helpers.go 30 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126
  1. // ⚡️ Fiber is an Express inspired web framework written in Go with ☕️
  2. // 🤖 GitHub Repository: https://github.com/gofiber/fiber
  3. // 📌 API Documentation: https://docs.gofiber.io
  4. package fiber
  5. import (
  6. "bytes"
  7. "context"
  8. "crypto/tls"
  9. "errors"
  10. "fmt"
  11. "io"
  12. "net"
  13. "os"
  14. "path/filepath"
  15. "reflect"
  16. "slices"
  17. "strconv"
  18. "strings"
  19. "sync"
  20. "time"
  21. "unsafe"
  22. "github.com/gofiber/utils/v2"
  23. utilsbytes "github.com/gofiber/utils/v2/bytes"
  24. "github.com/gofiber/fiber/v3/log"
  25. "github.com/valyala/bytebufferpool"
  26. "github.com/valyala/fasthttp"
  27. )
  28. // acceptedType is a struct that holds the parsed value of an Accept header
  29. // along with quality, specificity, parameters, and order.
  30. // Used for sorting accept headers.
  31. type acceptedType struct {
  32. params headerParams
  33. spec string
  34. quality float64
  35. specificity int
  36. order int
  37. }
  38. const noCacheValue = "no-cache"
  39. // Pre-allocated byte slices for accept header parsing
  40. var (
  41. semicolonQEquals = []byte(";q=")
  42. wildcardAll = []byte("*/*")
  43. wildcardSuffix = []byte("/*")
  44. )
  45. type headerParams map[string][]byte
  46. // ValueFromContext retrieves a value stored under key from supported context types.
  47. //
  48. // Supported context types:
  49. // - Ctx (including CustomCtx implementations)
  50. // - *fasthttp.RequestCtx
  51. // - context.Context
  52. func ValueFromContext[T any](ctx, key any) (T, bool) {
  53. switch typed := ctx.(type) {
  54. case Ctx:
  55. val, ok := typed.Locals(key).(T)
  56. return val, ok
  57. case *fasthttp.RequestCtx:
  58. val, ok := typed.UserValue(key).(T)
  59. return val, ok
  60. case context.Context:
  61. val, ok := typed.Value(key).(T)
  62. return val, ok
  63. default:
  64. var zero T
  65. return zero, false
  66. }
  67. }
  68. // StoreInContext stores key/value in both Fiber locals and request context.
  69. //
  70. // This is useful when values need to be available via both c.Locals() and
  71. // context.Context lookups throughout middleware and handlers.
  72. func StoreInContext(c Ctx, key, value any) {
  73. c.Locals(key, value)
  74. if c.App().config.PassLocalsToContext {
  75. c.SetContext(context.WithValue(c.Context(), key, value))
  76. }
  77. }
  78. // getTLSConfig returns a net listener's tls config
  79. func getTLSConfig(ln net.Listener) *tls.Config {
  80. if ln == nil {
  81. return nil
  82. }
  83. type tlsConfigProvider interface {
  84. TLSConfig() *tls.Config
  85. }
  86. type configProvider interface {
  87. Config() *tls.Config
  88. }
  89. if provider, ok := ln.(tlsConfigProvider); ok {
  90. return provider.TLSConfig()
  91. }
  92. if provider, ok := ln.(configProvider); ok {
  93. return provider.Config()
  94. }
  95. pointer := reflect.ValueOf(ln)
  96. if !pointer.IsValid() {
  97. return nil
  98. }
  99. // Reflection fallback for listeners that do not expose a TLS config method.
  100. val := reflect.Indirect(pointer)
  101. if !val.IsValid() {
  102. return nil
  103. }
  104. field := val.FieldByName("config")
  105. if !field.IsValid() {
  106. return nil
  107. }
  108. if field.Type() != reflect.TypeFor[*tls.Config]() {
  109. return nil
  110. }
  111. if field.CanInterface() {
  112. if cfg, ok := field.Interface().(*tls.Config); ok {
  113. return cfg
  114. }
  115. return nil
  116. }
  117. if !field.CanAddr() {
  118. return nil
  119. }
  120. value := reflect.NewAt(field.Type(), unsafe.Pointer(field.UnsafeAddr())).Elem() //nolint:gosec // Access to unexported field is required for listeners that don't expose TLS config methods.
  121. if !value.IsValid() {
  122. return nil
  123. }
  124. cfg, ok := value.Interface().(*tls.Config)
  125. if !ok {
  126. return nil
  127. }
  128. return cfg
  129. }
  130. // readContent opens a named file and read content from it
  131. func readContent(rf io.ReaderFrom, name string) (int64, error) {
  132. // Read file
  133. f, err := os.Open(filepath.Clean(name))
  134. if err != nil {
  135. return 0, fmt.Errorf("failed to open: %w", err)
  136. }
  137. defer func() {
  138. if err = f.Close(); err != nil {
  139. log.Errorf("Error closing file: %s", err)
  140. }
  141. }()
  142. n, readErr := rf.ReadFrom(f)
  143. if readErr != nil {
  144. return n, fmt.Errorf("failed to read: %w", readErr)
  145. }
  146. return n, nil
  147. }
  148. // quoteString escapes special characters using percent-encoding.
