Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

http.NewRequest() doesn't throw error when request method is invalid

Tags:

go

package main

import (
    "log"
    "net/http"
)

func main() {
    // invalid method called "bad"
    req, err := http.NewRequest("bad", "https://www.google.com", nil)
    if err != nil {
        log.Printf("E! got err: %v", err)
    } else {
        log.Printf("I! request method: %s", req.Method)
    }
}

https://play.golang.org/p/NM8_4pkN5uM

err is nil here, can someone explain?

Thanks!

like image 574
Qingfeng Avatar asked Jul 29 '26 04:07

Qingfeng


1 Answers

bad is not considered as a bad http method.

Any string of non zero length having characters from !#$%&*+-.0123456789ABCDEFGHIJKLMNOPQRSTUWVXYZ^_`abcdefghijklmnopqrstuvwxyz|~ is considered valid

Following is the function used to validate an HTTP METHOD

func validMethod(method string) bool {

    /*

         Method         = "OPTIONS"                ; Section 9.2

                        | "GET"                    ; Section 9.3

                        | "HEAD"                   ; Section 9.4

                        | "POST"                   ; Section 9.5

                        | "PUT"                    ; Section 9.6

                        | "DELETE"                 ; Section 9.7

                        | "TRACE"                  ; Section 9.8

                        | "CONNECT"                ; Section 9.9

                        | extension-method

       extension-method = token

         token          = 1*<any CHAR except CTLs or separators>

    */

    return len(method) > 0 && strings.IndexFunc(method, isNotToken) == -1

}
like image 131
Sarath Sadasivan Pillai Avatar answered Aug 02 '26 04:08

Sarath Sadasivan Pillai