Merge d2415e54db2617848cd2d0ac194b4c722c93fca0 into 19c2d5c0d1d096e1014fb7be62116ee9025d0f56

.github/workflows/gin.yml

@@ -26,7 +26,7 @@ jobs:
       - name: Setup golangci-lint
         uses: golangci/golangci-lint-action@v9
         with:
-          version: v2.6
+          version: v2.1.6
           args: --verbose
   test:
     needs: lint

.github/workflows/trivy-scan.yml

@@ -8,8 +8,9 @@ on:
     branches:
       - master
   schedule:
-    # Run daily at 00:00 UTC
-    - cron: '0 0 * * *'
+    # Run every 3 months (quarterly) on the 1st day at 00:00 UTC
+    # Months: January (1), April (4), July (7), October (10)
+    - cron: '0 0 1 1,4,7,10 *'
   workflow_dispatch: # Allow manual trigger
 
 permissions:

.golangci.yml

@@ -18,8 +18,15 @@ linters:
     - wastedassign
   settings:
     gosec:
-      excludes:
-        - G115
+      includes:
+        - G102
+        - G106
+        - G108
+        - G109
+        - G111
+        - G112
+        - G201
+        - G203
     perfsprint:
       int-conversion: true
       err-error: true
@@ -61,6 +68,7 @@ linters:
       - examples$
 formatters:
   enable:
+    - gci
     - gofmt
     - gofumpt
     - goimports
@@ -72,4 +80,7 @@ formatters:
   exclusions:
     generated: lax
     paths:
+      - third_party$
+      - builtin$
+      - examples$
       - gin.go

binding/default_validator_benchmark_test.go

@@ -18,8 +18,9 @@ func BenchmarkSliceValidationError(b *testing.B) {
 	}
 
 	b.ReportAllocs()
+	b.ResetTimer()
 
-	for b.Loop() {
+	for i := 0; i < b.N; i++ {
 		if len(e.Error()) == 0 {
 			b.Errorf("error")
 		}

binding/form_mapping_benchmark_test.go

@@ -31,7 +31,7 @@ type structFull struct {
 
 func BenchmarkMapFormFull(b *testing.B) {
 	var s structFull
-	for b.Loop() {
+	for i := 0; i < b.N; i++ {
 		err := mapForm(&s, form)
 		if err != nil {
 			b.Fatalf("Error on a form mapping")
@@ -54,7 +54,7 @@ type structName struct {
 
 func BenchmarkMapFormName(b *testing.B) {
 	var s structName
-	for b.Loop() {
+	for i := 0; i < b.N; i++ {
 		err := mapForm(&s, form)
 		if err != nil {
 			b.Fatalf("Error on a form mapping")

context.go

@@ -55,14 +55,6 @@ const ContextRequestKey ContextKeyType = 0
 // abortIndex represents a typical value used in abort functions.
 const abortIndex int8 = math.MaxInt8 >> 1
 
-// safeInt8 converts int to int8 safely, capping at math.MaxInt8
-func safeInt8(n int) int8 {
-	if n > math.MaxInt8 {
-		return math.MaxInt8
-	}
-	return int8(n)
-}
-
 // Context is the most important part of gin. It allows us to pass variables between middleware,
 // manage the flow, validate the JSON of a request and render a JSON response for example.
 type Context struct {
@@ -194,7 +186,7 @@ func (c *Context) FullPath() string {
 // See example in GitHub.
 func (c *Context) Next() {
 	c.index++
-	for c.index < safeInt8(len(c.handlers)) {
+	for c.index < int8(len(c.handlers)) {
 		if c.handlers[c.index] != nil {
 			c.handlers[c.index](c)
 		}
@@ -838,71 +830,41 @@ func (c *Context) ShouldBind(obj any) error {
 }
 