  149. // Non-ASCII bytes are encoded as well so the result is always ASCII.
  150. func (app *App) quoteString(raw string) string {
  151. bb := bytebufferpool.Get()
  152. quoted := app.toString(fasthttp.AppendQuotedArg(bb.B, app.toBytes(raw)))
  153. bytebufferpool.Put(bb)
  154. return quoted
  155. }
  156. // quoteRawString escapes only characters that need quoting according to
  157. // https://www.rfc-editor.org/rfc/rfc9110#section-5.6.4 so the result may
  158. // contain non-ASCII bytes.
  159. func (app *App) quoteRawString(raw string) string {
  160. const hex = "0123456789ABCDEF"
  161. bb := bytebufferpool.Get()
  162. defer bytebufferpool.Put(bb)
  163. for i := 0; i < len(raw); i++ {
  164. c := raw[i]
  165. switch {
  166. case c == '\\' || c == '"':
  167. // escape backslash and quote
  168. bb.B = append(bb.B, '\\', c)
  169. case c == '\n':
  170. bb.B = append(bb.B, '\\', 'n')
  171. case c == '\r':
  172. bb.B = append(bb.B, '\\', 'r')
  173. case c < 0x20 || c == 0x7f:
  174. // percent-encode control and DEL
  175. bb.B = append(bb.B,
  176. '%',
  177. hex[c>>4],
  178. hex[c&0x0f],
  179. )
  180. default:
  181. bb.B = append(bb.B, c)
  182. }
  183. }
  184. return app.toString(bb.B)
  185. }
  186. // isASCII reports whether the provided string contains only ASCII characters.
  187. // See: https://www.rfc-editor.org/rfc/rfc0020
  188. func (*App) isASCII(s string) bool {
  189. for i := 0; i < len(s); i++ {
  190. if s[i] > 127 {
  191. return false
  192. }
  193. }
  194. return true
  195. }
  196. // uniqueRouteStack drop all not unique routes from the slice
  197. func uniqueRouteStack(stack []*Route) []*Route {
  198. m := make(map[*Route]struct{}, len(stack))
  199. unique := make([]*Route, 0, len(stack))
  200. for _, v := range stack {
  201. if _, ok := m[v]; !ok {
  202. m[v] = struct{}{}
  203. unique = append(unique, v)
  204. }
  205. }
  206. return unique
  207. }
  208. // defaultString returns the value or a default value if it is set
  209. func defaultString(value string, defaultValue []string) string {
  210. if value == "" && len(defaultValue) > 0 {
  211. return defaultValue[0]
  212. }
  213. return value
  214. }
  215. func getGroupPath(prefix, path string) string {
  216. if path == "" {
  217. return prefix
  218. }
  219. if path[0] != '/' {
  220. path = "/" + path
  221. }
  222. return utils.TrimRight(prefix, '/') + path
  223. }
  224. // acceptsOffer determines if an offer matches a given specification.
  225. // It supports a trailing '*' wildcard and performs case-insensitive exact matching.
  226. // Returns true if the offer matches the specification, false otherwise.
  227. func acceptsOffer(spec, offer string, _ headerParams) bool {
  228. if len(spec) >= 1 && spec[len(spec)-1] == '*' {
  229. prefix := spec[:len(spec)-1]
  230. if len(offer) < len(prefix) {
  231. return false
  232. }
  233. return utils.EqualFold(prefix, offer[:len(prefix)])
  234. }
  235. return utils.EqualFold(spec, offer)
  236. }
  237. // acceptsLanguageOfferBasic determines if a language tag offer matches a range
  238. // according to RFC 4647 Basic Filtering.
  239. // A match occurs if the range exactly equals the tag or is a prefix of the tag
  240. // followed by a hyphen. The comparison is case-insensitive. Only a single "*"
  241. // as the entire range is allowed. Any "*" appearing after a hyphen renders the
  242. // range invalid and will not match.
  243. func acceptsLanguageOfferBasic(spec, offer string, _ headerParams) bool {
  244. if spec == "*" {
  245. return true
  246. }
  247. if strings.IndexByte(spec, '*') >= 0 {
  248. return false
  249. }
  250. if utils.EqualFold(spec, offer) {
  251. return true
  252. }
  253. return len(offer) > len(spec) &&
  254. utils.EqualFold(offer[:len(spec)], spec) &&
  255. offer[len(spec)] == '-'
  256. }
  257. // acceptsLanguageOfferExtended determines if a language tag offer matches a
  258. // range according to RFC 4647 Extended Filtering (§3.3.2).
