bugfix: fix failure of net/http unit test

0114-release-branch.go1.21-html-template-escape-additiona.patch

@@ -1,13 +1,22 @@
-From 6bf8cd883445c302836728eac62926bf14aa6c2b Mon Sep 17 00:00:00 2001
+From e7b9308c2106900310bbaeef1ddd948e845054e1 Mon Sep 17 00:00:00 2001
 From: Roland Shoemaker <roland@golang.org>
-Date: Wed, 14 Feb 2024 17:18:36 -0800
+Date: Thu, 15 Feb 2024 09:18:36 +0800
-Subject: [PATCH 2/4] [release-branch.go1.21] html/template: escape additional
+Subject: [PATCH 4/4] [Backport] html/template: escape additional tokens in
- tokens in MarshalJSON errors
+ MarshalJSON errors
+
+Offering: Cloud Core Network
+CVE: CVE-2024-24785
+Reference: https://go-review.googlesource.com/c/go/+/567515
 
 Escape "</script" and "<!--" in errors returned from MarshalJSON errors
 when attempting to marshal types in script blocks. This prevents any
 user controlled content from prematurely terminating the script block.
 
+Note: The upstream does not submit this change to go1.16 according to the rules of MinorReleases.
+Corego2.x are based on go1.16.5. Therefore, it need to submit the change to corego2.x.
+
+Edited-by: machangwang m00509938
+
 Updates #65697
 Fixes #65968
 
@@ -18,13 +27,14 @@ Reviewed-by: Damien Neil <dneil@google.com>
 (cherry picked from commit ccbc725f2d678255df1bd326fa511a492aa3a0aa)
 Reviewed-on: https://go-review.googlesource.com/c/go/+/567515
 Reviewed-by: Carlos Amedee <carlos@golang.org>
+Signed-off-by: Ma Chang Wang machangwang@huawei.com
 ---
  src/html/template/js.go      | 22 ++++++++-
  src/html/template/js_test.go | 96 ++++++++++++++++++++----------------
  2 files changed, 74 insertions(+), 44 deletions(-)
 
 diff --git a/src/html/template/js.go b/src/html/template/js.go
-index 35994f076eb..4d3b25d088c 100644
+index 35994f076e..4d3b25d088 100644
 --- a/src/html/template/js.go
 +++ b/src/html/template/js.go
 @@ -171,13 +171,31 @@ func jsValEscaper(args ...interface{}) string {
@@ -62,7 +72,7 @@ index 35994f076eb..4d3b25d088c 100644
  
  	// TODO: maybe post-process output to prevent it from containing
 diff --git a/src/html/template/js_test.go b/src/html/template/js_test.go
-index de9ef284106..0ad7b49d646 100644
+index de9ef28410..26d6dcd92c 100644
 --- a/src/html/template/js_test.go
 +++ b/src/html/template/js_test.go
 @@ -6,6 +6,7 @@ package template
@@ -87,7 +97,7 @@ index de9ef284106..0ad7b49d646 100644
  	tests := []struct {
 -		x  interface{}
 -		js string
-+		x        any
++		x        interface{}
 +		js       string
 +		skipNest bool
  	}{
@@ -165,8 +175,8 @@ index de9ef284106..0ad7b49d646 100644
 -		{nil, " null "},
 +		{"\t\x0b", `"\t\u000b"`, false},
 +		{struct{ X, Y int }{1, 2}, `{"X":1,"Y":2}`, false},
-+		{[]any{}, "[]", false},
++		{[]interface{}{}, "[]", false},
-+		{[]any{42, "foo", nil}, `[42,"foo",null]`, false},
++		{[]interface{}{42, "foo", nil}, `[42,"foo",null]`, false},
 +		{[]string{"<!--", "</script>", "-->"}, `["\u003c!--","\u003c/script\u003e","--\u003e"]`, false},
 +		{"<!--", `"\u003c!--"`, false},
 +		{"-->", `"--\u003e"`, false},

