tree fd1f694cc31ac4dbc37847dcaff2d4819533dba4
parent 9bc52686da81b515cf3ad654dfb1a536fabceafa
author Filippo Valsorda <filippo@golang.org> 1621620150 -0400
committer Filippo Valsorda <filippo@golang.org> 1622127658 +0000

net/http/httputil: always remove hop-by-hop headers

Previously, we'd fail to remove the Connection header from a request
like this:

    Connection:
    Connection: x-header

Fixes #46313
Fixes CVE-2021-33197

Change-Id: Ie3009e926ceecfa86dfa6bcc6fe14ff01086be7d
Reviewed-on: https://go-review.googlesource.com/c/go/+/321929
Run-TryBot: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
Trust: Katie Hockman <katie@golang.org>
Trust: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>