 // ShouldBindJSON is a shortcut for c.ShouldBindWith(obj, binding.JSON).
-//
-// Example:
-//
-//	POST /user
-//	Content-Type: application/json
-//
-//	Request Body:
-//	{
-//		"name": "Manu",
-//		"age": 20
-//	}
-//
-//	type User struct {
-//		Name string `json:"name"`
-//		Age  int    `json:"age"`
-//	}
-//
-//	var user User
-//	if err := c.ShouldBindJSON(&user); err != nil {
-//		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-//		return
-//	}
-//	c.JSON(http.StatusOK, user)
 func (c *Context) ShouldBindJSON(obj any) error {
 	return c.ShouldBindWith(obj, binding.JSON)
 }
 
 // ShouldBindXML is a shortcut for c.ShouldBindWith(obj, binding.XML).
-// It works like ShouldBindJSON but binds the request body as XML data.
 func (c *Context) ShouldBindXML(obj any) error {
 	return c.ShouldBindWith(obj, binding.XML)
 }
 
 // ShouldBindQuery is a shortcut for c.ShouldBindWith(obj, binding.Query).
-// It works like ShouldBindJSON but binds query parameters from the URL.
 func (c *Context) ShouldBindQuery(obj any) error {
 	return c.ShouldBindWith(obj, binding.Query)
 }
 
 // ShouldBindYAML is a shortcut for c.ShouldBindWith(obj, binding.YAML).
-// It works like ShouldBindJSON but binds the request body as YAML data.
 func (c *Context) ShouldBindYAML(obj any) error {
 	return c.ShouldBindWith(obj, binding.YAML)
 }
 
 // ShouldBindTOML is a shortcut for c.ShouldBindWith(obj, binding.TOML).
-// It works like ShouldBindJSON but binds the request body as TOML data.
 func (c *Context) ShouldBindTOML(obj any) error {
 	return c.ShouldBindWith(obj, binding.TOML)
 }
 
 // ShouldBindPlain is a shortcut for c.ShouldBindWith(obj, binding.Plain).
-// It works like ShouldBindJSON but binds plain text data from the request body.
 func (c *Context) ShouldBindPlain(obj any) error {
 	return c.ShouldBindWith(obj, binding.Plain)
 }
 
 // ShouldBindHeader is a shortcut for c.ShouldBindWith(obj, binding.Header).
-// It works like ShouldBindJSON but binds values from HTTP headers.
 func (c *Context) ShouldBindHeader(obj any) error {
 	return c.ShouldBindWith(obj, binding.Header)
 }
 
 // ShouldBindUri binds the passed struct pointer using the specified binding engine.
-// It works like ShouldBindJSON but binds parameters from the URI.
 func (c *Context) ShouldBindUri(obj any) error {
 	m := make(map[string][]string, len(c.Params))
 	for _, v := range c.Params {

context_test.go

@@ -292,7 +292,7 @@ func TestContextReset(t *testing.T) {
 	assert.Empty(t, c.Errors.Errors())
 	assert.Empty(t, c.Errors.ByType(ErrorTypeAny))
 	assert.Empty(t, c.Params)
-	assert.EqualValues(t, -1, c.index)
+	assert.EqualValues(t, c.index, -1)
 	assert.Equal(t, c.Writer.(*responseWriter), &c.writermem)
 }
 
@@ -384,7 +384,7 @@ func TestContextSetGetValues(t *testing.T) {
 	c.Set("intInterface", a)
 
 	assert.Exactly(t, "this is a string", c.MustGet("string").(string))
-	assert.Exactly(t, int32(-42), c.MustGet("int32").(int32))
+	assert.Exactly(t, c.MustGet("int32").(int32), int32(-42))
 	assert.Exactly(t, int64(42424242424242), c.MustGet("int64").(int64))
 	assert.Exactly(t, uint64(42), c.MustGet("uint64").(uint64))
 	assert.InDelta(t, float32(4.2), c.MustGet("float32").(float32), 0.01)

gin.go

@@ -23,12 +23,10 @@ import (
 	"golang.org/x/net/http2/h2c"
 )
 
