httplex.go

Documentation: golang.org/x/net/http/httpguts

     1  // Copyright 2016 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  package httpguts
     6  
     7  import (
     8  	"net"
     9  	"strings"
    10  	"unicode/utf8"
    11  
    12  	"golang.org/x/net/idna"
    13  )
    14  
    15  var isTokenTable = [127]bool{
    16  	'!':  true,
    17  	'#':  true,
    18  	'$':  true,
    19  	'%':  true,
    20  	'&':  true,
    21  	'\'': true,
    22  	'*':  true,
    23  	'+':  true,
    24  	'-':  true,
    25  	'.':  true,
    26  	'0':  true,
    27  	'1':  true,
    28  	'2':  true,
    29  	'3':  true,
    30  	'4':  true,
    31  	'5':  true,
    32  	'6':  true,
    33  	'7':  true,
    34  	'8':  true,
    35  	'9':  true,
    36  	'A':  true,
    37  	'B':  true,
    38  	'C':  true,
    39  	'D':  true,
    40  	'E':  true,
    41  	'F':  true,
    42  	'G':  true,
    43  	'H':  true,
    44  	'I':  true,
    45  	'J':  true,
    46  	'K':  true,
    47  	'L':  true,
    48  	'M':  true,
    49  	'N':  true,
    50  	'O':  true,
    51  	'P':  true,
    52  	'Q':  true,
    53  	'R':  true,
    54  	'S':  true,
    55  	'T':  true,
    56  	'U':  true,
    57  	'W':  true,
    58  	'V':  true,
    59  	'X':  true,
    60  	'Y':  true,
    61  	'Z':  true,
    62  	'^':  true,
    63  	'_':  true,
    64  	'`':  true,
    65  	'a':  true,
    66  	'b':  true,
    67  	'c':  true,
    68  	'd':  true,
    69  	'e':  true,
    70  	'f':  true,
    71  	'g':  true,
    72  	'h':  true,
    73  	'i':  true,
    74  	'j':  true,
    75  	'k':  true,
    76  	'l':  true,
    77  	'm':  true,
    78  	'n':  true,
    79  	'o':  true,
    80  	'p':  true,
    81  	'q':  true,
    82  	'r':  true,
    83  	's':  true,
    84  	't':  true,
    85  	'u':  true,
    86  	'v':  true,
    87  	'w':  true,
    88  	'x':  true,
    89  	'y':  true,
    90  	'z':  true,
    91  	'|':  true,
    92  	'~':  true,
    93  }
    94  
    95  func IsTokenRune(r rune) bool {
    96  	i := int(r)
    97  	return i < len(isTokenTable) && isTokenTable[i]
    98  }
    99  
   100  func isNotToken(r rune) bool {
   101  	return !IsTokenRune(r)
   102  }
   103  
   104  // HeaderValuesContainsToken reports whether any string in values
   105  // contains the provided token, ASCII case-insensitively.
   106  func HeaderValuesContainsToken(values []string, token string) bool {
   107  	for _, v := range values {
   108  		if headerValueContainsToken(v, token) {
   109  			return true
   110  		}
   111  	}
   112  	return false
   113  }
   114  
   115  // isOWS reports whether b is an optional whitespace byte, as defined
   116  // by RFC 7230 section 3.2.3.
   117  func isOWS(b byte) bool { return b == ' ' || b == '\t' }
   118  
   119  // trimOWS returns x with all optional whitespace removes from the
   120  // beginning and end.
   121  func trimOWS(x string) string {
   122  	// TODO: consider using strings.Trim(x, " \t") instead,
   123  	// if and when it's fast enough. See issue 10292.
   124  	// But this ASCII-only code will probably always beat UTF-8
   125  	// aware code.
   126  	for len(x) > 0 && isOWS(x[0]) {
   127  		x = x[1:]
   128  	}
   129  	for len(x) > 0 && isOWS(x[len(x)-1]) {
   130  		x = x[:len(x)-1]
   131  	}
   132  	return x
   133  }
   134  
   135  // headerValueContainsToken reports whether v (assumed to be a
   136  // 0#element, in the ABNF extension described in RFC 7230 section 7)
   137  // contains token amongst its comma-separated tokens, ASCII
   138  // case-insensitively.