  259. // - Case-insensitive comparisons
  260. // - '*' matches zero or more subtags (can "slide")
  261. // - Unspecified subtags are treated like '*' (so trailing/extraneous tag subtags are fine)
  262. // - Matching fails if sliding encounters a singleton (incl. 'x')
  263. func acceptsLanguageOfferExtended(spec, offer string, _ headerParams) bool {
  264. if spec == "*" {
  265. return true
  266. }
  267. if spec == "" || offer == "" {
  268. return false
  269. }
  270. // Use stack-allocated arrays to avoid heap allocations for typical language tags
  271. var rsBuf, tsBuf [8]string
  272. rs := rsBuf[:0]
  273. ts := tsBuf[:0]
  274. // Parse spec subtags without allocation for typical cases
  275. for s := range strings.SplitSeq(spec, "-") {
  276. rs = append(rs, s)
  277. }
  278. // Parse offer subtags without allocation for typical cases
  279. for s := range strings.SplitSeq(offer, "-") {
  280. ts = append(ts, s)
  281. }
  282. // Step 2: first subtag must match (or be '*')
  283. if rs[0] != "*" && !utils.EqualFold(rs[0], ts[0]) {
  284. return false
  285. }
  286. i, j := 1, 1 // i = range index, j = tag index
  287. for i < len(rs) {
  288. if rs[i] == "*" { // 3.A: '*' matches zero or more subtags
  289. i++
  290. continue
  291. }
  292. if j >= len(ts) { // 3.B: ran out of tag subtags
  293. return false
  294. }
  295. if utils.EqualFold(rs[i], ts[j]) { // 3.C: exact subtag match
  296. i++
  297. j++
  298. continue
  299. }
  300. // 3.D: singleton barrier (one letter or digit, incl. 'x')
  301. if len(ts[j]) == 1 {
  302. return false
  303. }
  304. // 3.E: slide forward in the tag and try again
  305. j++
  306. }
  307. // 4: matched all range subtags
  308. return true
  309. }
  310. // acceptsOfferType This function determines if an offer type matches a given specification.
  311. // It checks if the specification is equal to */* (i.e., all types are accepted).
  312. // It gets the MIME type of the offer (either from the offer itself or by its file extension).
  313. // It checks if the offer MIME type matches the specification MIME type or if the specification is of the form <MIME_type>/* and the offer MIME type has the same MIME type.
  314. // It checks if the offer contains every parameter present in the specification.
  315. // Returns true if the offer type matches the specification, false otherwise.
  316. func acceptsOfferType(spec, offerType string, specParams headerParams) bool {
  317. var offerMime, offerParams string
  318. if i := strings.IndexByte(offerType, ';'); i == -1 {
  319. offerMime = offerType
  320. } else {
  321. offerMime = offerType[:i]
  322. offerParams = offerType[i:]
  323. }
  324. // Accept: */*
  325. if spec == "*/*" {
  326. return paramsMatch(specParams, offerParams)
  327. }
  328. var mimetype string
  329. if strings.IndexByte(offerMime, '/') != -1 {
  330. mimetype = offerMime // MIME type
  331. } else {
  332. mimetype = utils.GetMIME(offerMime) // extension
  333. }
  334. if spec == mimetype {
  335. // Accept: <MIME_type>/<MIME_subtype>
  336. return paramsMatch(specParams, offerParams)
  337. }
  338. s := strings.IndexByte(mimetype, '/')
  339. specSlash := strings.IndexByte(spec, '/')
  340. // Accept: <MIME_type>/*
  341. if s != -1 && specSlash != -1 {
  342. if utils.EqualFold(spec[:specSlash], mimetype[:s]) && (spec[specSlash:] == "/*" || mimetype[s:] == "/*") {
  343. return paramsMatch(specParams, offerParams)
  344. }
  345. }
  346. return false
  347. }
  348. // paramsMatch returns whether offerParams contains all parameters present in specParams.
  349. // Matching is case-insensitive, and surrounding quotes are stripped.
  350. // To align with the behavior of res.format from Express, the order of parameters is
  351. // ignored, and if a parameter is specified twice in the incoming Accept, the last
  352. // provided value is given precedence.
  353. // In the case of quoted values, RFC 9110 says that we must treat any character escaped
  354. // by a backslash as equivalent to the character itself (e.g., "a\aa" is equivalent to "aaa").
  355. // For the sake of simplicity, we forgo this and compare the value as-is. Besides, it would
  356. // be highly unusual for a client to escape something other than a double quote or backslash.
  357. // See https://www.rfc-editor.org/rfc/rfc9110#name-parameters
  358. func paramsMatch(specParamStr headerParams, offerParams string) bool {
  359. if len(specParamStr) == 0 {
  360. return true
  361. }
  362. allSpecParamsMatch := true
  363. for specParam, specVal := range specParamStr {
  364. foundParam := false
  365. fasthttp.VisitHeaderParams(utils.UnsafeBytes(offerParams), func(key, value []byte) bool {
  366. if utils.EqualFold(specParam, utils.UnsafeString(key)) {
  367. foundParam = true
  368. unescaped, err := unescapeHeaderValue(value)
  369. if err != nil {
  370. allSpecParamsMatch = false
  371. return false
  372. }
  373. allSpecParamsMatch = utils.EqualFold(specVal, unescaped)
  374. return false
  375. }
  376. return true
  377. })
  378. if !foundParam || !allSpecParamsMatch {
  379. return false
  380. }
  381. }
  382. return allSpecParamsMatch
  383. }
  384. // getSplicedStrList function takes a string and a string slice as an argument, divides the string into different
  385. // elements divided by ',' and stores these elements in the string slice.