-const (
-	defaultMultipartMemory = 32 << 20 // 32 MB
-	escapedColon           = "\\:"
-	colon                  = ":"
-	backslash              = "\\"
-)
+const defaultMultipartMemory = 32 << 20 // 32 MB
+const escapedColon = "\\:"
+const colon = ":"
+const backslash = "\\"
 
 var (
 	default404Body = []byte("404 page not found")
@@ -48,10 +46,8 @@ var defaultTrustedCIDRs = []*net.IPNet{
 	},
 }
 
-var (
-	regSafePrefix         = regexp.MustCompile("[^a-zA-Z0-9/-]+")
-	regRemoveRepeatedChar = regexp.MustCompile("/{2,}")
-)
+var regSafePrefix = regexp.MustCompile("[^a-zA-Z0-9/-]+")
+var regRemoveRepeatedChar = regexp.MustCompile("/{2,}")
 
 // HandlerFunc defines the handler used by gin middleware as return value.
 type HandlerFunc func(*Context)
@@ -98,10 +94,6 @@ const (
 type Engine struct {
 	RouterGroup
 
-	// routeTreesUpdated ensures that the initialization or update of the route trees
-	// (used for routing HTTP requests) happens only once, even if called multiple times concurrently.
-	routeTreesUpdated sync.Once
-
 	// RedirectTrailingSlash enables automatic redirection if the current route can't be matched but a
 	// handler for the path with (without) the trailing slash exists.
 	// For example if /foo/ is requested but a route only exists for /foo, the
@@ -545,11 +537,7 @@ func (engine *Engine) Run(addr ...string) (err error) {
 	engine.updateRouteTrees()
 	address := resolveAddress(addr)
 	debugPrint("Listening and serving HTTP on %s\n", address)
-	server := &http.Server{ // #nosec G112
-		Addr:    address,
-		Handler: engine.Handler(),
-	}
-	err = server.ListenAndServe()
+	err = http.ListenAndServe(address, engine.Handler())
 	return
 }
 
@@ -565,11 +553,7 @@ func (engine *Engine) RunTLS(addr, certFile, keyFile string) (err error) {
 			"Please check https://github.com/gin-gonic/gin/blob/master/docs/doc.md#dont-trust-all-proxies for details.")
 	}
 
-	server := &http.Server{ // #nosec G112
-		Addr:    addr,
-		Handler: engine.Handler(),
-	}
-	err = server.ListenAndServeTLS(certFile, keyFile)
+	err = http.ListenAndServeTLS(addr, certFile, keyFile, engine.Handler())
 	return
 }
 
@@ -592,10 +576,7 @@ func (engine *Engine) RunUnix(file string) (err error) {
 	defer listener.Close()
 	defer os.Remove(file)
 
-	server := &http.Server{ // #nosec G112
-		Handler: engine.Handler(),
-	}
-	err = server.Serve(listener)
+	err = http.Serve(listener, engine.Handler())
 	return
 }
 
@@ -649,19 +630,12 @@ func (engine *Engine) RunListener(listener net.Listener) (err error) {
 			"Please check https://github.com/gin-gonic/gin/blob/master/docs/doc.md#dont-trust-all-proxies for details.")
 	}
 
-	server := &http.Server{ // #nosec G112
-		Handler: engine.Handler(),
-	}
-	err = server.Serve(listener)
+	err = http.Serve(listener, engine.Handler())
 	return
 }
 