   139  func headerValueContainsToken(v string, token string) bool {
   140  	for comma := strings.IndexByte(v, ','); comma != -1; comma = strings.IndexByte(v, ',') {
   141  		if tokenEqual(trimOWS(v[:comma]), token) {
   142  			return true
   143  		}
   144  		v = v[comma+1:]
   145  	}
   146  	return tokenEqual(trimOWS(v), token)
   147  }
   148  
   149  // lowerASCII returns the ASCII lowercase version of b.
   150  func lowerASCII(b byte) byte {
   151  	if 'A' <= b && b <= 'Z' {
   152  		return b + ('a' - 'A')
   153  	}
   154  	return b
   155  }
   156  
   157  // tokenEqual reports whether t1 and t2 are equal, ASCII case-insensitively.
   158  func tokenEqual(t1, t2 string) bool {
   159  	if len(t1) != len(t2) {
   160  		return false
   161  	}
   162  	for i, b := range t1 {
   163  		if b >= utf8.RuneSelf {
   164  			// No UTF-8 or non-ASCII allowed in tokens.
   165  			return false
   166  		}
   167  		if lowerASCII(byte(b)) != lowerASCII(t2[i]) {
   168  			return false
   169  		}
   170  	}
   171  	return true
   172  }
   173  
   174  // isLWS reports whether b is linear white space, according
   175  // to http://www.w3.org/Protocols/rfc2616/rfc2616-sec2.html#sec2.2
   176  //
   177  //	LWS            = [CRLF] 1*( SP | HT )
   178  func isLWS(b byte) bool { return b == ' ' || b == '\t' }
   179  
   180  // isCTL reports whether b is a control byte, according
   181  // to http://www.w3.org/Protocols/rfc2616/rfc2616-sec2.html#sec2.2
   182  //
   183  //	CTL            = <any US-ASCII control character
   184  //	                 (octets 0 - 31) and DEL (127)>
   185  func isCTL(b byte) bool {
   186  	const del = 0x7f // a CTL
   187  	return b < ' ' || b == del
   188  }
   189  
   190  // ValidHeaderFieldName reports whether v is a valid HTTP/1.x header name.
   191  // HTTP/2 imposes the additional restriction that uppercase ASCII
   192  // letters are not allowed.
   193  //
   194  // RFC 7230 says:
   195  //
   196  //	header-field   = field-name ":" OWS field-value OWS
   197  //	field-name     = token
   198  //	token          = 1*tchar
   199  //	tchar = "!" / "#" / "$" / "%" / "&" / "'" / "*" / "+" / "-" / "." /
   200  //	        "^" / "_" / "`" / "|" / "~" / DIGIT / ALPHA
   201  func ValidHeaderFieldName(v string) bool {
   202  	if len(v) == 0 {
   203  		return false
   204  	}
   205  	for _, r := range v {
   206  		if !IsTokenRune(r) {
   207  			return false
   208  		}
   209  	}
   210  	return true
   211  }
   212  
   213  // ValidHostHeader reports whether h is a valid host header.
   214  func ValidHostHeader(h string) bool {
   215  	// The latest spec is actually this:
   216  	//
   217  	// http://tools.ietf.org/html/rfc7230#section-5.4
   218  	//     Host = uri-host [ ":" port ]
   219  	//
   220  	// Where uri-host is:
   221  	//     http://tools.ietf.org/html/rfc3986#section-3.2.2
   222  	//
   223  	// But we're going to be much more lenient for now and just
   224  	// search for any byte that's not a valid byte in any of those
   225  	// expressions.
   226  	for i := 0; i < len(h); i++ {
   227  		if !validHostByte[h[i]] {
   228  			return false
   229  		}
   230  	}
   231  	return true
   232  }
   233  
   234  // See the validHostHeader comment.