  386. // It returns the populated string slice as an output.
  387. //
  388. // If the given slice hasn't enough space, it will allocate more and return.
  389. func getSplicedStrList(headerValue string, dst []string) []string {
  390. if headerValue == "" {
  391. return nil
  392. }
  393. dst = dst[:0]
  394. segmentStart := 0
  395. for i := 0; i < len(headerValue); i++ {
  396. if headerValue[i] == ',' {
  397. dst = append(dst, utils.TrimSpace(headerValue[segmentStart:i]))
  398. segmentStart = i + 1
  399. }
  400. }
  401. dst = append(dst, utils.TrimSpace(headerValue[segmentStart:]))
  402. return dst
  403. }
  404. func joinHeaderValues(headers [][]byte) []byte {
  405. switch len(headers) {
  406. case 0:
  407. return nil
  408. case 1:
  409. return headers[0]
  410. default:
  411. return bytes.Join(headers, []byte{','})
  412. }
  413. }
  414. func unescapeHeaderValue(v []byte) ([]byte, error) {
  415. if bytes.IndexByte(v, '\\') == -1 {
  416. return v, nil
  417. }
  418. res := make([]byte, 0, len(v))
  419. escaping := false
  420. for i, c := range v {
  421. if escaping {
  422. res = append(res, c)
  423. escaping = false
  424. continue
  425. }
  426. if c == '\\' {
  427. // invalid escape at end of string
  428. if i == len(v)-1 {
  429. return nil, errInvalidEscapeSequence
  430. }
  431. escaping = true
  432. continue
  433. }
  434. res = append(res, c)
  435. }
  436. if escaping {
  437. return nil, errInvalidEscapeSequence
  438. }
  439. return res, nil
  440. }
  441. // forEachMediaRange parses an Accept or Content-Type header, calling functor
  442. // on each media range.
  443. // See: https://www.rfc-editor.org/rfc/rfc9110#name-content-negotiation-fields
  444. func forEachMediaRange(header []byte, functor func([]byte)) {
  445. hasDQuote := bytes.IndexByte(header, '"') != -1
  446. for len(header) > 0 {
  447. n := 0
  448. header = utils.TrimLeft(header, ' ')
  449. quotes := 0
  450. escaping := false
  451. if hasDQuote {
  452. // Complex case. We need to keep track of quotes and quoted-pairs (i.e., characters escaped with \ )
  453. loop:
  454. for n < len(header) {
  455. switch header[n] {
  456. case ',':
  457. if quotes%2 == 0 {
  458. break loop
  459. }
  460. case '"':
  461. if !escaping {
  462. quotes++
  463. }
  464. case '\\':
  465. if quotes%2 == 1 {
  466. escaping = !escaping
  467. }
  468. default:
  469. // all other characters are ignored
  470. }
  471. n++
  472. }
  473. } else {
  474. // Simple case. Just look for the next comma.
  475. if n = bytes.IndexByte(header, ','); n == -1 {
  476. n = len(header)
  477. }
  478. }
  479. functor(header[:n])
  480. if n >= len(header) {
  481. return
  482. }
  483. header = header[n+1:]
  484. }
  485. }
  486. // Pool for headerParams instances. The headerParams object *must*
  487. // be cleared before being returned to the pool.
  488. var headerParamPool = sync.Pool{
  489. New: func() any {
  490. return make(headerParams)
  491. },
  492. }
  493. // getOffer return valid offer for header negotiation.
