GitHub Actions
4d639698bb
- Implemented filename sanitization in backup, import, and certificate handlers to prevent log injection attacks. - Added tests to ensure filenames are sanitized correctly in backup and import handlers. - Updated notification and domain handlers to sanitize domain names before logging. - Introduced middleware functions for sanitizing request paths and headers to redact sensitive information in logs. - Enhanced recovery middleware to sanitize logged paths and headers during panic situations. - Updated various services to log sanitized values for sensitive fields.
33 lines
1.1 KiB
Go
33 lines
1.1 KiB
Go
package middleware
|
|
|
|
import (
|
|
"net/http"
|
|
"runtime/debug"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
// Recovery logs panic information. When verbose is true it logs stacktraces
|
|
// and basic request metadata for debugging.
|
|
func Recovery(verbose bool) gin.HandlerFunc {
|
|
return func(c *gin.Context) {
|
|
defer func() {
|
|
if r := recover(); r != nil {
|
|
// Try to get a request-scoped logger; fall back to global logger
|
|
entry := GetRequestLogger(c)
|
|
if verbose {
|
|
entry.WithFields(map[string]interface{}{
|
|
"method": c.Request.Method,
|
|
"path": SanitizePath(c.Request.URL.Path),
|
|
"headers": SanitizeHeaders(c.Request.Header),
|
|
}).Errorf("PANIC: %v\nStacktrace:\n%s", r, debug.Stack())
|
|
} else {
|
|
entry.Errorf("PANIC: %v", r)
|
|
}
|
|
c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{"error": "internal server error"})
|
|
}
|
|
}()
|
|
c.Next()
|
|
}
|
|
}
|