commit | a357d15e9ee36a1232ae071d9968c4cf10a672b4 | [log] [tgz] |
---|---|---|
author | Brad Fitzpatrick <bradfitz@golang.org> | Mon Jul 18 06:05:24 2016 +0000 |
committer | Chris Broadfoot <cbro@golang.org> | Mon Jul 18 15:13:08 2016 +0000 |
tree | 962a791649c8e0256267f5e64afa91a8a601ecaa | |
parent | 5164532ae0e9c3e87084638913029392ecc1af42 [diff] |
[release-branch.go1.6] net/http, net/http/cgi: fix for CGI + HTTP_PROXY security issue Because, * The CGI spec defines that incoming request header "Foo: Bar" maps to environment variable HTTP_FOO == "Bar". (see RFC 3875 4.1.18) * The HTTP_PROXY environment variable is conventionally used to configure the HTTP proxy for HTTP clients (and is respected by default for Go's net/http.Client and Transport) That means Go programs running in a CGI environment (as a child process under a CGI host) are vulnerable to an incoming request containing "Proxy: attacker.com:1234", setting HTTP_PROXY, and changing where Go by default proxies all outbound HTTP requests. This is CVE-2016-5386, aka https://httpoxy.org/ Fixes #16405 Change-Id: I6f68ade85421b4807785799f6d98a8b077e871f0 Reviewed-on: https://go-review.googlesource.com/25010 Run-TryBot: Chris Broadfoot <cbro@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Chris Broadfoot <cbro@golang.org> Reviewed-on: https://go-review.googlesource.com/25012
Go is an open source programming language that makes it easy to build simple, reliable, and efficient software.
For documentation about how to install and use Go, visit https://golang.org/ or load doc/install-source.html in your web browser.
Our canonical Git repository is located at https://go.googlesource.com/go. There is a mirror of the repository at https://github.com/golang/go.
Go is the work of hundreds of contributors. We appreciate your help!
To contribute, please read the contribution guidelines: https://golang.org/doc/contribute.html
Unless otherwise noted, the Go source files are distributed under the BSD-style license found in the LICENSE file.
If you have just untarred a binary Go distribution, you need to set the environment variable $GOROOT to the full path of the go directory (the one containing this file). You can omit the variable if you unpack it into /usr/local/go, or if you rebuild from sources by running all.bash (see doc/install-source.html). You should also add the Go binary directory $GOROOT/bin to your shell's path.
For example, if you extracted the tar file into $HOME/go, you might put the following in your .profile:
export GOROOT=$HOME/go export PATH=$PATH:$GOROOT/bin
See https://golang.org/doc/install or doc/install.html for more details.