  494. func getOffer(header []byte, isAccepted func(spec, offer string, specParams headerParams) bool, offers ...string) string {
  495. if len(offers) == 0 {
  496. return ""
  497. }
  498. if len(header) == 0 {
  499. return offers[0]
  500. }
  501. acceptedTypes := make([]acceptedType, 0, 8)
  502. order := 0
  503. // Parse header and get accepted types with their quality and specificity
  504. // See: https://www.rfc-editor.org/rfc/rfc9110#name-content-negotiation-fields
  505. forEachMediaRange(header, func(accept []byte) {
  506. order++
  507. spec, quality := accept, 1.0
  508. var params headerParams
  509. if i := bytes.IndexByte(accept, ';'); i != -1 {
  510. spec = accept[:i]
  511. // Optimized quality parsing
  512. qIndex := i + 3
  513. if bytes.HasPrefix(accept[i:], semicolonQEquals) && bytes.IndexByte(accept[qIndex:], ';') == -1 {
  514. if q, err := fasthttp.ParseUfloat(accept[qIndex:]); err == nil {
  515. quality = q
  516. }
  517. } else {
  518. params, _ = headerParamPool.Get().(headerParams) //nolint:errcheck // only contains headerParams
  519. for k := range params {
  520. delete(params, k)
  521. }
  522. fasthttp.VisitHeaderParams(accept[i:], func(key, value []byte) bool {
  523. if len(key) == 1 && key[0] == 'q' {
  524. if q, err := fasthttp.ParseUfloat(value); err == nil {
  525. quality = q
  526. }
  527. return false
  528. }
  529. lowerKey := utils.UnsafeString(utilsbytes.UnsafeToLower(key))
  530. val, err := unescapeHeaderValue(value)
  531. if err != nil {
  532. return true
  533. }
  534. params[lowerKey] = val
  535. return true
  536. })
  537. }
  538. // Skip this accept type if quality is 0.0
  539. // See: https://www.rfc-editor.org/rfc/rfc9110#quality.values
  540. if quality == 0.0 {
  541. return
  542. }
  543. }
  544. spec = utils.TrimSpace(spec)
  545. // Determine specificity
  546. var specificity int
  547. // check for wildcard this could be a mime */* or a wildcard character *
  548. switch {
  549. case len(spec) == 1 && spec[0] == '*':
  550. specificity = 1
  551. case bytes.Equal(spec, wildcardAll):
  552. specificity = 1
  553. case bytes.HasSuffix(spec, wildcardSuffix):
  554. specificity = 2
  555. case bytes.IndexByte(spec, '/') != -1:
  556. specificity = 3
  557. default:
  558. specificity = 4
  559. }
  560. // Add to accepted types
  561. acceptedTypes = append(acceptedTypes, acceptedType{
  562. spec: utils.UnsafeString(spec),
  563. quality: quality,
  564. specificity: specificity,
  565. order: order,
  566. params: params,
  567. })
  568. })
  569. if len(acceptedTypes) > 1 {
  570. // Sort accepted types by quality and specificity, preserving order of equal elements
  571. sortAcceptedTypes(acceptedTypes)
  572. }
  573. // Find the first offer that matches the accepted types
  574. for _, acceptedType := range acceptedTypes {
  575. for _, offer := range offers {
  576. if offer == "" {
  577. continue
  578. }
  579. if isAccepted(acceptedType.spec, offer, acceptedType.params) {
  580. if acceptedType.params != nil {
  581. headerParamPool.Put(acceptedType.params)
  582. }
  583. return offer
  584. }
  585. }
  586. if acceptedType.params != nil {
  587. headerParamPool.Put(acceptedType.params)
  588. }
  589. }
  590. return ""
  591. }
  592. // sortAcceptedTypes sorts accepted types by quality and specificity, preserving order of equal elements
  593. // A type with parameters has higher priority than an equivalent one without parameters.
  594. // e.g., text/html;a=1;b=2 comes before text/html;a=1
  595. // See: https://www.rfc-editor.org/rfc/rfc9110#name-content-negotiation-fields
  596. func sortAcceptedTypes(at []acceptedType) {
  597. for i := 1; i < len(at); i++ {
  598. lo, hi := 0, i-1
  599. for lo <= hi {
  600. mid := (lo + hi) / 2
  601. if at[i].quality < at[mid].quality ||
  602. (at[i].quality == at[mid].quality && at[i].specificity < at[mid].specificity) ||
  603. (at[i].quality == at[mid].quality && at[i].specificity == at[mid].specificity && len(at[i].params) < len(at[mid].params)) ||
  604. (at[i].quality == at[mid].quality && at[i].specificity == at[mid].specificity && len(at[i].params) == len(at[mid].params) && at[i].order > at[mid].order) {
  605. lo = mid + 1
  606. } else {
  607. hi = mid - 1
  608. }
  609. }
  610. for j := i; j > lo; j-- {
  611. at[j-1], at[j] = at[j], at[j-1]
  612. }
  613. }
  614. }
  615. // normalizeEtag validates an entity tag and returns the
  616. // value without quotes. weak is true if the tag has the "W/" prefix.
  617. func normalizeEtag(t string) (value string, weak, ok bool) { //nolint:nonamedreturns // gocritic unnamedResult requires naming the parsed ETag components
  618. weak = strings.HasPrefix(t, "W/")
  619. if weak {
  620. t = t[2:]
  621. }
  622. if len(t) < 2 || t[0] != '"' || t[len(t)-1] != '"' {
  623. return "", weak, false
  624. }
  625. return t[1 : len(t)-1], weak, true
  626. }
  627. // matchEtag performs a weak comparison of entity tags according to
  628. // RFC 9110 §8.8.3.2. The weak indicator ("W/") is ignored, but both tags must
  629. // be properly quoted. Invalid tags result in a mismatch.
