Skip to content

net/http/httputil: report ErrBodyReadAfterClose on dumped bodies - #80705

Open
harjothkhara wants to merge 1 commit into
golang:masterfrom
harjothkhara:fix/httputil-dump-body-close-77463
Open

net/http/httputil: report ErrBodyReadAfterClose on dumped bodies#80705
harjothkhara wants to merge 1 commit into
golang:masterfrom
harjothkhara:fix/httputil-dump-body-close-77463

Conversation

@harjothkhara

Copy link
Copy Markdown
Contributor

DumpRequest, DumpRequestOut and DumpResponse replace the body they are
given with an equivalent one read from memory. That replacement was an
io.NopCloser, whose Close does nothing, so reading it after Close kept
returning data instead of an error.

Code that reads a body after closing it is broken, but with these
functions in the request path it silently worked, which hid the bug.

Return a body that reports http.ErrBodyReadAfterClose once closed, the
documented sentinel for this condition, as a real request or response
body does.

Fixes #77463

@gopherbot

Copy link
Copy Markdown
Contributor

This PR (HEAD: 544b342) has been imported to Gerrit for code review.

Please visit Gerrit at https://go-review.googlesource.com/c/go/+/809900.

Important tips:

  • Don't comment on this PR. All discussion takes place in Gerrit.
  • You need a Gmail or other Google account to log in to Gerrit.
  • To change your code in response to feedback:
    • Push a new commit to the branch used by your GitHub PR.
    • A new "patch set" will then appear in Gerrit.
    • Respond to each comment by marking as Done in Gerrit if implemented as suggested. You can alternatively write a reply.
    • Critical: you must click the blue Reply button near the top to publish your Gerrit responses.
    • Multiple commits in the PR will be squashed by GerritBot.
  • The title and description of the GitHub PR are used to construct the final commit message.
    • Edit these as needed via the GitHub web interface (not via Gerrit or git).
    • You should word wrap the PR description at ~76 characters unless you need longer lines (e.g., for tables or URLs).
  • See the Sending a change via GitHub and Reviews sections of the Contribution Guide as well as the FAQ for details.

DumpRequest, DumpRequestOut and DumpResponse replace the body they are
given with an equivalent one read from memory. That replacement was an
io.NopCloser, whose Close does nothing, so reading it after Close kept
returning data instead of an error.

Code that reads a body after closing it is broken, but with these
functions in the request path it silently worked, which hid the bug.

Return a body that reports http.ErrBodyReadAfterClose once closed, the
documented sentinel for this condition, as a real request or response
body does.

Only the body handed back to the caller is wrapped. drainBody also
returns a second reader, used to produce the dump itself and, in
DumpRequestOut, to feed the transport; that one stays an io.NopCloser so
that net/http continues to recognize it as an in-memory reader and to
copy from it without an intermediate buffer.

The wrapper tracks closure atomically, since http.Request.Body requires
Close to be safe to call concurrently with Read, and forwards WriteTo
when the underlying reader supports it, as io.NopCloser does.

Fixes golang#77463

Change-Id: Ia9bdfc86edeafb242b8c23aaa83132978c767a9c
@harjothkhara
harjothkhara force-pushed the fix/httputil-dump-body-close-77463 branch from 544b342 to 503d7ac Compare August 4, 2026 03:41
@gopherbot

Copy link
Copy Markdown
Contributor

This PR (HEAD: 503d7ac) has been imported to Gerrit for code review.

Please visit Gerrit at https://go-review.googlesource.com/c/go/+/809900.

Important tips:

  • Don't comment on this PR. All discussion takes place in Gerrit.
  • You need a Gmail or other Google account to log in to Gerrit.
  • To change your code in response to feedback:
    • Push a new commit to the branch used by your GitHub PR.
    • A new "patch set" will then appear in Gerrit.
    • Respond to each comment by marking as Done in Gerrit if implemented as suggested. You can alternatively write a reply.
    • Critical: you must click the blue Reply button near the top to publish your Gerrit responses.
    • Multiple commits in the PR will be squashed by GerritBot.
  • The title and description of the GitHub PR are used to construct the final commit message.
    • Edit these as needed via the GitHub web interface (not via Gerrit or git).
    • You should word wrap the PR description at ~76 characters unless you need longer lines (e.g., for tables or URLs).
  • See the Sending a change via GitHub and Reviews sections of the Contribution Guide as well as the FAQ for details.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

net/http/httputil: DumpRequest and DumpResponse replacement body allows read after close

2 participants