0115-net-textproto-mime-multipart-avoid-unbounded-read-in.patch

@@ -1,8 +1,12 @@
-From 7d40949db8a4b2d5cd294dc76b80f2a0c1c47db0 Mon Sep 17 00:00:00 2001
+From ad350209f937e05451e46bf55ca8a13f4b24e58e Mon Sep 17 00:00:00 2001
 From: Damien Neil <dneil@google.com>
 Date: Tue, 16 Jan 2024 15:37:52 -0800
-Subject: [PATCH 3/4] net/textproto, mime/multipart: avoid unbounded read in
+Subject: [PATCH 1/4] [Backport] net/textproto, mime/multipart: avoid unbounded
- MIME header
+ read in MIME header
+
+Offering: Cloud Core Network
+CVE: CVE-2023-45290
+Reference: https://go-review.googlesource.com/c/go/+/569341
 
 mime/multipart.Reader.ReadForm allows specifying the maximum amount
 of memory that will be consumed by the form. While this limit is
@@ -15,6 +19,11 @@ runs out of memory.
 
 Limit the amount of data consumed when reading a header.
 
+Note: The upstream does not submit this change to go1.16 according to the rules of MinorReleases.
+Corego2.x are based on go1.16.5. Therefore, it need to submit the change to corego2.x.
+
+Edited-by: zhaoshengwei z00581105
+
 Fixes CVE-2023-45290
 Fixes #65383
 
@@ -27,6 +36,7 @@ Reviewed-by: Carlos Amedee <carlos@golang.org>
 Reviewed-by: Damien Neil <dneil@google.com>
 Auto-Submit: Michael Knyszek <mknyszek@google.com>
 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
+Signed-off-by: Zhao Sheng Wei zhaoshengwei@huawei.com
 ---
  src/mime/multipart/formdata_test.go | 42 +++++++++++++++++++++++++
  src/net/textproto/reader.go         | 48 ++++++++++++++++++++---------
@@ -34,7 +44,7 @@ LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceacc
  3 files changed, 87 insertions(+), 15 deletions(-)
 
 diff --git a/src/mime/multipart/formdata_test.go b/src/mime/multipart/formdata_test.go
-index 24de7b89563..1eb301be641 100644
+index 24de7b8956..1eb301be64 100644
 --- a/src/mime/multipart/formdata_test.go
 +++ b/src/mime/multipart/formdata_test.go
 @@ -407,6 +407,48 @@ func TestReadFormLimits(t *testing.T) {
@@ -87,7 +97,7 @@ index 24de7b89563..1eb301be641 100644
  	for _, test := range []struct {
  		name string
 diff --git a/src/net/textproto/reader.go b/src/net/textproto/reader.go
-index d80f378801d..b377a7ce5d9 100644
+index d80f378801..b377a7ce5d 100644
 --- a/src/net/textproto/reader.go
 +++ b/src/net/textproto/reader.go
 @@ -17,6 +17,10 @@ import (
@@ -238,7 +248,7 @@ index d80f378801d..b377a7ce5d9 100644
  		if vv == nil && len(strs) > 0 {
  			// More than likely this will be a single-element key.
 diff --git a/src/net/textproto/reader_test.go b/src/net/textproto/reader_test.go
-index 3ae0de13530..db1ed91bd51 100644
+index 3ae0de1353..db1ed91bd5 100644
 --- a/src/net/textproto/reader_test.go
 +++ b/src/net/textproto/reader_test.go
 @@ -34,6 +34,18 @@ func TestReadLine(t *testing.T) {

0116-release-branch.go1.21-net-http-net-http-cookiejar-av.patch

@@ -1,8 +1,12 @@
-From 80b1721f76672451256fd5e1ad508d185cfd74ef Mon Sep 17 00:00:00 2001
+From eccb945d92ba5e7f88c6f4f0e810862588ebd688 Mon Sep 17 00:00:00 2001
-From: Damien Neil <dneil@google.com>
+From: Gustavo Falco <comfortablynumb84@gmail.com>
-Date: Thu, 11 Jan 2024 11:31:57 -0800
+Date: Sun, 11 Dec 2022 02:39:20 +0000
-Subject: [PATCH 4/4] [release-branch.go1.21] net/http, net/http/cookiejar:
+Subject: [PATCH 2/4] [Backport] net/http, net/http/cookiejar: avoid subdomain
- avoid subdomain matches on IPv6 zones
+ matches on IPv6 zones
+
+Offering: Cloud Core Network
+CVE: CVE-2023-45289
+Reference: https://go-review.googlesource.com/c/go/+/569340
 
 When deciding whether to forward cookies or sensitive headers
 across a redirect, do not attempt to interpret an IPv6 address
@@ -16,31 +20,71 @@ of "www.example.com".
 
