Don't send the fragment/hash/# part of a URL to the server

Fixes #748
valyala · Feb 28, 2020 · 76b74e3 · 76b74e3
1 parent aa96a47
commit 76b74e3
Show file tree

Hide file tree

Showing 3 changed files with 32 additions and 13 deletions.
diff --git a/http_test.go b/http_test.go
@@ -15,6 +15,21 @@ import (
 	"github.com/valyala/bytebufferpool"
 )
 
+// Don't send the fragment/hash/# part of a URL to the server.
+func TestFragmentInURIRequest(t *testing.T) {
+	var req Request
+	req.SetRequestURI("https://docs.gitlab.com/ee/user/project/integrations/webhooks.html#events")
+
+	var b bytes.Buffer
+	req.WriteTo(&b)
+	got := b.String()
+	expected := "GET /ee/user/project/integrations/webhooks.html HTTP/1.1\r\nHost: docs.gitlab.com\r\n\r\n"
+
+	if got != expected {
+		t.Errorf("got %q expected %q", got, expected)
+	}
+}
+
 func TestRequestCopyTo(t *testing.T) {
 	t.Parallel()
 

diff --git a/uri.go b/uri.go
@@ -401,10 +401,6 @@ func (u *URI) RequestURI() []byte {
 		dst = append(dst, '?')
 		dst = append(dst, u.queryString...)
 	}
-	if len(u.hash) > 0 {
-		dst = append(dst, '#')
-		dst = append(dst, u.hash...)
-	}
 	u.requestURI = dst
 	return u.requestURI
 }
@@ -519,7 +515,12 @@ func (u *URI) FullURI() []byte {
 // AppendBytes appends full uri to dst and returns the extended dst.
 func (u *URI) AppendBytes(dst []byte) []byte {
 	dst = u.appendSchemeHost(dst)
-	return append(dst, u.RequestURI()...)
+	dst = append(dst, u.RequestURI()...)
+	if len(u.hash) > 0 {
+		dst = append(dst, '#')
+		dst = append(dst, u.hash...)
+	}
+	return dst
 }
 
 func (u *URI) appendSchemeHost(dst []byte) []byte {

diff --git a/uri_test.go b/uri_test.go
@@ -274,18 +274,18 @@ func testURIFullURI(t *testing.T, scheme, host, path, hash string, args *Args, e
 }
 
 func TestURIParseNilHost(t *testing.T) {
-	testURIParseScheme(t, "http://google.com/foo?bar#baz", "http", "google.com", "/foo?bar#baz")
-	testURIParseScheme(t, "HTtP://google.com/", "http", "google.com", "/")
-	testURIParseScheme(t, "://google.com/xyz", "http", "google.com", "/xyz")
-	testURIParseScheme(t, "//google.com/foobar", "http", "google.com", "/foobar")
-	testURIParseScheme(t, "fTP://aaa.com", "ftp", "aaa.com", "/")
-	testURIParseScheme(t, "httPS://aaa.com", "https", "aaa.com", "/")
+	testURIParseScheme(t, "http://google.com/foo?bar#baz", "http", "google.com", "/foo?bar", "baz")
+	testURIParseScheme(t, "HTtP://google.com/", "http", "google.com", "/", "")
+	testURIParseScheme(t, "://google.com/xyz", "http", "google.com", "/xyz", "")
+	testURIParseScheme(t, "//google.com/foobar", "http", "google.com", "/foobar", "")
+	testURIParseScheme(t, "fTP://aaa.com", "ftp", "aaa.com", "/", "")
+	testURIParseScheme(t, "httPS://aaa.com", "https", "aaa.com", "/", "")
 
 	// missing slash after hostname
-	testURIParseScheme(t, "http://foobar.com?baz=111", "http", "foobar.com", "/?baz=111")
+	testURIParseScheme(t, "http://foobar.com?baz=111", "http", "foobar.com", "/?baz=111", "")
 }
 
-func testURIParseScheme(t *testing.T, uri, expectedScheme, expectedHost, expectedRequestURI string) {
+func testURIParseScheme(t *testing.T, uri, expectedScheme, expectedHost, expectedRequestURI, expectedHash string) {
 	var u URI
 	u.Parse(nil, []byte(uri))
 	if string(u.Scheme()) != expectedScheme {
@@ -297,6 +297,9 @@ func testURIParseScheme(t *testing.T, uri, expectedScheme, expectedHost, expecte
 	if string(u.RequestURI()) != expectedRequestURI {
 		t.Fatalf("Unexepcted requestURI %q. Expecting %q for uri %q", u.RequestURI(), expectedRequestURI, uri)
 	}
+	if string(u.hash) != expectedHash {
+		t.Fatalf("Unexepcted hash %q. Expecting %q for uri %q", u.hash, expectedHash, uri)
+	}
 }
 
 func TestURIParse(t *testing.T) {