mirror
/
go
mirror of https://github.com/golang/go.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
The Go programming language
54,096 Commits 63 Branches 451 Tags 660 MiB
Go 94.3%
Assembly 5.3%
C 0.2%
Shell 0.1%
Go to file
Damien Neil 7c84234142 net/http/httputil: avoid query parameter smuggling 
Query parameter smuggling occurs when a proxy's interpretation
of query parameters differs from that of a downstream server.
Change ReverseProxy to avoid forwarding ignored query parameters.

Remove unparsable query parameters from the outbound request

   * if req.Form != nil after calling ReverseProxy.Director; and
   * before calling ReverseProxy.Rewrite.

This change preserves the existing behavior of forwarding the
raw query untouched if a Director hook does not parse the query
by calling Request.ParseForm (possibly indirectly).

Fixes #54663
Fixes CVE-2022-2880

Change-Id: If1621f6b0e73a49d79059dae9e6b256e0ff18ca9
Reviewed-on: https://go-review.googlesource.com/c/go/+/432976
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gopher Robot <gobot@golang.org>
Run-TryBot: Damien Neil <dneil@google.com>
 		2022-09-23 21:06:17 +00:00
.github .github: update issue label for pkgsite-removal 2022-09-07 16:00:20 +00:00
api time: implement Compare method 2022-09-19 17:10:49 +00:00
doc spec: describe an edge case for slice expression of nil slice 2022-09-21 14:06:17 +00:00
lib/time lib/time, time/tzdata: update to 2022b 2022-08-11 20:03:19 +00:00
misc cmd/go: omit VCS stamping during bootstrap 2022-09-22 18:55:06 +00:00
src net/http/httputil: avoid query parameter smuggling 2022-09-23 21:06:17 +00:00
test cmd/compile: use "init... cycle" instead of "init... loop" in error messages 2022-09-23 20:27:09 +00:00
.gitattributes
…
.gitignore internal/buildcfg: move build configuration out of cmd/internal/objabi 2021-04-16 19:20:53 +00:00
CONTRIBUTING.md
…
LICENSE
…
PATENTS
…
README.md README.md: update wiki link 2022-04-26 16:21:18 +00:00
SECURITY.md SECURITY.md: replace golang.org with go.dev 2022-04-26 19:59:47 +00:00
codereview.cfg codereview.cfg: add codereview.cfg for master branch 2021-02-19 18:44:53 +00:00

README.md

The Go Programming Language

Go is an open source programming language that makes it easy to build simple, reliable, and efficient software.

Gopher image Gopher image by Renee French, licensed under Creative Commons 3.0 Attributions license.

Our canonical Git repository is located at https://go.googlesource.com/go. There is a mirror of the repository at https://github.com/golang/go.

Unless otherwise noted, the Go source files are distributed under the BSD-style license found in the LICENSE file.

Download and Install

Binary Distributions

Official binary distributions are available at https://go.dev/dl/.

After downloading a binary release, visit https://go.dev/doc/install for installation instructions.

Install From Source

If a binary distribution is not available for your combination of operating system and architecture, visit https://go.dev/doc/install/source for source installation instructions.

Contributing

Go is the work of thousands of contributors. We appreciate your help!

To contribute, please read the contribution guidelines at https://go.dev/doc/contribute.

Note that the Go project uses the issue tracker for bug reports and proposals only. See https://go.dev/wiki/Questions for a list of places to ask questions about the Go language.