 Thanks to Juho Nurminen of Mattermost for reporting this issue.
 
+Note: The upstream does not submit this change to go1.16 according to the rules of MinorReleases.
+Corego2.x are based on go1.16.5. Therefore, it need to submit the change to corego2.x.
+
+Edited-by: zhaoshengwei z00581105
+
 Fixes CVE-2023-45289
-Fixes #65385
+Fixes #65065
-For #65065
 
 Change-Id: I8f463f59f0e700c8a18733d2b264a8bcb3a19599
 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2131938
 Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
 Reviewed-by: Roland Shoemaker <bracewell@google.com>
-Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2173775
+Reviewed-on: https://go-review.googlesource.com/c/go/+/569340
-Reviewed-by: Carlos Amedee <amedee@google.com>
+Reviewed-by: Damien Neil <dneil@google.com>
-Reviewed-on: https://go-review.googlesource.com/c/go/+/569239
+LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
 Reviewed-by: Carlos Amedee <carlos@golang.org>
 Auto-Submit: Michael Knyszek <mknyszek@google.com>
-TryBot-Bypass: Michael Knyszek <mknyszek@google.com>
+Signed-off-by: Zhao Sheng Wei zhaoshengwei@huawei.com
+
+[Backport] net/http: keep sensitive headers on redirects to the same host
+
+Offering: Cloud Core Network
+Reference: https://go-review.googlesource.com/c/go/+/424935
+
+Preserve sensitive headers on a redirect to a different port of the same host.
+
+Note: The upstream does not submit this change to go1.16 according to the rules of MinorReleases.
+Corego2.x are based on go1.16.5. Therefore, it need to submit the change to corego2.x.
+
+Edited-by: zhaoshengwei z00581105
+
+Fixes #35104
+
+Change-Id: I5ab57c414ce92a70e688ee684b9ff02fb062b3c6
+GitHub-Last-Rev: 8d53e71e2243c141d70d27a503d0f7e6dee64c3c
+GitHub-Pull-Request: golang/go#54539
+Reviewed-on: https://go-review.googlesource.com/c/go/+/424935
+TryBot-Result: Gopher Robot <gobot@golang.org>
+Reviewed-by: Cherry Mui <cherryyz@google.com>
+Reviewed-by: Damien Neil <dneil@google.com>
+Run-TryBot: Damien Neil <dneil@google.com>
+Signed-off-by: Zhao Sheng Wei zhaoshengwei@huawei.com
 ---
- src/net/http/client.go             |  6 ++++++
+ src/net/http/client.go             | 10 ++++++++--
- src/net/http/client_test.go        |  1 +
+ src/net/http/client_test.go        | 30 +++++++++++++++++++++++++-----
  src/net/http/cookiejar/jar.go      |  7 +++++++
  src/net/http/cookiejar/jar_test.go | 10 ++++++++++
- 4 files changed, 24 insertions(+)
+ src/net/http/transport.go          | 10 +++++++---
+ 5 files changed, 57 insertions(+), 10 deletions(-)
 