 // ServeHTTP conforms to the http.Handler interface.
 func (engine *Engine) ServeHTTP(w http.ResponseWriter, req *http.Request) {
-	engine.routeTreesUpdated.Do(func() {
-		engine.updateRouteTrees()
-	})
-
 	c := engine.pool.Get().(*Context)
 	c.writermem.reset(w)
 	c.Request = req

gin_integration_test.go

@@ -16,7 +16,6 @@ import (
 	"os"
 	"path/filepath"
 	"runtime"
-	"strings"
 	"sync"
 	"testing"
 	"time"
@@ -262,11 +261,10 @@ func TestUnixSocket(t *testing.T) {
 
 	fmt.Fprint(c, "GET /example HTTP/1.0\r\n\r\n")
 	scanner := bufio.NewScanner(c)
-	var responseBuilder strings.Builder
+	var response string
 	for scanner.Scan() {
-		responseBuilder.WriteString(scanner.Text())
+		response += scanner.Text()
 	}
-	response := responseBuilder.String()
 	assert.Contains(t, response, "HTTP/1.0 200", "should get a 200")
 	assert.Contains(t, response, "it worked", "resp body should match")
 }
@@ -324,11 +322,10 @@ func TestFileDescriptor(t *testing.T) {
 
 	fmt.Fprintf(c, "GET /example HTTP/1.0\r\n\r\n")
 	scanner := bufio.NewScanner(c)
-	var responseBuilder strings.Builder
+	var response string
 	for scanner.Scan() {
-		responseBuilder.WriteString(scanner.Text())
+		response += scanner.Text()
 	}
-	response := responseBuilder.String()
 	assert.Contains(t, response, "HTTP/1.0 200", "should get a 200")
 	assert.Contains(t, response, "it worked", "resp body should match")
 }
@@ -357,11 +354,10 @@ func TestListener(t *testing.T) {
 
 	fmt.Fprintf(c, "GET /example HTTP/1.0\r\n\r\n")
 	scanner := bufio.NewScanner(c)
-	var responseBuilder strings.Builder
+	var response string
 	for scanner.Scan() {
-		responseBuilder.WriteString(scanner.Text())
+		response += scanner.Text()
 	}
-	response := responseBuilder.String()
 	assert.Contains(t, response, "HTTP/1.0 200", "should get a 200")
 	assert.Contains(t, response, "it worked", "resp body should match")
 }

gin_test.go

@@ -913,102 +913,3 @@ func TestMethodNotAllowedNoRoute(t *testing.T) {
 	assert.NotPanics(t, func() { g.ServeHTTP(resp, req) })
 	assert.Equal(t, http.StatusNotFound, resp.Code)
 }
-
-// Test the fix for https://github.com/gin-gonic/gin/pull/4415
-func TestLiteralColonWithRun(t *testing.T) {
-	SetMode(TestMode)
-	router := New()
-
-	router.GET(`/test\:action`, func(c *Context) {
-		c.JSON(http.StatusOK, H{"path": "literal_colon"})
-	})
-
-	router.updateRouteTrees()
-
-	w := httptest.NewRecorder()
-
-	req, _ := http.NewRequest(http.MethodGet, "/test:action", nil)
-	router.ServeHTTP(w, req)
-
-	assert.Equal(t, http.StatusOK, w.Code)
-	assert.Contains(t, w.Body.String(), "literal_colon")
-}
-
-func TestLiteralColonWithDirectServeHTTP(t *testing.T) {
-	SetMode(TestMode)
-	router := New()
-
-	router.GET(`/test\:action`, func(c *Context) {
-		c.JSON(http.StatusOK, H{"path": "literal_colon"})
-	})
-
-	w := httptest.NewRecorder()
-	req, _ := http.NewRequest(http.MethodGet, "/test:action", nil)
-	router.ServeHTTP(w, req)
-
-	assert.Equal(t, http.StatusOK, w.Code)
-	assert.Contains(t, w.Body.String(), "literal_colon")
-}
-
-func TestLiteralColonWithHandler(t *testing.T) {
-	SetMode(TestMode)
-	router := New()
-
-	router.GET(`/test\:action`, func(c *Context) {
-		c.JSON(http.StatusOK, H{"path": "literal_colon"})
-	})
-
-	handler := router.Handler()
-
-	w := httptest.NewRecorder()
-	req, _ := http.NewRequest(http.MethodGet, "/test:action", nil)
-	handler.ServeHTTP(w, req)
-
-	assert.Equal(t, http.StatusOK, w.Code)
-	assert.Contains(t, w.Body.String(), "literal_colon")
-}
-
-func TestLiteralColonWithHTTPServer(t *testing.T) {
-	SetMode(TestMode)
-	router := New()
-
-	router.GET(`/test\:action`, func(c *Context) {
-		c.JSON(http.StatusOK, H{"path": "literal_colon"})
-	})
-
-	router.GET("/test/:param", func(c *Context) {
-		c.JSON(http.StatusOK, H{"param": c.Param("param")})
-	})
-
-	w := httptest.NewRecorder()
-	req, _ := http.NewRequest(http.MethodGet, "/test:action", nil)
-	router.ServeHTTP(w, req)
-
-	assert.Equal(t, http.StatusOK, w.Code)
-	assert.Contains(t, w.Body.String(), "literal_colon")
-
-	w2 := httptest.NewRecorder()
-	req2, _ := http.NewRequest(http.MethodGet, "/test/foo", nil)
-	router.ServeHTTP(w2, req2)
-
-	assert.Equal(t, http.StatusOK, w2.Code)
-	assert.Contains(t, w2.Body.String(), "foo")
-}
-
-// Test that updateRouteTrees is called only once
-func TestUpdateRouteTreesCalledOnce(t *testing.T) {
-	SetMode(TestMode)
-	router := New()
-
-	router.GET(`/test\:action`, func(c *Context) {
-		c.String(http.StatusOK, "ok")
-	})
-
-	for range 5 {
-		w := httptest.NewRecorder()
-		req, _ := http.NewRequest(http.MethodGet, "/test:action", nil)
-		router.ServeHTTP(w, req)
-		assert.Equal(t, http.StatusOK, w.Code)
-		assert.Equal(t, "ok", w.Body.String())
-	}
-}

