 07:13:42 -07:00
api unicode: strconv: regexp: Upgrade to Unicode 7.0.0. 2014-08-18 20:26:10 +02:00
doc doc/go1.4.txt: useless change to tickle builders 2014-10-06 22:22:47 -07:00
include build: fix elf builds 2014-09-24 14:45:11 -07:00
lib codereview: do not hit upload_complete on first patch 2014-08-06 16:12:24 -04:00
misc misc/cgo/test: fail issue 7978 with clearer error when GOTRACEBACK != 2 2014-10-03 16:42:18 -04:00
src net/http: fix authentication info leakage in Referer header (potential security risk) 2014-10-07 07:13:42 -07:00
test cmd/gc: prohibit short variable declarations containing duplicate symbols 2014-10-06 17:16:39 -04:00
.hgignore .hgignore: delete some dregs 2014-09-25 17:30:12 -07:00
.hgtags tag go1.3.3 2014-10-01 13:38:00 +10:00
AUTHORS A+C: Jens Frederich (individual CLA) 2014-10-06 10:41:24 -07:00
CONTRIBUTORS A+C: Jens Frederich (individual CLA) 2014-10-06 10:41:24 -07:00
favicon.ico godoc: update favicon 2012-10-11 17:02:36 +11:00
LICENSE doc: update licensing text one more time 2012-03-27 15:09:13 +11:00
PATENTS
README README: Fix installation instructions 2013-11-20 13:47:37 -08:00
robots.txt godoc: serve robots.txt raw 2011-02-19 05:46:20 +11:00

This is the source code repository for the Go programming language.  

For documentation about how to install and use Go,
visit http://golang.org/ or load doc/install-source.html
in your web browser.

After installing Go, you can view a nicely formatted
doc/install-source.html by running godoc --http=:6060
and then visiting http://localhost:6060/doc/install/source.

Unless otherwise noted, the Go source files are distributed
under the BSD-style license found in the LICENSE file.

--

Binary Distribution Notes

If you have just untarred a binary Go distribution, you need to set
the environment variable $GOROOT to the full path of the go
directory (the one containing this README).  You can omit the
variable if you unpack it into /usr/local/go, or if you rebuild
from sources by running all.bash (see doc/install.html).
You should also add the Go binary directory $GOROOT/bin
to your shell's path.

For example, if you extracted the tar file into $HOME/go, you might
put the following in your .profile:

    export GOROOT=$HOME/go
    export PATH=$PATH:$GOROOT/bin

See doc/install.html for more details.