 diff --git a/src/net/http/client.go b/src/net/http/client.go
-index 3860d97d8f4..54866fe5d6c 100644
+index 3860d97d8f..5f24bfce7a 100644
 --- a/src/net/http/client.go
 +++ b/src/net/http/client.go
+@@ -976,8 +976,8 @@ func shouldCopyHeaderOnRedirect(headerKey string, initial, dest *url.URL) bool {
+ 		// directly, we don't know their scope, so we assume
+ 		// it's for *.domain.com.
+ 
+-		ihost := canonicalAddr(initial)
+-		dhost := canonicalAddr(dest)
++		ihost := idnaASCIIFromURL(initial)
++		dhost := idnaASCIIFromURL(dest)
+ 		return isDomainOrSubdomain(dhost, ihost)
+ 	}
+ 	// All other headers are copied:
 @@ -992,6 +992,12 @@ func isDomainOrSubdomain(sub, parent string) bool {
  	if sub == parent {
  		return true
@@ -55,19 +99,79 @@ index 3860d97d8f4..54866fe5d6c 100644
  	// that means sub must end in "."+parent.
  	// Do it without allocating.
 diff --git a/src/net/http/client_test.go b/src/net/http/client_test.go
-index 80807fae7a4..b4698eee082 100644
+index 80807fae7a..ce476d1a34 100644
 --- a/src/net/http/client_test.go
 +++ b/src/net/http/client_test.go
-@@ -1703,6 +1703,7 @@ func TestShouldCopyHeaderOnRedirect(t *testing.T) {
+@@ -1466,6 +1466,9 @@ func TestClientRedirectResponseWithoutRequest(t *testing.T) {
+ }
+ 
+ // Issue 4800: copy (some) headers when Client follows a redirect.
++// Issue 35104: Since both URLs have the same host (localhost)
++// but different ports, sensitive headers like Cookie and Authorization
++// are preserved.
+ func TestClientCopyHeadersOnRedirect(t *testing.T) {
+ 	const (
+ 		ua   = "some-agent/1.2"
+@@ -1478,6 +1481,8 @@ func TestClientCopyHeadersOnRedirect(t *testing.T) {
+ 			"X-Foo":           []string{xfoo},
+ 			"Referer":         []string{ts2URL},
+ 			"Accept-Encoding": []string{"gzip"},
++			"Cookie":          []string{"foo=bar"},
++			"Authorization":   []string{"secretpassword"},
+ 		}
+ 		if !reflect.DeepEqual(r.Header, want) {
+ 			t.Errorf("Request.Header = %#v; want %#v", r.Header, want)
+@@ -1498,9 +1503,11 @@ func TestClientCopyHeadersOnRedirect(t *testing.T) {
+ 	c := ts1.Client()
+ 	c.CheckRedirect = func(r *Request, via []*Request) error {
+ 		want := Header{
+-			"User-Agent": []string{ua},
+-			"X-Foo":      []string{xfoo},
+-			"Referer":    []string{ts2URL},
++			"User-Agent":    []string{ua},
++			"X-Foo":         []string{xfoo},
++			"Referer":       []string{ts2URL},
++			"Cookie":        []string{"foo=bar"},
++			"Authorization": []string{"secretpassword"},
+ 		}
+ 		if !reflect.DeepEqual(r.Header, want) {
+ 			t.Errorf("CheckRedirect Request.Header = %#v; want %#v", r.Header, want)
+@@ -1702,18 +1709,31 @@ func TestShouldCopyHeaderOnRedirect(t *testing.T) {
+ 		{"cookie", "http://foo.com/", "http://bar.com/", false},
  		{"cookie2", "http://foo.com/", "http://bar.com/", false},
  		{"authorization", "http://foo.com/", "http://bar.com/", false},
++		{"authorization", "http://foo.com/", "https://foo.com/", true},
++		{"authorization", "http://foo.com:1234/", "http://foo.com:4321/", true},
  		{"www-authenticate", "http://foo.com/", "http://bar.com/", false},
 +		{"authorization", "http://foo.com/", "http://[::1%25.foo.com]/", false},
  
