net/http: allows empty header names

[Dmitry Vyukov]

The following program:

package main

import (
    "bufio"
    "bytes"
    "fmt"
    "net/http"
)

func main() {
    data := []byte("GET / HTTP/0.0\n:v\n\n")
    r, err := http.ReadRequest(bufio.NewReader(bytes.NewReader(data)))
    if err != nil {
        return
    }
    fmt.Printf("%q\n", r.Header.Get(""))
}

prints:

"v"

As per RFC 7230 field-name is a token, tokens consist of one or more chars.

go version devel +a1fe3b5 Sat Jun 13 04:33:26 2015 +0000 linux/amd64

[GopherBot]

CL https://golang.org/cl/11242 mentions this issue.