Merge 3a5ca23133c9515843e9d8b6096ab14859ba0ead into db309081bc5c137b2aa15701ef53f7f19788da25

This is useful for APIs that might have sensitive information in the query string, such as API keys.

This patch does not change the default behavior of the code unless the new `SkipQueryString` config option is passed in.

The "skip" term is a bit of a misnomer here, as this doesn't actually skip that log, but modifies the output. I'm open to suggestions for a more appropriate name.

Co-authored-by: Bo-Yi Wu <appleboy.tw@gmail.com>

binding/all.go

@@ -7,6 +7,8 @@ import (
 
 type allBinding struct{}
 
+var _ BindingMany = allBinding{}
+
 func (allBinding) Name() string {
 	return "all"
 }

binding/binding_nomsgpack.go

@@ -46,6 +46,15 @@ type BindingUri interface {
 	BindUri(map[string][]string, any) error
 }
 
+// BindingMany adds BindMany method to Binding. BindingMany is similar to Binding,
+// but it has full access to all request aspects to bind multiple parts simultaneously.
+//
+// NOTE: External projects should NOT depend on this interface as it is for Gin's internal binding logic
+type BindingMany interface {
+	Name() string
+	BindMany(req *http.Request, uriParams map[string][]string, obj any) error
+}
+
 // StructValidator is the minimal interface which needs to be implemented in
 // order for it to be used as the validator engine for ensuring the correctness
 // of the request. Gin provides a default implementation for this using
@@ -71,18 +80,19 @@ var Validator StructValidator = &defaultValidator{}
 // These implement the Binding interface and can be used to bind the data
 // present in the request to struct instances.
 var (
-	JSON          = jsonBinding{}
-	XML           = xmlBinding{}
-	Form          = formBinding{}
-	Query         = queryBinding{}
-	FormPost      = formPostBinding{}
-	FormMultipart = formMultipartBinding{}
-	ProtoBuf      = protobufBinding{}
-	YAML          = yamlBinding{}
-	Uri           = uriBinding{}
-	Header        = headerBinding{}
-	TOML          = tomlBinding{}
-	Plain         = plainBinding{}
+	All           BindingMany = allBinding{} // NOTE: This combines other bindings and doesn't have its own Content-Type
+	JSON                      = jsonBinding{}
+	XML                       = xmlBinding{}
+	Form                      = formBinding{}
+	Query                     = queryBinding{}
+	FormPost                  = formPostBinding{}
+	FormMultipart             = formMultipartBinding{}
+	ProtoBuf                  = protobufBinding{}
+	YAML                      = yamlBinding{}
+	Uri                       = uriBinding{}
+	Header                    = headerBinding{}
+	TOML                      = tomlBinding{}
+	Plain                     = plainBinding{}
 	BSON          BindingBody = bsonBinding{}
 )
 

docs/doc.md

@@ -22,6 +22,7 @@
   - [How to write log file](#how-to-write-log-file)
   - [Custom Log Format](#custom-log-format)
   - [Controlling Log output coloring](#controlling-log-output-coloring)
+  - [Avoid logging query strings](#avoid-loging-query-strings)
   - [Model binding and validation](#model-binding-and-validation)
   - [Custom Validators](#custom-validators)
   - [Only Bind Query String](#only-bind-query-string)
@@ -592,6 +593,20 @@ func main() {
 }
 ```
 
+### Avoid logging query strings
+
+```go
+func main() {
+  router := gin.New()
+  
+  // SkipQueryString indicates that the logger should not log the query string.
+  // For example, /path?q=1 will be logged as /path
+  loggerConfig := gin.LoggerConfig{SkipQueryString: true}
+  
+  router.Use(gin.LoggerWithConfig(loggerConfig))
+}
+```
+
 ### Model binding and validation
 
 To bind a request body into a type, use model binding. We currently support binding of JSON, XML, YAML, TOML and standard form values (foo=bar&boo=baz).

logger.go

@@ -48,6 +48,11 @@ type LoggerConfig struct {
 	// Optional.
 	SkipPaths []string
 
+	// SkipQueryString indicates that query strings should not be written
+	// for cases such as when API keys are passed via query strings.
+	// Optional. Default value is false.
+	SkipQueryString bool
+
 	// Skip is a Skipper that indicates which logs should not be written.
 	// Optional.
 	Skip Skipper
@@ -298,7 +303,7 @@ func LoggerWithConfig(conf LoggerConfig) HandlerFunc {
 
 		param.BodySize = c.Writer.Size()
 
-		if raw != "" {
+		if raw != "" && !conf.SkipQueryString {
 			path = path + "?" + raw
 		}
 

logger_test.go

@@ -471,3 +471,17 @@ func TestForceConsoleColor(t *testing.T) {
 	// reset console color mode.
 	consoleColorMode = autoColor
 }
+
+func TestLoggerWithConfigSkipQueryString(t *testing.T) {
+	buffer := new(strings.Builder)
+	router := New()
+	router.Use(LoggerWithConfig(LoggerConfig{
+		Output:          buffer,
+		SkipQueryString: true,
+	}))
+	router.GET("/logged", func(c *Context) { c.Status(http.StatusOK) })
+
+	PerformRequest(router, "GET", "/logged?a=21")
+	assert.Contains(t, buffer.String(), "200")
+	assert.NotContains(t, buffer.String(), "a=21")
+}