path_test.go

@@ -94,7 +94,7 @@ func TestPathCleanMallocs(t *testing.T) {
 func BenchmarkPathClean(b *testing.B) {
 	b.ReportAllocs()
 
-	for b.Loop() {
+	for i := 0; i < b.N; i++ {
 		for _, test := range cleanTests {
 			cleanPath(test.path)
 		}
@@ -134,10 +134,10 @@ func TestPathCleanLong(t *testing.T) {
 
 func BenchmarkPathCleanLong(b *testing.B) {
 	cleanTests := genLongPaths()
-
+	b.ResetTimer()
 	b.ReportAllocs()
 
-	for b.Loop() {
+	for i := 0; i < b.N; i++ {
 		for _, test := range cleanTests {
 			cleanPath(test.path)
 		}

tree.go

@@ -5,7 +5,6 @@
 package gin
 
 import (
-	"math"
 	"net/url"
 	"strings"
 	"unicode"
@@ -78,22 +77,14 @@ func (n *node) addChild(child *node) {
 	}
 }
 
-// safeUint16 converts int to uint16 safely, capping at math.MaxUint16
-func safeUint16(n int) uint16 {
-	if n > math.MaxUint16 {
-		return math.MaxUint16
-	}
-	return uint16(n)
-}
-
 func countParams(path string) uint16 {
 	colons := strings.Count(path, ":")
 	stars := strings.Count(path, "*")
-	return safeUint16(colons + stars)
+	return uint16(colons + stars)
 }
 
 func countSections(path string) uint16 {
-	return safeUint16(strings.Count(path, "/"))
+	return uint16(strings.Count(path, "/"))
 }
 
 type nodeType uint8

utils_test.go

@@ -19,7 +19,7 @@ func init() {
 }
 
 func BenchmarkParseAccept(b *testing.B) {
-	for b.Loop() {
+	for i := 0; i < b.N; i++ {
 		parseAccept("text/html , application/xhtml+xml,application/xml;q=0.9,  */* ;q=0.8")
 	}
 }