affected/package: net/http Cannot handle certain invalid request URLs

[c3er]

What version of Go are you using (go version)?

$ go version
go version go1.18.2 linux/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/c3er/.cache/go-build"
GOENV="/home/c3er/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/home/c3er/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/c3er/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.18.2"
GCCGO="gccgo"
GOAMD64="v1"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/home/c3er/repos/goscratch/go.mod"
GOWORK=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build3014967349=/tmp/go-build -gno-record-gcc-switches"

What did you do?

Using the HTTP server from net/http it seems not possible to handle requests that contain certain, unescaped characters.

Given this example program:

package main

import (
	"fmt"
	"net/http"
)

func main() {
	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
		fmt.Println(r.URL)
	})
	if err := http.ListenAndServe(":8123", nil); err != nil {
		panic(err)
	}
}

Trying this request:

$ curl -i 'localhost:8123/dfsfdsfds '
HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=utf-8
Connection: close

400 Bad Request

Note the space character at the end of the URL, though it doesn't matter where in the query part the space character is.

What did you expect to see?

Preferably that the my HTTP request handler is invoked and that I see output in the shell where the server was started. But if I could register some extra "request error handler" instead, it would also be fine.

My use case is an internally used microservice and I want to implement a proper error handling -- e.g. writing invalid request strings to a log.

What did you see instead?

No output in the shell where the server is started. See also above section "What did you do?" and "What did you expect to see?"

[seankhliao]

Duplicate of #21548

[c3er]

Thanks @seankhliao

I didn't find the issue when I searched for it.