net/http: prevent redirect loop in serveFile if "/" is a normal file #63860

mauri870 · 2023-11-01T02:03:54Z

When FileServer(Dir("file")) is used where "file" is a normal file and
not a directory, the server enters a redirect loop.

The usage of a file inplace of a directory path is not documented in
http.Dir and it could be considered undefined behavior.

This CL updates serveFile to check if we are trying to traverse a normal
file instead of a directory and return an error, preventing the redirect
loop.

Fixes #63769

When FileServer(Dir("file")) is used where "file" is a normal file and not a directory, the server enters a redirect loop. If serveFile is trying to serve "/" from a FileSystem and it happens to be a normal file then we can avoid the redirect loop to ../ and serve the file itself. This is the same behavior of newer apis in net/http like ServeFileFS. Fixes [reserved]

gopherbot · 2023-11-01T02:12:53Z

This PR (HEAD: c8c8bf4) has been imported to Gerrit for code review.

Please visit Gerrit at https://go-review.googlesource.com/c/go/+/538719.

Important tips:

Don't comment on this PR. All discussion takes place in Gerrit.
You need a Gmail or other Google account to log in to Gerrit.
To change your code in response to feedback:
- Push a new commit to the branch used by your GitHub PR.
- A new "patch set" will then appear in Gerrit.
- Respond to each comment by marking as Done in Gerrit if implemented as suggested. You can alternatively write a reply.
- Critical: you must click the blue Reply button near the top to publish your Gerrit responses.
- Multiple commits in the PR will be squashed by GerritBot.
The title and description of the GitHub PR are used to construct the final commit message.
- Edit these as needed via the GitHub web interface (not via Gerrit or git).
- You should word wrap the PR description at ~76 characters unless you need longer lines (e.g., for tables or URLs).
See the Sending a change via GitHub and Reviews sections of the Contribution Guide as well as the FAQ for details.

gopherbot · 2023-11-06T21:50:17Z

Message from Damien Neil:

Patch Set 2: Code-Review+2 Commit-Queue+1

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2023-11-06T21:50:18Z

Message from Go LUCI:

Patch Set 2:

Dry run: CV is trying the patch.

Bot data: {"action":"start","triggered_at":"2023-11-06T21:40:13Z","revision":"72db8915d510aeed01e7ce63f221d78475889c8e"}

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2023-11-06T22:12:05Z

Message from Damien Neil:

Patch Set 2: -Commit-Queue

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2023-11-06T22:12:05Z

Message from Go LUCI:

Patch Set 2:

This CL has passed the run

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2023-11-06T22:12:06Z

Message from Go LUCI:

Patch Set 2: LUCI-TryBot-Result+1

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2023-11-07T22:15:52Z

Message from Bryan Mills:

Patch Set 2:

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2023-11-07T22:36:30Z

Message from Mauri de Souza Meneguzzo:

Patch Set 2:

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2023-11-08T14:34:45Z

Message from Bryan Mills:

Patch Set 2:

(2 comments)

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

…-dir-file

gopherbot · 2023-11-16T20:17:40Z

Message from Mauri de Souza Meneguzzo:

Patch Set 2:

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2023-11-16T20:54:03Z

Message from Mauri de Souza Meneguzzo:

Patch Set 2:

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2023-11-16T21:08:43Z

Message from Mauri de Souza Meneguzzo:

Patch Set 2:

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2023-11-16T21:08:51Z

This PR (HEAD: 8e2f667) has been imported to Gerrit for code review.

Please visit Gerrit at https://go-review.googlesource.com/c/go/+/538719.

Important tips:

Don't comment on this PR. All discussion takes place in Gerrit.
You need a Gmail or other Google account to log in to Gerrit.
To change your code in response to feedback:
- Push a new commit to the branch used by your GitHub PR.
- A new "patch set" will then appear in Gerrit.
- Respond to each comment by marking as Done in Gerrit if implemented as suggested. You can alternatively write a reply.
- Critical: you must click the blue Reply button near the top to publish your Gerrit responses.
- Multiple commits in the PR will be squashed by GerritBot.
The title and description of the GitHub PR are used to construct the final commit message.
- Edit these as needed via the GitHub web interface (not via Gerrit or git).
- You should word wrap the PR description at ~76 characters unless you need longer lines (e.g., for tables or URLs).
See the Sending a change via GitHub and Reviews sections of the Contribution Guide as well as the FAQ for details.

gopherbot · 2023-11-16T21:16:10Z

Message from Bryan Mills:

Patch Set 2:

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2023-11-16T21:16:19Z

This PR (HEAD: 6279bce) has been imported to Gerrit for code review.