  630. func matchEtag(s, etag string) bool {
  631. n1, _, ok1 := normalizeEtag(s)
  632. n2, _, ok2 := normalizeEtag(etag)
  633. if !ok1 || !ok2 {
  634. return false
  635. }
  636. return n1 == n2
  637. }
  638. // matchEtagStrong performs a strong entity-tag comparison following
  639. // RFC 9110 §8.8.3.1. A weak tag never matches a strong one, even if the quoted
  640. // values are identical.
  641. func matchEtagStrong(s, etag string) bool {
  642. n1, w1, ok1 := normalizeEtag(s)
  643. n2, w2, ok2 := normalizeEtag(etag)
  644. if !ok1 || !ok2 || w1 || w2 {
  645. return false
  646. }
  647. return n1 == n2
  648. }
  649. // isEtagStale reports whether a response with the given ETag would be considered
  650. // stale when presented with the raw If-None-Match header value. Comparison is
  651. // weak as defined by RFC 9110 §8.8.3.2.
  652. func (app *App) isEtagStale(etag string, noneMatchBytes []byte) bool {
  653. var start, end int
  654. header := utils.TrimSpace(app.toString(noneMatchBytes))
  655. // Short-circuit the wildcard case: "*" never counts as stale.
  656. if header == "*" {
  657. return false
  658. }
  659. // Adapted from:
  660. // https://github.com/jshttp/fresh/blob/master/index.js#L110
  661. for i := range noneMatchBytes {
  662. switch noneMatchBytes[i] {
  663. case 0x20:
  664. if start == end {
  665. start = i + 1
  666. end = i + 1
  667. }
  668. case 0x2c:
  669. if matchEtag(app.toString(noneMatchBytes[start:end]), etag) {
  670. return false
  671. }
  672. start = i + 1
  673. end = i + 1
  674. default:
  675. end = i + 1
  676. }
  677. }
  678. return !matchEtag(app.toString(noneMatchBytes[start:end]), etag)
  679. }
  680. func parseAddr(raw string) (host, port string) { //nolint:nonamedreturns // gocritic unnamedResult requires naming host and port parts for clarity
  681. if raw == "" {
  682. return "", ""
  683. }
  684. raw = utils.TrimSpace(raw)
  685. // Handle IPv6 addresses enclosed in brackets as defined by RFC 3986
  686. if strings.HasPrefix(raw, "[") {
  687. if end := strings.IndexByte(raw, ']'); end != -1 {
  688. host = raw[:end+1] // keep the closing ]
  689. if len(raw) > end+1 && raw[end+1] == ':' {
  690. return host, raw[end+2:]
  691. }
  692. return host, ""
  693. }
  694. }
  695. // Everything else with a colon
  696. if i := strings.LastIndexByte(raw, ':'); i != -1 {
  697. host, port = raw[:i], raw[i+1:]
  698. // If “host” still contains ':', we must have hit an un-bracketed IPv6
  699. // literal. In that form a port is impossible, so treat the whole thing
  700. // as host.
  701. if strings.IndexByte(host, ':') >= 0 {
  702. return raw, ""
  703. }
  704. return host, port
  705. }
  706. // No colon, nothing to split
  707. return raw, ""
  708. }
  709. // isNoCache checks if the cacheControl header value contains a `no-cache` directive.
  710. // Per RFC 9111 §5.2.2.4, no-cache can appear as either:
  711. // - "no-cache" (applies to entire response)
  712. // - "no-cache=field-name" (applies to specific header field)
  713. // Both forms indicate the response should not be served from cache without revalidation.
  714. func isNoCache(cacheControl string) bool {
  715. n := len(cacheControl)
  716. if n < len(noCacheValue) {
  717. return false
  718. }
  719. const noCacheLen = len(noCacheValue)
  720. const asciiCaseFold = byte(0x20)
  721. for i := 0; i <= n-noCacheLen; i++ {
  722. if (cacheControl[i] | asciiCaseFold) != 'n' {
  723. continue
  724. }
  725. if !matchNoCacheToken(cacheControl, i) {
  726. continue
  727. }
  728. if i > 0 && !isNoCacheDelimiter(cacheControl[i-1]) {
  729. continue
  730. }
  731. // Handle: "no-cache", "no-cache, ...", "no-cache=...", "no-cache ,"
  732. if i+noCacheLen == n {
  733. return true
  734. }
  735. if isNoCacheDelimiter(cacheControl[i+noCacheLen]) || cacheControl[i+noCacheLen] == '=' {
  736. return true
  737. }
  738. }
  739. return false
  740. }
  741. func isNoCacheDelimiter(c byte) bool {
  742. return c == ' ' || c == '\t' || c == ','
  743. }
  744. func matchNoCacheToken(s string, i int) bool {
  745. // ASCII-only case-insensitive compare for "no-cache".
