Skip to content

net/url: URL allows malformed query round trip [1.11 backport] #29923

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
gopherbot opened this issue Jan 24, 2019 · 4 comments
Closed

net/url: URL allows malformed query round trip [1.11 backport] #29923

gopherbot opened this issue Jan 24, 2019 · 4 comments
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge
Milestone
Go1.11.6

Comments

@gopherbot
Copy link
Contributor

@FiloSottile requested issue #22907 to be considered for backport to the next 1.11 minor release.

@gopherbot please open backport issues.

This has security implications, and CL 159157 is safe enough to backport.
@gopherbot gopherbot added the CherryPickCandidate Used during the release process for point releases label Jan 24, 2019
@gopherbot gopherbot mentioned this issue Jan 24, 2019
Open
@gopherbot gopherbot added this to the Go1.11.6 milestone Jan 24, 2019
@FiloSottile FiloSottile added the CherryPickApproved Used during the release process for point releases label Jan 24, 2019
@FiloSottile
Copy link
Contributor

@bradfitz The cherry-pick hits a merge conflict, leaving this and the 1.10 cherry-pick to you.

@gopherbot gopherbot removed the CherryPickCandidate Used during the release process for point releases label Jan 24, 2019
@bradfitz
Copy link
Contributor

Sounds good. I'll handle these.

FYI I sent out https://go-review.googlesource.com/c/go/+/160178 for a fixed (and more permissive) version of the check for Go 1.13. That's probably what I'll backport, or maybe I'll only reject \x00, \r, and \n for those older releases.

@dmitshur dmitshur mentioned this issue Jan 31, 2019
Closed
@gopherbot
Copy link
Contributor Author

Change https://golang.org/cl/160798 mentions this issue: [release-branch.go1.11] net/http, net/url: reject control characters in URLs

@gopherbot
Copy link
Contributor Author

Closed by merging eb0f2b3 to release-branch.go1.11.

gopherbot pushed a commit that referenced this issue Feb 1, 2019
@bradfitz
[release-branch.go1.11] net/http, net/url: reject control characters …
eb0f2b3 
…in URLs

Cherry pick of combined CL 159157 + CL 160178.

Fixes #29923
Updates #27302
Updates #22907

Change-Id: I6de92c14284595a58321a4b4d53229285979b872
Reviewed-on: https://go-review.googlesource.com/c/160798
Run-TryBot: Brad Fitzpatrick <[email protected]>
TryBot-Result: Gobot Gobot <[email protected]>
Reviewed-by: Ian Lance Taylor <[email protected]>
@zeha zeha mentioned this issue Apr 6, 2019
Closed
@golang golang locked and limited conversation to collaborators Feb 1, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge
Projects
None yet
Milestone
Go1.11.6
Development

No branches or pull requests
3 participants
@bradfitz @FiloSottile @gopherbot