<p dir="auto">Request parsing does not verify validity of Host header, in particular it can contain spaces.<br>
This leads to weird possibilities like:</p>
<div class="highlight highlight-source-go notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="package main

import (
    &quot;bufio&quot;
    &quot;bytes&quot;
    &quot;os&quot;
    &quot;net/http&quot;
)

func main() {
    data := []byte(&quot;GET http:/1.1 HTTP/1.1\nHost: host.com/somethingelse HTTP\n\n&quot;)
    r, err := http.ReadRequest(bufio.NewReader(bytes.NewReader(data)))
    if err != nil {
        panic(err)
    }
    r.WriteProxy(os.Stdout)
}"><pre class="notranslate"><span class="pl-k">package</span> main

<span class="pl-k">import</span> (
    <span class="pl-s">"bufio"</span>
    <span class="pl-s">"bytes"</span>
    <span class="pl-s">"os"</span>
    <span class="pl-s">"net/http"</span>
)

<span class="pl-k">func</span> <span class="pl-en">main</span>() {
    <span class="pl-s1">data</span> <span class="pl-c1">:=</span> []<span class="pl-smi">byte</span>(<span class="pl-s">"GET http:/1.1 HTTP/1.1<span class="pl-cce">\n</span>Host: host.com/somethingelse HTTP<span class="pl-cce">\n</span><span class="pl-cce">\n</span>"</span>)
    <span class="pl-s1">r</span>, <span class="pl-s1">err</span> <span class="pl-c1">:=</span> <span class="pl-s1">http</span>.<span class="pl-en">ReadRequest</span>(<span class="pl-s1">bufio</span>.<span class="pl-en">NewReader</span>(<span class="pl-s1">bytes</span>.<span class="pl-en">NewReader</span>(<span class="pl-s1">data</span>)))
    <span class="pl-k">if</span> <span class="pl-s1">err</span> <span class="pl-c1">!=</span> <span class="pl-c1">nil</span> {
        <span class="pl-en">panic</span>(<span class="pl-s1">err</span>)
    }
    <span class="pl-s1">r</span>.<span class="pl-en">WriteProxy</span>(<span class="pl-s1">os</span>.<span class="pl-c1">Stdout</span>)
}</pre></div>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="GET http://host.com/somethingelse HTTP/1.1 HTTP/1.1
Host: host.com/somethingelse HTTP
User-Agent: Go 1.1 package http"><pre class="notranslate"><code class="notranslate">GET http://host.com/somethingelse HTTP/1.1 HTTP/1.1
Host: host.com/somethingelse HTTP
User-Agent: Go 1.1 package http
</code></pre></div>
<p dir="auto">which I guess can trick some other HTTP implementation.</p>
<p dir="auto">go version devel +a1fe3b5 Sat Jun 13 04:33:26 2015 +0000 linux/amd64</p>
<p dir="auto">by <strong><a href="mailto:mail@ungerik.net">mail@ungerik.net</a></strong>:</p>
<pre class="notranslate">Package net returns an internal error var when a connection was closed:

var errClosing = errors.New("use of closed network connection")

To check for that error, currently the error text has to be parsed. It would be much
better be able to check for a defined error type.</pre>