add comment. remove test

pull/18129/head
John Murret 2023-07-14 11:15:52 -06:00
parent f8578b0749
commit 4452224d6a
2 changed files with 7 additions and 23 deletions

View File

@ -1000,6 +1000,13 @@ func (r *request) toHTTP() (*http.Request, error) {
return nil, err
}
// validate that socket communications that do not use the host, detect
// slashes in the host name and replace it with local host.
// this is required since go started validating req.host in 1.20.6 and 1.19.11.
// prior to that they would strip out the slashes for you. They removed that
// behavior and added more strict validation as part of a CVE.
// https://github.com/golang/go/issues/60374
// the hope is that
if strings.HasPrefix(r.url.Host, "/") {
r.url.Host = "localhost"
}

View File

@ -991,29 +991,6 @@ func TestAPI_RequestToHTTP(t *testing.T) {
}
}
func TestAPI_RequestToHTTP_PrefixedWithSlashes(t *testing.T) {
t.Parallel()
c, s := makeClient(t)
defer s.Stop()
c.config.Address = "/tmp/mysocket.sock"
r := c.newRequest("DELETE", "/v1/kv/foo")
q := &QueryOptions{
Datacenter: "foo",
}
r.setQueryOptions(q)
req, err := r.toHTTP()
require.NoError(t, err)
// validate that socket communications that do not use the host, detect
// slashes in the host name and replace it with local host.
// this is required since go started validating req.host in 1.20.6.
// prior to that they would strip out the slahes for you. They removed that
// behavior and added more strict validation as part of a CVE.
// https://github.com/golang/go/issues/11206
require.Equal(t, "localhost", req.Host)
}
func TestAPI_ParseQueryMeta(t *testing.T) {
t.Parallel()
resp := &http.Response{