  746. const asciiCaseFold = byte(0x20)
  747. b := s[i:]
  748. return (b[0]|asciiCaseFold) == 'n' &&
  749. (b[1]|asciiCaseFold) == 'o' &&
  750. b[2] == '-' &&
  751. (b[3]|asciiCaseFold) == 'c' &&
  752. (b[4]|asciiCaseFold) == 'a' &&
  753. (b[5]|asciiCaseFold) == 'c' &&
  754. (b[6]|asciiCaseFold) == 'h' &&
  755. (b[7]|asciiCaseFold) == 'e'
  756. }
  757. var errTestConnClosed = errors.New("testConn is closed")
  758. type testConn struct {
  759. r bytes.Buffer
  760. w bytes.Buffer
  761. isClosed bool
  762. sync.Mutex
  763. }
  764. // Read implements net.Conn by reading from the buffered input.
  765. func (c *testConn) Read(b []byte) (int, error) {
  766. c.Lock()
  767. defer c.Unlock()
  768. return c.r.Read(b) //nolint:wrapcheck // This must not be wrapped
  769. }
  770. // Write implements net.Conn by appending to the buffered output.
  771. func (c *testConn) Write(b []byte) (int, error) {
  772. c.Lock()
  773. defer c.Unlock()
  774. if c.isClosed {
  775. return 0, errTestConnClosed
  776. }
  777. return c.w.Write(b) //nolint:wrapcheck // This must not be wrapped
  778. }
  779. // Close marks the connection as closed and prevents further writes.
  780. func (c *testConn) Close() error {
  781. c.Lock()
  782. defer c.Unlock()
  783. c.isClosed = true
  784. return nil
  785. }
  786. // LocalAddr implements net.Conn and returns a placeholder address.
  787. func (*testConn) LocalAddr() net.Addr { return &net.TCPAddr{Port: 0, Zone: "", IP: net.IPv4zero} }
  788. // RemoteAddr implements net.Conn and returns a placeholder address.
  789. func (*testConn) RemoteAddr() net.Addr { return &net.TCPAddr{Port: 0, Zone: "", IP: net.IPv4zero} }
  790. // SetDeadline implements net.Conn but is a no-op for the in-memory connection.
  791. func (*testConn) SetDeadline(_ time.Time) error { return nil }
  792. // SetReadDeadline implements net.Conn but is a no-op for the in-memory connection.
  793. func (*testConn) SetReadDeadline(_ time.Time) error { return nil }
  794. // SetWriteDeadline implements net.Conn but is a no-op for the in-memory connection.
  795. func (*testConn) SetWriteDeadline(_ time.Time) error { return nil }
  796. func toStringImmutable(b []byte) string {
  797. return string(b)
  798. }
  799. func toBytesImmutable(s string) []byte {
  800. return []byte(s)
  801. }
  802. // HTTP methods and their unique INTs
  803. func (app *App) methodInt(s string) int {
  804. // For better performance
  805. if len(app.configured.RequestMethods) == 0 {
  806. switch s {
  807. case MethodGet:
  808. return methodGet
  809. case MethodHead:
  810. return methodHead
  811. case MethodPost:
  812. return methodPost
  813. case MethodPut:
  814. return methodPut
  815. case MethodDelete:
  816. return methodDelete
  817. case MethodConnect:
  818. return methodConnect
  819. case MethodOptions:
  820. return methodOptions
  821. case MethodTrace:
  822. return methodTrace
  823. case MethodPatch:
  824. return methodPatch
  825. default:
  826. return -1
  827. }
  828. }
  829. // For method customization
  830. return slices.Index(app.config.RequestMethods, s)
  831. }
  832. func (app *App) method(methodInt int) string {
  833. return app.config.RequestMethods[methodInt]
  834. }
  835. // IsMethodSafe reports whether the HTTP method is considered safe.
  836. // See https://datatracker.ietf.org/doc/html/rfc9110#section-9.2.1
  837. func IsMethodSafe(m string) bool {
  838. switch m {
  839. case MethodGet,
  840. MethodHead,
  841. MethodOptions,
  842. MethodTrace:
  843. return true
  844. default:
  845. return false
  846. }
  847. }
  848. // IsMethodIdempotent reports whether the HTTP method is considered idempotent.
  849. // See https://datatracker.ietf.org/doc/html/rfc9110#section-9.2.2
  850. func IsMethodIdempotent(m string) bool {
  851. if IsMethodSafe(m) {
  852. return true
  853. }
  854. switch m {
  855. case MethodPut, MethodDelete:
  856. return true
  857. default:
  858. return false
  859. }
  860. }
  861. // Convert a string value to a specified type, handling errors and optional default values.
