tree d00f25105998b1febceffce61fe9db56485b8963
parent 4edea0f0a77b341ec565d848e453c4a854418e8c
author Brad Fitzpatrick <bradfitz@golang.org> 1548270547 +0000
committer Brad Fitzpatrick <bradfitz@golang.org> 1548271906 +0000

net/url, net/http: reject control characters in URLs

This is a more conservative version of the reverted CL 99135 (which
was reverted in CL 137716)

The net/url part rejects URLs with ASCII CTLs from being parsed and
the net/http part rejects writing them if a bogus url.URL is
constructed otherwise.

Updates #27302
Updates #22907

Change-Id: I09a2212eb74c63db575223277aec363c55421ed8
Reviewed-on: https://go-review.googlesource.com/c/159157
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>