Please visit Gerrit at https://go-review.googlesource.com/c/go/+/538719.

Important tips:

Don't comment on this PR. All discussion takes place in Gerrit.
You need a Gmail or other Google account to log in to Gerrit.
To change your code in response to feedback:
- Push a new commit to the branch used by your GitHub PR.
- A new "patch set" will then appear in Gerrit.
- Respond to each comment by marking as Done in Gerrit if implemented as suggested. You can alternatively write a reply.
- Critical: you must click the blue Reply button near the top to publish your Gerrit responses.
- Multiple commits in the PR will be squashed by GerritBot.
The title and description of the GitHub PR are used to construct the final commit message.
- Edit these as needed via the GitHub web interface (not via Gerrit or git).
- You should word wrap the PR description at ~76 characters unless you need longer lines (e.g., for tables or URLs).
See the Sending a change via GitHub and Reviews sections of the Contribution Guide as well as the FAQ for details.

gopherbot · 2023-11-16T21:23:39Z

This PR (HEAD: 480bda8) has been imported to Gerrit for code review.

Please visit Gerrit at https://go-review.googlesource.com/c/go/+/538719.

Important tips:

Don't comment on this PR. All discussion takes place in Gerrit.
You need a Gmail or other Google account to log in to Gerrit.
To change your code in response to feedback:
- Push a new commit to the branch used by your GitHub PR.
- A new "patch set" will then appear in Gerrit.
- Respond to each comment by marking as Done in Gerrit if implemented as suggested. You can alternatively write a reply.
- Critical: you must click the blue Reply button near the top to publish your Gerrit responses.
- Multiple commits in the PR will be squashed by GerritBot.
The title and description of the GitHub PR are used to construct the final commit message.
- Edit these as needed via the GitHub web interface (not via Gerrit or git).
- You should word wrap the PR description at ~76 characters unless you need longer lines (e.g., for tables or URLs).
See the Sending a change via GitHub and Reviews sections of the Contribution Guide as well as the FAQ for details.

gopherbot · 2023-11-16T21:30:49Z

Message from Mauri de Souza Meneguzzo:

Patch Set 4:

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2023-11-16T22:42:09Z

Message from Damien Neil:

Patch Set 6: Code-Review+2 Commit-Queue+1

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2023-11-16T22:48:58Z

Message from Go LUCI:

Patch Set 6:

Dry run: CV is trying the patch.

Bot data: {"action":"start","triggered_at":"2023-11-16T22:36:19Z","revision":"5394ca24677113fcbee41570ae92a9a7e732a9a7"}

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2023-11-16T23:02:40Z

Message from Damien Neil:

Patch Set 6: -Commit-Queue

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2023-11-16T23:02:41Z

Message from Go LUCI:

Patch Set 6:

This CL has passed the run

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2023-11-16T23:02:42Z

Message from Go LUCI:

Patch Set 6: LUCI-TryBot-Result+1

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2023-11-18T23:27:44Z

Message from Mauri de Souza Meneguzzo:

Patch Set 8: Run-TryBot+1

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2023-11-18T23:34:08Z

Message from Gopher Robot:

Patch Set 8:

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2023-11-18T23:40:28Z

Message from Gopher Robot:

Patch Set 8: TryBot-Result+1

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2023-11-18T23:46:52Z

Message from Emmanuel Odeke:

Patch Set 8: Hold+1

(4 comments)

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2023-11-18T23:53:12Z

Message from Emmanuel Odeke:

Patch Set 8:

(2 comments)

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

…eserver-dir-file Change-Id: Iad4fd4bd06eda52cf160bcd47b5319b911c3ad94

gopherbot · 2023-11-19T20:46:49Z

This PR (HEAD: dbbbe96) has been imported to Gerrit for code review.

Please visit Gerrit at https://go-review.googlesource.com/c/go/+/538719.

