优化结构

internal/server/middleware/http.go

@@ -2,7 +2,7 @@ package middleware
 
 import (
 	"github.com/gin-gonic/gin"
-	"kra/internal/server/httpx"
+	httpx "kra/pkg/httpx"
 )
 
 const (

internal/server/middleware/recovery.go

@@ -1,10 +1,12 @@
 package middleware
 
 import (
+	"errors"
 	"log/slog"
 	"net"
 	"net/http"
 	"net/http/httputil"
+	"net/url"
 	"os"
 	"runtime/debug"
 	"strings"
@@ -19,16 +21,10 @@ func Recovery(logger *slog.Logger) gin.HandlerFunc {
 			if panicValue == nil {
 				return
 			}
-			brokenPipe := false
-			if networkError, ok := panicValue.(*net.OpError); ok {
-				if syscallError, ok := networkError.Err.(*os.SyscallError); ok {
-					message := strings.ToLower(syscallError.Error())
-					brokenPipe = strings.Contains(message, "broken pipe") || strings.Contains(message, "connection reset by peer")
-				}
-			}
-			request, _ := httputil.DumpRequest(c.Request, false)
+			brokenPipe := isBrokenPipe(panicValue)
+			request := recoveryRequestDump(c.Request)
 			if logger != nil {
-				logger.ErrorContext(c.Request.Context(), "recovery from panic", "mod", "http", "error", panicValue, "request", string(request), "stack", string(debug.Stack()))
+				logger.ErrorContext(c.Request.Context(), "recovery from panic", "mod", "http", "error", panicValue, "request", request, "stack", string(debug.Stack()))
 			}
 			if brokenPipe {
 				if err, ok := panicValue.(error); ok {
@@ -42,3 +38,46 @@ func Recovery(logger *slog.Logger) gin.HandlerFunc {
 		c.Next()
 	}
 }
+
+func isBrokenPipe(value any) bool {
+	var networkError *net.OpError
+	if !errors.As(asError(value), &networkError) {
+		return false
+	}
+	var syscallError *os.SyscallError
+	if !errors.As(networkError, &syscallError) {
+		return false
+	}
+	message := strings.ToLower(syscallError.Error())
+	return strings.Contains(message, "broken pipe") || strings.Contains(message, "connection reset by peer")
+}
+
+func asError(value any) error {
+	err, _ := value.(error)
+	return err
+}
+
+func recoveryRequestDump(request *http.Request) string {
+	if request == nil {
+		return ""
+	}
+	clone := request.Clone(request.Context())
+	clone.Header = request.Header.Clone()
+	for key := range clone.Header {
+		switch strings.ToLower(key) {
+		case "authorization", "cookie", "set-cookie", "x-token", "proxy-authorization":
+			clone.Header[key] = []string{"***"}
+		}
+	}
+	if request.URL != nil {
+		clone.URL = new(url.URL)
+		*clone.URL = *request.URL
+		clone.URL.RawQuery = redactQuery(request.URL.RawQuery)
+		clone.RequestURI = clone.URL.RequestURI()
+	}
+	dumped, err := httputil.DumpRequest(clone, false)
+	if err != nil {
+		return clone.Method + " " + clone.RequestURI
+	}
+	return string(dumped)
+}

internal/server/middleware/recovery_test.go

@@ -0,0 +1,56 @@
+package middleware
+
+import (
+	"bytes"
+	"log/slog"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"strings"
+	"syscall"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+)
+
+func TestRecoveryRedactsCredentialsFromRequestDump(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	var output bytes.Buffer
+	logger := slog.New(slog.NewTextHandler(&output, nil))
+	engine := gin.New()
+	engine.Use(Recovery(logger))
+	engine.GET("/panic", func(*gin.Context) { panic("boom") })
+
+	request := httptest.NewRequest(http.MethodGet, "/panic?token=query-secret&room=orders", nil)
+	request.Header.Set("Authorization", "Bearer header-secret")
+	request.Header.Set("Cookie", "x-token=cookie-secret")
+	request.Header.Set("X-Trace-Id", "trace-id")
+	response := httptest.NewRecorder()
+	engine.ServeHTTP(response, request)
+
+	if response.Code != http.StatusInternalServerError {
+		t.Fatalf("status=%d, want %d", response.Code, http.StatusInternalServerError)
+	}
+	logText := output.String()
+	for _, secret := range []string{"query-secret", "header-secret", "cookie-secret"} {
+		if strings.Contains(logText, secret) {
+			t.Fatalf("recovery log leaked %q: %s", secret, logText)
+		}
+	}
+	if !strings.Contains(logText, "token=%2A%2A%2A") || !strings.Contains(logText, "Authorization: ***") || !strings.Contains(logText, "Cookie: ***") {
+		t.Fatalf("recovery log did not contain expected redaction: %s", logText)
+	}
+}
+
+func TestRecoveryDetectsWrappedBrokenPipe(t *testing.T) {
+	pipe := &net.OpError{Op: "write", Net: "tcp", Err: os.NewSyscallError("write", syscall.EPIPE)}
+	if !isBrokenPipe(wrappedBrokenPipeError{cause: pipe}) {
+		t.Fatal("wrapped broken-pipe error was not detected")
+	}
+}
+
+type wrappedBrokenPipeError struct{ cause error }
+
+func (wrappedBrokenPipeError) Error() string   { return "wrapped broken pipe" }
+func (e wrappedBrokenPipeError) Unwrap() error { return e.cause }