Skip to content

Commit

Permalink
add comment. remove test
Browse files Browse the repository at this point in the history
  • Loading branch information
jmurret committed Jul 14, 2023
1 parent f8578b0 commit 4452224
Show file tree
Hide file tree
Showing 2 changed files with 7 additions and 23 deletions.
7 changes: 7 additions & 0 deletions api/api.go
Original file line number Diff line number Diff line change
Expand Up @@ -1000,6 +1000,13 @@ func (r *request) toHTTP() (*http.Request, error) {
return nil, err
}

// validate that socket communications that do not use the host, detect
// slashes in the host name and replace it with local host.
// this is required since go started validating req.host in 1.20.6 and 1.19.11.
// prior to that they would strip out the slashes for you. They removed that
// behavior and added more strict validation as part of a CVE.
// https://github.com/golang/go/issues/60374
// the hope is that
if strings.HasPrefix(r.url.Host, "/") {
r.url.Host = "localhost"
}
Expand Down
23 changes: 0 additions & 23 deletions api/api_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -991,29 +991,6 @@ func TestAPI_RequestToHTTP(t *testing.T) {
}
}

func TestAPI_RequestToHTTP_PrefixedWithSlashes(t *testing.T) {
t.Parallel()
c, s := makeClient(t)
defer s.Stop()

c.config.Address = "/tmp/mysocket.sock"
r := c.newRequest("DELETE", "/v1/kv/foo")
q := &QueryOptions{
Datacenter: "foo",
}
r.setQueryOptions(q)
req, err := r.toHTTP()
require.NoError(t, err)
// validate that socket communications that do not use the host, detect
// slashes in the host name and replace it with local host.
// this is required since go started validating req.host in 1.20.6.
// prior to that they would strip out the slahes for you. They removed that
// behavior and added more strict validation as part of a CVE.
// https://github.com/golang/go/issues/11206
require.Equal(t, "localhost", req.Host)

}

func TestAPI_ParseQueryMeta(t *testing.T) {
t.Parallel()
resp := &http.Response{
Expand Down

0 comments on commit 4452224

Please sign in to comment.