Important tips:

Don't comment on this PR. All discussion takes place in Gerrit.
You need a Gmail or other Google account to log in to Gerrit.
To change your code in response to feedback:
- Push a new commit to the branch used by your GitHub PR.
- A new "patch set" will then appear in Gerrit.
- Respond to each comment by marking as Done in Gerrit if implemented as suggested. You can alternatively write a reply.
- Critical: you must click the blue Reply button near the top to publish your Gerrit responses.
- Multiple commits in the PR will be squashed by GerritBot.
The title and description of the GitHub PR are used to construct the final commit message.
- Edit these as needed via the GitHub web interface (not via Gerrit or git).
- You should word wrap the PR description at ~76 characters unless you need longer lines (e.g., for tables or URLs).
See the Sending a change via GitHub and Reviews sections of the Contribution Guide as well as the FAQ for details.

gopherbot · 2023-11-19T20:53:18Z

Message from Mauri de Souza Meneguzzo:

Patch Set 8: -Run-TryBot

(3 comments)

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2023-11-19T20:59:34Z

Message from Emmanuel Odeke:

Patch Set 9: -Hold Code-Review+2 Run-TryBot+1

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2023-11-19T21:05:58Z

Message from Gopher Robot:

Patch Set 9:

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2023-11-19T21:18:44Z

Message from Gopher Robot:

Patch Set 9: TryBot-Result+1

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2023-11-20T21:12:32Z

Message from Bryan Mills:

Patch Set 9:

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2023-11-20T22:28:05Z

Message from Bryan Mills:

Patch Set 9:

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2023-12-01T14:44:59Z

Message from Mauri de Souza Meneguzzo:

Patch Set 9:

(2 comments)

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2023-12-02T12:45:16Z

This PR (HEAD: 7399288) has been imported to Gerrit for code review.

Please visit Gerrit at https://go-review.googlesource.com/c/go/+/538719.

Important tips:

Don't comment on this PR. All discussion takes place in Gerrit.
You need a Gmail or other Google account to log in to Gerrit.
To change your code in response to feedback:
- Push a new commit to the branch used by your GitHub PR.
- A new "patch set" will then appear in Gerrit.
- Respond to each comment by marking as Done in Gerrit if implemented as suggested. You can alternatively write a reply.
- Critical: you must click the blue Reply button near the top to publish your Gerrit responses.
- Multiple commits in the PR will be squashed by GerritBot.
The title and description of the GitHub PR are used to construct the final commit message.
- Edit these as needed via the GitHub web interface (not via Gerrit or git).
- You should word wrap the PR description at ~76 characters unless you need longer lines (e.g., for tables or URLs).
See the Sending a change via GitHub and Reviews sections of the Contribution Guide as well as the FAQ for details.

gopherbot · 2023-12-02T12:51:35Z

Message from Mauri de Souza Meneguzzo:

Patch Set 9:

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2023-12-04T15:45:15Z

Message from Bryan Mills:

Patch Set 10: Code-Review+1

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2024-01-10T13:33:44Z

This PR (HEAD: 754c9a1) has been imported to Gerrit for code review.

Please visit Gerrit at https://go-review.googlesource.com/c/go/+/538719.

Important tips:

Don't comment on this PR. All discussion takes place in Gerrit.
You need a Gmail or other Google account to log in to Gerrit.
To change your code in response to feedback:
- Push a new commit to the branch used by your GitHub PR.
- A new "patch set" will then appear in Gerrit.
- Respond to each comment by marking as Done in Gerrit if implemented as suggested. You can alternatively write a reply.
- Critical: you must click the blue Reply button near the top to publish your Gerrit responses.
- Multiple commits in the PR will be squashed by GerritBot.
The title and description of the GitHub PR are used to construct the final commit message.
- Edit these as needed via the GitHub web interface (not via Gerrit or git).
- You should word wrap the PR description at ~76 characters unless you need longer lines (e.g., for tables or URLs).
See the Sending a change via GitHub and Reviews sections of the Contribution Guide as well as the FAQ for details.

gopherbot · 2024-02-26T23:48:54Z

Message from Mauri de Souza Meneguzzo:

Patch Set 11: Commit-Queue+1

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2024-02-26T23:54:52Z

Message from Go LUCI:

Patch Set 11:

Dry run: CV is trying the patch.

Bot data: {"action":"start","triggered_at":"2024-02-26T23:41:46Z","revision":"b47fd82ac595fbfc78aa53aa33f4ede92de3d7c6"}

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2024-02-27T00:13:36Z

Message from Mauri de Souza Meneguzzo:

Patch Set 11: -Commit-Queue

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2024-02-27T00:13:36Z

Message from Go LUCI:

Patch Set 11:

This CL has passed the run

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2024-02-27T00:13:37Z

Message from Go LUCI:

Patch Set 11: LUCI-TryBot-Result+1

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

gopherbot · 2024-02-27T00:25:30Z

Message from Mauri de Souza Meneguzzo:

Patch Set 11:

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/538719.
After addressing review feedback, remember to publish your drafts!

