Skip to content

net/http: use consistent IDNA processing for dial target and Host header - #80446

Open
kingljl wants to merge 5 commits into
golang:masterfrom
kingljl:fix-net-http-client-dials--iDNA
Open

net/http: use consistent IDNA processing for dial target and Host header#80446
kingljl wants to merge 5 commits into
golang:masterfrom
kingljl:fix-net-http-client-dials--iDNA

Conversation

@kingljl

@kingljl kingljl commented Jul 17, 2026

Copy link
Copy Markdown

Changes:

  • src/net/http/request.go: add idnaASCIIHostPort and use it for the HTTP/1
    Host header instead of httpguts.PunycodeHostPort.
  • src/net/http/internal/httpcommon/httpcommon.go: use idnaASCIIHostPort
    for the HTTP/2 :authority in EncodeHeaders (bundled copy).
  • src/vendor/golang.org/x/net/internal/httpcommon/request.go: same change
    in the vendored source of the bundle (see net/http: use consistent IDNA processing for dial target and Host header net#253).
  • src/net/http/internal/http2/transport.go: map authorityAddr with
    idna.Lookup.ToASCII so the h2 connection-pool key matches the dial and
    header.
  • src/net/http/transport_test.go: add TestTransportIDNAMapping covering
    HTTP/1 and HTTP/2.

For golang/net#253
Fixes #80417

kingljl added 5 commits July 17, 2026 14:42
Add IDNA ASCII processing for host in HTTP requests.
Add test for IDNA mapping in Transport layer
Updated IDNA processing to use idna.Lookup.ToASCII for host conversion, ensuring consistency with net/http.
Added IDNA processing for host strings to ensure consistency with the :authority header and prevent SSRF bypass.
Add IDNA processing for host in request headers to ensure consistency with dialed address, addressing potential SSRF filter bypass.

A temporary commit has been made to make the function operational, and a pull request (PR) for the net library has already been submitted
@gopherbot

Copy link
Copy Markdown
Contributor

This PR (HEAD: 7f0bd51) has been imported to Gerrit for code review.

Please visit Gerrit at https://go-review.googlesource.com/c/go/+/802080.

Important tips:

  • Don't comment on this PR. All discussion takes place in Gerrit.
  • You need a Gmail or other Google account to log in to Gerrit.
  • To change your code in response to feedback:
    • Push a new commit to the branch used by your GitHub PR.
    • A new "patch set" will then appear in Gerrit.
    • Respond to each comment by marking as Done in Gerrit if implemented as suggested. You can alternatively write a reply.
    • Critical: you must click the blue Reply button near the top to publish your Gerrit responses.
    • Multiple commits in the PR will be squashed by GerritBot.
  • The title and description of the GitHub PR are used to construct the final commit message.
    • Edit these as needed via the GitHub web interface (not via Gerrit or git).
    • You should word wrap the PR description at ~76 characters unless you need longer lines (e.g., for tables or URLs).
  • See the Sending a change via GitHub and Reviews sections of the Contribution Guide as well as the FAQ for details.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

net/http: Client dials an IDNA-mapped host differing from url.Hostname() and Host header

2 participants