  		// But subdomains should work:
  		{"www-authenticate", "http://foo.com/", "http://foo.com/", true},
+ 		{"www-authenticate", "http://foo.com/", "http://sub.foo.com/", true},
+ 		{"www-authenticate", "http://foo.com/", "http://notfoo.com/", false},
+-		{"www-authenticate", "http://foo.com/", "https://foo.com/", false},
++		{"www-authenticate", "http://foo.com/", "https://foo.com/", true},
+ 		{"www-authenticate", "http://foo.com:80/", "http://foo.com/", true},
+ 		{"www-authenticate", "http://foo.com:80/", "http://sub.foo.com/", true},
+ 		{"www-authenticate", "http://foo.com:443/", "https://foo.com/", true},
+ 		{"www-authenticate", "http://foo.com:443/", "https://sub.foo.com/", true},
+-		{"www-authenticate", "http://foo.com:1234/", "http://foo.com/", false},
++		{"www-authenticate", "http://foo.com:1234/", "http://foo.com/", true},
++
++		{"authorization", "http://foo.com/", "http://foo.com/", true},
++		{"authorization", "http://foo.com/", "http://sub.foo.com/", true},
++		{"authorization", "http://foo.com/", "http://notfoo.com/", false},
++		{"authorization", "http://foo.com/", "https://foo.com/", true},
++		{"authorization", "http://foo.com:80/", "http://foo.com/", true},
++		{"authorization", "http://foo.com:80/", "http://sub.foo.com/", true},
++		{"authorization", "http://foo.com:443/", "https://foo.com/", true},
++		{"authorization", "http://foo.com:443/", "https://sub.foo.com/", true},
++		{"authorization", "http://foo.com:1234/", "http://foo.com/", true},
+ 	}
+ 	for i, tt := range tests {
+ 		u0, err := url.Parse(tt.initialURL)
 diff --git a/src/net/http/cookiejar/jar.go b/src/net/http/cookiejar/jar.go
-index 9f199170847..18cbfc272d7 100644
+index 9f19917084..18cbfc272d 100644
 --- a/src/net/http/cookiejar/jar.go
 +++ b/src/net/http/cookiejar/jar.go
 @@ -356,6 +356,13 @@ func jarKey(host string, psl PublicSuffixList) string {
@@ -85,7 +189,7 @@ index 9f199170847..18cbfc272d7 100644
  }
  
 diff --git a/src/net/http/cookiejar/jar_test.go b/src/net/http/cookiejar/jar_test.go
-index 47fb1abdaaf..fd8d40ed1b9 100644
+index 47fb1abdaa..fd8d40ed1b 100644
 --- a/src/net/http/cookiejar/jar_test.go
 +++ b/src/net/http/cookiejar/jar_test.go
 @@ -251,6 +251,7 @@ var isIPTests = map[string]bool{
@@ -112,6 +216,35 @@ index 47fb1abdaaf..fd8d40ed1b9 100644
  }
  
  func TestBasics(t *testing.T) {
+diff --git a/src/net/http/transport.go b/src/net/http/transport.go
+index 88d15a5919..e48026b7be 100644
+--- a/src/net/http/transport.go
++++ b/src/net/http/transport.go
+@@ -2678,17 +2678,21 @@ var portMap = map[string]string{
+ 	"socks5": "1080",
+ }
+ 
+-// canonicalAddr returns url.Host but always with a ":port" suffix
+-func canonicalAddr(url *url.URL) string {
++func idnaASCIIFromURL(url *url.URL) string {
+ 	addr := url.Hostname()
+ 	if v, err := idnaASCII(addr); err == nil {
+ 		addr = v
+ 	}
++	return addr
++}
++
++// canonicalAddr returns url.Host but always with a ":port" suffix.
++func canonicalAddr(url *url.URL) string {
+ 	port := url.Port()
+ 	if port == "" {
+ 		port = portMap[url.Scheme]
+ 	}
+-	return net.JoinHostPort(addr, port)
++	return net.JoinHostPort(idnaASCIIFromURL(url), port)
+ }
+ 
+ // bodyEOFSignal is used by the HTTP/1 transport when reading response
 -- 
 2.33.0
 

golang.spec

@@ -58,7 +58,7 @@
 
 Name:           golang
 Version:        1.15.7
-Release:        39
+Release:        40
 Summary:        The Go Programming Language
 License:        BSD and Public Domain
 URL:            https://golang.org/
@@ -497,6 +497,12 @@ fi
 %files devel -f go-tests.list -f go-misc.list -f go-src.list
 
 %changelog
+* Thu Mar 28 2024 hanchao <hanchao63@huawei.com> - 1.15.7-40
+- Type:bugfix
+- CVE:
+- SUG:NA
+- DESC:fix failure of net/http unit test
+
 * Fri Mar 15 2024 hanchao <hanchao63@huawei.com> - 1.15.7-39
 - Type:CVE
 - CVE:CVE-2024-24783,CVE-2024-24785,CVE-2023-45290,CVE-2023-45289