When FileServer(Dir("file")) is used where "file" is a normal file and not a directory, the server enters a redirect loop. The usage of a file inplace of a directory path is not documented in http.Dir and it could be considered undefined behavior. This CL updates serveFile to check if we are trying to traverse a normal file instead of a directory and return an error, preventing the redirect loop. Fixes #63769 Change-Id: I81e289444e7d0bd72189c2e7b763f5540333e2d0 GitHub-Last-Rev: 754c9a1 GitHub-Pull-Request: #63860 Reviewed-on: https://go-review.googlesource.com/c/go/+/538719 Reviewed-by: Damien Neil <[email protected]> Reviewed-by: Emmanuel Odeke <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Bryan Mills <[email protected]> Auto-Submit: Bryan Mills <[email protected]> Commit-Queue: Bryan Mills <[email protected]>

gopherbot · 2024-02-27T18:13:34Z

This PR is being closed because golang.org/cl/538719 has been merged.

mauri870 added 2 commits October 31, 2023 22:45

remove TODO

c8c8bf4

Merge remote-tracking branch 'origin' into hotfix/net-http-fileserver…

182cf93

…-dir-file

fix http.Dir docs

8e2f667

mauri870 force-pushed the hotfix/net-http-fileserver-dir-file branch 2 times, most recently from db6fcf1 to 480bda8 Compare November 16, 2023 21:21

return an error if Dir is invoked with a normal file

6f5f712

mauri870 force-pushed the hotfix/net-http-fileserver-dir-file branch from 480bda8 to 6f5f712 Compare November 17, 2023 20:02

mauri870 added 2 commits November 19, 2023 17:33

Merge remote-tracking branch 'origin/master' into hotfix/net-http-fil…

6715bf3

…eserver-dir-file Change-Id: Iad4fd4bd06eda52cf160bcd47b5319b911c3ad94

improvements for error handling

dbbbe96

handle error inside serveFile

7399288

Merge branch 'master' into hotfix/net-http-fileserver-dir-file

754c9a1

gopherbot closed this Feb 27, 2024

net/http: prevent redirect loop in serveFile if "/" is a normal file #63860

net/http: prevent redirect loop in serveFile if "/" is a normal file #63860

Conversation

mauri870 commented Nov 1, 2023 • edited Loading

gopherbot commented Nov 1, 2023

gopherbot commented Nov 6, 2023

gopherbot commented Nov 6, 2023

gopherbot commented Nov 6, 2023

gopherbot commented Nov 6, 2023

gopherbot commented Nov 6, 2023

gopherbot commented Nov 7, 2023

gopherbot commented Nov 7, 2023

gopherbot commented Nov 8, 2023

gopherbot commented Nov 16, 2023

gopherbot commented Nov 16, 2023

gopherbot commented Nov 16, 2023

gopherbot commented Nov 16, 2023

gopherbot commented Nov 16, 2023

gopherbot commented Nov 16, 2023

gopherbot commented Nov 16, 2023

gopherbot commented Nov 16, 2023

gopherbot commented Nov 16, 2023

gopherbot commented Nov 16, 2023

gopherbot commented Nov 16, 2023

gopherbot commented Nov 16, 2023

gopherbot commented Nov 16, 2023

gopherbot commented Nov 18, 2023

gopherbot commented Nov 18, 2023

gopherbot commented Nov 18, 2023

gopherbot commented Nov 18, 2023

gopherbot commented Nov 18, 2023

gopherbot commented Nov 19, 2023

gopherbot commented Nov 19, 2023

gopherbot commented Nov 19, 2023

gopherbot commented Nov 19, 2023

gopherbot commented Nov 19, 2023

gopherbot commented Nov 20, 2023

gopherbot commented Nov 20, 2023

gopherbot commented Dec 1, 2023

gopherbot commented Dec 2, 2023

gopherbot commented Dec 2, 2023

gopherbot commented Dec 4, 2023

gopherbot commented Jan 10, 2024

gopherbot commented Feb 26, 2024

gopherbot commented Feb 26, 2024

gopherbot commented Feb 27, 2024

gopherbot commented Feb 27, 2024

gopherbot commented Feb 27, 2024

gopherbot commented Feb 27, 2024

gopherbot commented Feb 27, 2024

mauri870 commented Nov 1, 2023 •

edited

Loading