Compare commits

...

5 Commits

Author SHA1 Message Date
cyal1
a038020183
Merge b7dd5120ef35e1ed60c497d770495aa3054e6ab1 into 63dd3e60cab89c27fb66bce1423bd268d52abad1 2025-11-28 17:28:34 +08:00
Yilong Li
63dd3e60ca
fix(recover): suppress http.ErrAbortHandler in recover (#4336)
Co-authored-by: Bo-Yi Wu <appleboy.tw@gmail.com>
2025-11-27 23:20:52 +08:00
cyal1
b7dd5120ef
add open redirect test case
https://github.com/gin-gonic/gin/pull/3907
2024-04-01 14:52:28 +08:00
cyal1
29db90e1fc
fixed open redirect 2024-04-01 14:50:18 +08:00
cyal1
6c8ec4deda
fixed open redirect 2024-03-28 23:05:09 +08:00
4 changed files with 34 additions and 1 deletions

1
gin.go
View File

@ -788,6 +788,7 @@ func redirectTrailingSlash(c *Context) {
p = prefix + "/" + req.URL.Path
}
req.URL.Path = p + "/"
p = regexp.MustCompile("^/{2,}").ReplaceAllString(p, "/")
if length := len(p); length > 1 && p[length-1] == '/' {
req.URL.Path = p[:length-1]
}

View File

@ -68,6 +68,9 @@ func CustomRecoveryWithWriter(out io.Writer, handle RecoveryFunc) HandlerFunc {
}
}
}
if e, ok := err.(error); ok && errors.Is(e, http.ErrAbortHandler) {
brokenPipe = true
}
if logger != nil {
const stackSkip = 3
if brokenPipe {

View File

@ -142,6 +142,30 @@ func TestPanicWithBrokenPipe(t *testing.T) {
}
}
// TestPanicWithAbortHandler asserts that recovery handles http.ErrAbortHandler as broken pipe
func TestPanicWithAbortHandler(t *testing.T) {
const expectCode = 204
var buf strings.Builder
router := New()
router.Use(RecoveryWithWriter(&buf))
router.GET("/recovery", func(c *Context) {
// Start writing response
c.Header("X-Test", "Value")
c.Status(expectCode)
// Panic with ErrAbortHandler which should be treated as broken pipe
panic(http.ErrAbortHandler)
})
// RUN
w := PerformRequest(router, http.MethodGet, "/recovery")
// TEST
assert.Equal(t, expectCode, w.Code)
out := buf.String()
assert.Contains(t, out, "net/http: abort Handler")
assert.NotContains(t, out, "panic recovered")
}
func TestCustomRecoveryWithWriter(t *testing.T) {
errBuffer := new(strings.Builder)
buffer := new(strings.Builder)

View File

@ -150,8 +150,13 @@ func TestRouteRedirectTrailingSlash(t *testing.T) {
router.GET("/path2/", func(c *Context) {})
router.POST("/path3", func(c *Context) {})
router.PUT("/path4/", func(c *Context) {})
router.GET("/:param1/:param2", func(c *Context) {})
w := PerformRequest(router, http.MethodGet, "/path/")
w := PerformRequest(router, http.MethodGet, "//path/")
assert.Equal(t, "/path", w.Header().Get("Location"))
assert.Equal(t, http.StatusMovedPermanently, w.Code)
w = PerformRequest(router, http.MethodGet, "/path/")
assert.Equal(t, "/path", w.Header().Get("Location"))
assert.Equal(t, http.StatusMovedPermanently, w.Code)