  862. func Convert[T any](value string, converter func(string) (T, error), defaultValue ...T) (T, error) {
  863. converted, err := converter(value)
  864. if err != nil {
  865. if len(defaultValue) > 0 {
  866. return defaultValue[0], nil
  867. }
  868. return converted, fmt.Errorf("failed to convert: %w", err)
  869. }
  870. return converted, nil
  871. }
  872. var (
  873. errParsedEmptyString = errors.New("parsed result is empty string")
  874. errParsedEmptyBytes = errors.New("parsed result is empty bytes")
  875. errParsedType = errors.New("unsupported generic type")
  876. )
  877. func genericParseType[V GenericType](str string) (V, error) {
  878. var v V
  879. switch any(v).(type) {
  880. case int:
  881. result, err := utils.ParseInt(str)
  882. if err != nil {
  883. return v, fmt.Errorf("failed to parse int: %w", err)
  884. }
  885. return any(int(result)).(V), nil //nolint:errcheck,forcetypeassert // not needed
  886. case int8:
  887. result, err := utils.ParseInt8(str)
  888. if err != nil {
  889. return v, fmt.Errorf("failed to parse int8: %w", err)
  890. }
  891. return any(result).(V), nil //nolint:errcheck,forcetypeassert // not needed
  892. case int16:
  893. result, err := utils.ParseInt16(str)
  894. if err != nil {
  895. return v, fmt.Errorf("failed to parse int16: %w", err)
  896. }
  897. return any(result).(V), nil //nolint:errcheck,forcetypeassert // not needed
  898. case int32:
  899. result, err := utils.ParseInt32(str)
  900. if err != nil {
  901. return v, fmt.Errorf("failed to parse int32: %w", err)
  902. }
  903. return any(result).(V), nil //nolint:errcheck,forcetypeassert // not needed
  904. case int64:
  905. result, err := utils.ParseInt(str)
  906. if err != nil {
  907. return v, fmt.Errorf("failed to parse int64: %w", err)
  908. }
  909. return any(result).(V), nil //nolint:errcheck,forcetypeassert // not needed
  910. case uint:
  911. result, err := utils.ParseUint(str)
  912. if err != nil {
  913. return v, fmt.Errorf("failed to parse uint: %w", err)
  914. }
  915. return any(uint(result)).(V), nil //nolint:errcheck,forcetypeassert // not needed
  916. case uint8:
  917. result, err := utils.ParseUint8(str)
  918. if err != nil {
  919. return v, fmt.Errorf("failed to parse uint8: %w", err)
  920. }
  921. return any(result).(V), nil //nolint:errcheck,forcetypeassert // not needed
  922. case uint16:
  923. result, err := utils.ParseUint16(str)
  924. if err != nil {
  925. return v, fmt.Errorf("failed to parse uint16: %w", err)
  926. }
  927. return any(result).(V), nil //nolint:errcheck,forcetypeassert // not needed
  928. case uint32:
  929. result, err := utils.ParseUint32(str)
  930. if err != nil {
  931. return v, fmt.Errorf("failed to parse uint32: %w", err)
  932. }
  933. return any(result).(V), nil //nolint:errcheck,forcetypeassert // not needed
  934. case uint64:
  935. result, err := utils.ParseUint(str)
  936. if err != nil {
  937. return v, fmt.Errorf("failed to parse uint64: %w", err)
  938. }
  939. return any(result).(V), nil //nolint:errcheck,forcetypeassert // not needed
  940. case float32:
  941. result, err := utils.ParseFloat32(str)
  942. if err != nil {
  943. return v, fmt.Errorf("failed to parse float32: %w", err)
  944. }
  945. return any(result).(V), nil //nolint:errcheck,forcetypeassert // not needed
  946. case float64:
  947. result, err := utils.ParseFloat64(str)
  948. if err != nil {
  949. return v, fmt.Errorf("failed to parse float64: %w", err)
  950. }
  951. return any(result).(V), nil //nolint:errcheck,forcetypeassert // not needed
  952. case bool:
  953. result, err := strconv.ParseBool(str)
  954. if err != nil {
  955. return v, fmt.Errorf("failed to parse bool: %w", err)
  956. }
  957. return any(result).(V), nil //nolint:errcheck,forcetypeassert // not needed
  958. case string:
  959. if str == "" {
  960. return v, errParsedEmptyString
  961. }
  962. return any(str).(V), nil //nolint:errcheck,forcetypeassert // not needed
  963. case []byte:
  964. if str == "" {
  965. return v, errParsedEmptyBytes
  966. }
  967. return any([]byte(str)).(V), nil //nolint:errcheck,forcetypeassert // not needed
  968. default:
  969. return v, errParsedType
  970. }
  971. }
  972. // GenericType enumerates the values that can be parsed from strings by the
  973. // generic helper functions.
  974. type GenericType interface {
  975. GenericTypeInteger | GenericTypeFloat | bool | string | []byte
  976. }
  977. // GenericTypeInteger is the union of all supported integer types.
  978. type GenericTypeInteger interface {
  979. GenericTypeIntegerSigned | GenericTypeIntegerUnsigned
  980. }
  981. // GenericTypeIntegerSigned is the union of supported signed integer types.
  982. type GenericTypeIntegerSigned interface {
  983. int | int8 | int16 | int32 | int64
  984. }
  985. // GenericTypeIntegerUnsigned is the union of supported unsigned integer types.
  986. type GenericTypeIntegerUnsigned interface {
  987. uint | uint8 | uint16 | uint32 | uint64
  988. }
  989. // GenericTypeFloat is the union of supported floating-point types.
  990. type GenericTypeFloat interface {
  991. float32 | float64
  992. }