Merge 5ea1f87e8838da6ff3d02435f979778342fe1af4 into 2a794cd0b0faa7d829291375b27a3467ea972b0d

Co-authored-by: Bo-Yi Wu <appleboy.tw@gmail.com>

binding/form_mapping.go

@@ -300,6 +300,11 @@ func setByForm(value reflect.Value, field reflect.StructField, form map[string][
 }
 
 func setWithProperType(val string, value reflect.Value, field reflect.StructField) error {
+	// If it is a string type, no spaces are removed, and the user data is not modified here
+	if value.Kind() != reflect.String {
+		val = strings.TrimSpace(val)
+	}
+
 	switch value.Kind() {
 	case reflect.Int:
 		return setIntField(val, 0, value)
@@ -404,6 +409,11 @@ func setTimeField(val string, structField reflect.StructField, value reflect.Val
 		timeFormat = time.RFC3339
 	}
 
+	if val == "" {
+		value.Set(reflect.ValueOf(time.Time{}))
+		return nil
+	}
+
 	switch tf := strings.ToLower(timeFormat); tf {
 	case "unix", "unixmilli", "unixmicro", "unixnano":
 		tv, err := strconv.ParseInt(val, 10, 64)
@@ -427,11 +437,6 @@ func setTimeField(val string, structField reflect.StructField, value reflect.Val
 		return nil
 	}
 
-	if val == "" {
-		value.Set(reflect.ValueOf(time.Time{}))
-		return nil
-	}
-
 	l := time.Local
 	if isUTC, _ := strconv.ParseBool(structField.Tag.Get("time_utc")); isUTC {
 		l = time.UTC
@@ -475,6 +480,10 @@ func setSlice(vals []string, value reflect.Value, field reflect.StructField) err
 }
 
 func setTimeDuration(val string, value reflect.Value) error {
+	if val == "" {
+		val = "0"
+	}
+
 	d, err := time.ParseDuration(val)
 	if err != nil {
 		return err

binding/form_mapping_test.go

@@ -226,7 +226,35 @@ func TestMappingTime(t *testing.T) {
 	require.Error(t, err)
 }
 
+type bindTestData struct {
+	need any
+	got  any
+	in   map[string][]string
+}
+
+func TestMappingTimeUnixNano(t *testing.T) {
+	type needFixUnixNanoEmpty struct {
+		CreateTime time.Time `form:"createTime" time_format:"unixNano"`
+	}
+
+	// ok
+	tests := []bindTestData{
+		{need: &needFixUnixNanoEmpty{}, got: &needFixUnixNanoEmpty{}, in: formSource{"createTime": []string{"   "}}},
+		{need: &needFixUnixNanoEmpty{}, got: &needFixUnixNanoEmpty{}, in: formSource{"createTime": []string{}}},
+	}
+
+	for _, v := range tests {
+		err := mapForm(v.got, v.in)
+		require.NoError(t, err)
+		assert.Equal(t, v.need, v.got)
+	}
+}
+
 func TestMappingTimeDuration(t *testing.T) {
+	type needFixDurationEmpty struct {
+		Duration time.Duration `form:"duration"`
+	}
+
 	var s struct {
 		D time.Duration
 	}
@@ -236,6 +264,17 @@ func TestMappingTimeDuration(t *testing.T) {
 	require.NoError(t, err)
 	assert.Equal(t, 5*time.Second, s.D)
 
+	// ok
+	tests := []bindTestData{
+		{need: &needFixDurationEmpty{}, got: &needFixDurationEmpty{}, in: formSource{"duration": []string{"   "}}},
+		{need: &needFixDurationEmpty{}, got: &needFixDurationEmpty{}, in: formSource{"duration": []string{}}},
+	}
+
+	for _, v := range tests {
+		err := mapForm(v.got, v.in)
+		require.NoError(t, err)
+		assert.Equal(t, v.need, v.got)
+	}
 	// error
 	err = mappingByPtr(&s, formSource{"D": {"wrong"}}, "form")
 	require.Error(t, err)

context.go

@@ -1227,7 +1227,14 @@ func (c *Context) String(code int, format string, values ...any) {
 }
 
 // Redirect returns an HTTP redirect to the specific location.
+// When the 'location' parameter is empty, it poses a potential security risk.
+// Avoid bringing potential security risks into the production environment.
 func (c *Context) Redirect(code int, location string) {
+	if location == "" {
+		debugPrint(`[WARNING] When the 'location' parameter is empty, it poses a potential security risk. Please input a secure redirection URL to ensure safe operation.`)
+	}
+
+
 	c.Render(-1, render.Redirect{
 		Code:     code,
 		Location: location,

context_test.go

@@ -1548,6 +1548,7 @@ func TestContextRenderRedirectAll(t *testing.T) {
 	assert.Panics(t, func() { c.Redirect(309, "/resource") })
 	assert.NotPanics(t, func() { c.Redirect(http.StatusMultipleChoices, "/resource") })
 	assert.NotPanics(t, func() { c.Redirect(http.StatusPermanentRedirect, "/resource") })
+	assert.NotPanics(t, func() { c.Redirect(http.StatusTemporaryRedirect, "")})
 }
 
 func TestContextNegotiationWithJSON(t *testing.T) {

debug.go

@@ -13,7 +13,7 @@ import (
 	"sync/atomic"
 )
 
-const ginSupportMinGoVer = 23
+const ginSupportMinGoVer = 24
 
 // IsDebugging returns true if the framework is running in debug mode.
 // Use SetMode(gin.ReleaseMode) to disable debug mode.

docs/doc.md

@@ -1555,6 +1555,8 @@ Gin allows only one html.Template by default. Check [a multitemplate render](htt
 
 Issuing a HTTP redirect is easy. Both internal and external locations are supported.
 
+Note: When the location is empty, there is a security risk. Please do not bring it to production
+
 ```go
 r.GET("/test", func(c *gin.Context) {
   c.Redirect(http.StatusMovedPermanently, "http://www.google.com/")