blackteay/gin
3
0
Fork 0
mirror of https://github.com/gin-gonic/gin.git synced 2025-10-24 19:09:57 +08:00
Code Issues Projects Releases Wiki Activity

Don't log requests (#1370)

Browse Source 
Fixes #1331

HTTP logging leaks sensitive request information.

This PR removes HTTP request logging during panics.
This commit is contained in:
Dustin Decker 2018-09-23 00:15:23 -07:00 committed by Justin Israel
parent 1e326a1bb7
commit 5548cc3c53
2 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
recovery.go
View File

@ -51,12 +51,16 @@ func RecoveryWithWriter(out io.Writer) HandlerFunc {
} }
} }
if logger != nil { if logger != nil {
stack := stack(3)
httprequest, _ := httputil.DumpRequest(c.Request, false) httprequest, _ := httputil.DumpRequest(c.Request, false)
if brokenPipe { if brokenPipe {
logger.Printf("%s\n%s%s", err, string(httprequest), reset) logger.Printf("%s\n%s%s", err, string(httprequest), reset)
} else { } else if IsDebugging() {
logger.Printf("[Recovery] %s panic recovered:\n%s\n%s\n%s%s", logger.Printf("[Recovery] %s panic recovered:\n%s\n%s\n%s%s",
timeFormat(time.Now()), string(httprequest), err, stack(3), reset) timeFormat(time.Now()), string(httprequest), err, stack, reset)
} else {
logger.Printf("[Recovery] %s panic recovered:\n%s\n%s%s",
timeFormat(time.Now()), err, stack, reset)
} }
} }

12
recovery_test.go
View File

@ -27,9 +27,19 @@ func TestPanicInHandler(t *testing.T) {
w := performRequest(router, "GET", "/recovery") w := performRequest(router, "GET", "/recovery")
// TEST // TEST
assert.Equal(t, http.StatusInternalServerError, w.Code) assert.Equal(t, http.StatusInternalServerError, w.Code)
assert.Contains(t, buffer.String(), "GET /recovery") assert.Contains(t, buffer.String(), "panic recovered")
assert.Contains(t, buffer.String(), "Oupps, Houston, we have a problem") assert.Contains(t, buffer.String(), "Oupps, Houston, we have a problem")
assert.Contains(t, buffer.String(), "TestPanicInHandler") assert.Contains(t, buffer.String(), "TestPanicInHandler")
assert.NotContains(t, buffer.String(), "GET /recovery")
// Debug mode prints the request
SetMode(DebugMode)
// RUN
w = performRequest(router, "GET", "/recovery")
// TEST
assert.Equal(t, http.StatusInternalServerError, w.Code)
assert.Contains(t, buffer.String(), "GET /recovery")
} }
// TestPanicWithAbort assert that panic has been recovered even if context.Abort was used. // TestPanicWithAbort assert that panic has been recovered even if context.Abort was used.