diff --git a/context.go b/context.go index a00d1e55..3f18dab6 100644 --- a/context.go +++ b/context.go @@ -1249,7 +1249,14 @@ func (c *Context) String(code int, format string, values ...any) { } // Redirect returns an HTTP redirect to the specific location. +// When the 'location' parameter is empty, it poses a potential security risk. +// Avoid bringing potential security risks into the production environment. func (c *Context) Redirect(code int, location string) { + if location == "" { + debugPrint(`[WARNING] When the 'location' parameter is empty, it poses a potential security risk. Please input a secure redirection URL to ensure safe operation.`) + } + + c.Render(-1, render.Redirect{ Code: code, Location: location, diff --git a/context_test.go b/context_test.go index 41694585..fc726558 100644 --- a/context_test.go +++ b/context_test.go @@ -1596,6 +1596,7 @@ func TestContextRenderRedirectAll(t *testing.T) { assert.Panics(t, func() { c.Redirect(309, "/resource") }) assert.NotPanics(t, func() { c.Redirect(http.StatusMultipleChoices, "/resource") }) assert.NotPanics(t, func() { c.Redirect(http.StatusPermanentRedirect, "/resource") }) + assert.NotPanics(t, func() { c.Redirect(http.StatusTemporaryRedirect, "")}) } func TestContextNegotiationWithJSON(t *testing.T) { diff --git a/docs/doc.md b/docs/doc.md index 449c8d02..265c25b3 100644 --- a/docs/doc.md +++ b/docs/doc.md @@ -1619,6 +1619,8 @@ Gin allows only one html.Template by default. Check [a multitemplate render](htt Issuing a HTTP redirect is easy. Both internal and external locations are supported. +Note: When the location is empty, there is a security risk. Please do not bring it to production + ```go r.GET("/test", func(c *gin.Context) { c.Redirect(http.StatusMovedPermanently, "http://www.google.com/")