net/http: Post redirect can submit entity body when redirecting with GET request

[ioquatix]

As discussed in #52519, it's possible for the http.Client to perform an invalid request when it receives a redirect status code which changes the request method from POST to GET, removing the entity body without updating the required headers.

See rack/rack#1994 for more context.

What version of Go are you using (go version)?

$ go version
go version go1.19.4 linux/amd64

Does this issue reproduce with the latest release?

Yes.

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/samuel/.cache/go-build"
GOENV="/home/samuel/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/home/samuel/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/samuel/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/lib/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/lib/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.19.4"
GCCGO="gccgo"
GOAMD64="v1"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/dev/null"
GOWORK=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build3391049208=/tmp/go-build -gno-record-gcc-switches"

What did you do?

The problem is explained in https://github.com/ioquatix/rack-go-http-client-redirect-bug with a reproduction.

What did you expect to see?

I expected it to follow the similar model as the fetch specification for handling redirects: https://fetch.spec.whatwg.org/#http-redirect-fetch.

Specifically, when receiving a redirect which causes the request method to change to GET, it needs to remove the entity body and the following headers:

• content-encoding
• content-language
• content-location
• content-type

What did you see instead?

A GET request which includes a content-type header without an entity body (invalid).

[ianlancetaylor]

CC @neild @bradfitz