   235  var validHostByte = [256]bool{
   236  	'0': true, '1': true, '2': true, '3': true, '4': true, '5': true, '6': true, '7': true,
   237  	'8': true, '9': true,
   238  
   239  	'a': true, 'b': true, 'c': true, 'd': true, 'e': true, 'f': true, 'g': true, 'h': true,
   240  	'i': true, 'j': true, 'k': true, 'l': true, 'm': true, 'n': true, 'o': true, 'p': true,
   241  	'q': true, 'r': true, 's': true, 't': true, 'u': true, 'v': true, 'w': true, 'x': true,
   242  	'y': true, 'z': true,
   243  
   244  	'A': true, 'B': true, 'C': true, 'D': true, 'E': true, 'F': true, 'G': true, 'H': true,
   245  	'I': true, 'J': true, 'K': true, 'L': true, 'M': true, 'N': true, 'O': true, 'P': true,
   246  	'Q': true, 'R': true, 'S': true, 'T': true, 'U': true, 'V': true, 'W': true, 'X': true,
   247  	'Y': true, 'Z': true,
   248  
   249  	'!':  true, // sub-delims
   250  	'$':  true, // sub-delims
   251  	'%':  true, // pct-encoded (and used in IPv6 zones)
   252  	'&':  true, // sub-delims
   253  	'(':  true, // sub-delims
   254  	')':  true, // sub-delims
   255  	'*':  true, // sub-delims
   256  	'+':  true, // sub-delims
   257  	',':  true, // sub-delims
   258  	'-':  true, // unreserved
   259  	'.':  true, // unreserved
   260  	':':  true, // IPv6address + Host expression's optional port
   261  	';':  true, // sub-delims
   262  	'=':  true, // sub-delims
   263  	'[':  true,
   264  	'\'': true, // sub-delims
   265  	']':  true,
   266  	'_':  true, // unreserved
   267  	'~':  true, // unreserved
   268  }
   269  
   270  // ValidHeaderFieldValue reports whether v is a valid "field-value" according to
   271  // http://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html#sec4.2 :
   272  //
   273  //	message-header = field-name ":" [ field-value ]
   274  //	field-value    = *( field-content | LWS )
   275  //	field-content  = <the OCTETs making up the field-value
   276  //	                 and consisting of either *TEXT or combinations
   277  //	                 of token, separators, and quoted-string>
   278  //
   279  // http://www.w3.org/Protocols/rfc2616/rfc2616-sec2.html#sec2.2 :
   280  //
   281  //	TEXT           = <any OCTET except CTLs,
   282  //	                  but including LWS>
   283  //	LWS            = [CRLF] 1*( SP | HT )
   284  //	CTL            = <any US-ASCII control character
   285  //	                 (octets 0 - 31) and DEL (127)>
   286  //
   287  // RFC 7230 says:
   288  //
   289  //	field-value    = *( field-content / obs-fold )
   290  //	obj-fold       =  N/A to http2, and deprecated
   291  //	field-content  = field-vchar [ 1*( SP / HTAB ) field-vchar ]
   292  //	field-vchar    = VCHAR / obs-text
   293  //	obs-text       = %x80-FF
   294  //	VCHAR          = "any visible [USASCII] character"
   295  //
   296  // http2 further says: "Similarly, HTTP/2 allows header field values
   297  // that are not valid. While most of the values that can be encoded
   298  // will not alter header field parsing, carriage return (CR, ASCII
   299  // 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII
   300  // 0x0) might be exploited by an attacker if they are translated
   301  // verbatim. Any request or response that contains a character not
   302  // permitted in a header field value MUST be treated as malformed
   303  // (Section 8.1.2.6). Valid characters are defined by the
   304  // field-content ABNF rule in Section 3.2 of [RFC7230]."
   305  //
   306  // This function does not (yet?) properly handle the rejection of
   307  // strings that begin or end with SP or HTAB.
   308  func ValidHeaderFieldValue(v string) bool {
   309  	for i := 0; i < len(v); i++ {
   310  		b := v[i]
   311  		if isCTL(b) && !isLWS(b) {
   312  			return false
   313  		}
   314  	}
   315  	return true
   316  }
   317  
   318  func isASCII(s string) bool {
   319  	for i := 0; i < len(s); i++ {
   320  		if s[i] >= utf8.RuneSelf {
   321  			return false
   322  		}
   323  	}
   324  	return true
   325  }
   326  
   327  // PunycodeHostPort returns the IDNA Punycode version
   328  // of the provided "host" or "host:port" string.
   329  func PunycodeHostPort(v string) (string, error) {
   330  	if isASCII(v) {
   331  		return v, nil
   332  	}
   333  
   334  	host, port, err := net.SplitHostPort(v)
   335  	if err != nil {
   336  		// The input 'v' argument was just a "host" argument,
   337  		// without a port. This error should not be returned
   338  		// to the caller.
   339  		host = v
   340  		port = ""
   341  	}
   342  	host, err = idna.ToASCII(host)
   343  	if err != nil {
   344  		// Non-UTF-8? Not representable in Punycode, in any
   345  		// case.
   346  		return "", err
   347  	}
   348  	if port == "" {
   349  		return host, nil
   350  	}
   351  	return net.JoinHostPort(host, port), nil
   352  }
   353
View as plain text