From 5548cc3c534514541f33bf85b38434a25ec5dc0f Mon Sep 17 00:00:00 2001
From: Dustin Decker <dustindecker@protonmail.com>
Date: Sun, 23 Sep 2018 00:15:23 -0700
Subject: [PATCH] Don't log requests (#1370)

Fixes #1331

HTTP logging leaks sensitive request information.

This PR removes HTTP request logging during panics.
---
 recovery.go      |  8 ++++++--
 recovery_test.go | 12 +++++++++++-
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/recovery.go b/recovery.go
index efe3295e..e788cc47 100644
--- a/recovery.go
+++ b/recovery.go
@@ -51,12 +51,16 @@ func RecoveryWithWriter(out io.Writer) HandlerFunc {
 					}
 				}
 				if logger != nil {
+					stack := stack(3)
 					httprequest, _ := httputil.DumpRequest(c.Request, false)
 					if brokenPipe {
 						logger.Printf("%s\n%s%s", err, string(httprequest), reset)
-					} else {
+					} else if IsDebugging() {
 						logger.Printf("[Recovery] %s panic recovered:\n%s\n%s\n%s%s",
-							timeFormat(time.Now()), string(httprequest), err, stack(3), reset)
+							timeFormat(time.Now()), string(httprequest), err, stack, reset)
+					} else {
+						logger.Printf("[Recovery] %s panic recovered:\n%s\n%s%s",
+							timeFormat(time.Now()), err, stack, reset)
 					}
 				}
 
diff --git a/recovery_test.go b/recovery_test.go
index 139f7888..7b56d401 100644
--- a/recovery_test.go
+++ b/recovery_test.go
@@ -27,9 +27,19 @@ func TestPanicInHandler(t *testing.T) {
 	w := performRequest(router, "GET", "/recovery")
 	// TEST
 	assert.Equal(t, http.StatusInternalServerError, w.Code)
-	assert.Contains(t, buffer.String(), "GET /recovery")
+	assert.Contains(t, buffer.String(), "panic recovered")
 	assert.Contains(t, buffer.String(), "Oupps, Houston, we have a problem")
 	assert.Contains(t, buffer.String(), "TestPanicInHandler")
+	assert.NotContains(t, buffer.String(), "GET /recovery")
+
+	// Debug mode prints the request
+	SetMode(DebugMode)
+	// RUN
+	w = performRequest(router, "GET", "/recovery")
+	// TEST
+	assert.Equal(t, http.StatusInternalServerError, w.Code)
+	assert.Contains(t, buffer.String(), "GET /recovery")
+
 }
 
 // TestPanicWithAbort assert that panic has been recovered even if context.Abort was used.