From ad53619b15fda20df57c16cf19fe83f4a428cefa Mon Sep 17 00:00:00 2001
From: Dustin Decker <dustindecker@protonmail.com>
Date: Sun, 23 Sep 2018 00:15:23 -0700
Subject: [PATCH] Don't log requests (#1370)

Fixes #1331

HTTP logging leaks sensitive request information.

This PR removes HTTP request logging during panics.
---
 recovery.go      |  8 ++++++--
 recovery_test.go | 12 +++++++++++-
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/recovery.go b/recovery.go
index 61c5bd53..6c28b4fa 100644
--- a/recovery.go
+++ b/recovery.go
@@ -39,8 +39,12 @@ func RecoveryWithWriter(out io.Writer) HandlerFunc {
 			if err := recover(); err != nil {
 				if logger != nil {
 					stack := stack(3)
-					httprequest, _ := httputil.DumpRequest(c.Request, false)
-					logger.Printf("[Recovery] %s panic recovered:\n%s\n%s\n%s%s", timeFormat(time.Now()), string(httprequest), err, stack, reset)
+					if IsDebugging() {
+						httprequest, _ := httputil.DumpRequest(c.Request, false)
+						logger.Printf("[Recovery] %s panic recovered:\n%s\n%s\n%s%s", timeFormat(time.Now()), string(httprequest), err, stack, reset)
+					} else {
+						logger.Printf("[Recovery] %s panic recovered:\n%s\n%s%s", timeFormat(time.Now()), err, stack, reset)
+					}
 				}
 				c.AbortWithStatus(http.StatusInternalServerError)
 			}
diff --git a/recovery_test.go b/recovery_test.go
index 53f4a071..7d422b74 100644
--- a/recovery_test.go
+++ b/recovery_test.go
@@ -24,9 +24,19 @@ func TestPanicInHandler(t *testing.T) {
 	w := performRequest(router, "GET", "/recovery")
 	// TEST
 	assert.Equal(t, http.StatusInternalServerError, w.Code)
-	assert.Contains(t, buffer.String(), "GET /recovery")
+	assert.Contains(t, buffer.String(), "panic recovered")
 	assert.Contains(t, buffer.String(), "Oupps, Houston, we have a problem")
 	assert.Contains(t, buffer.String(), "TestPanicInHandler")
+	assert.NotContains(t, buffer.String(), "GET /recovery")
+
+	// Debug mode prints the request
+	SetMode(DebugMode)
+	// RUN
+	w = performRequest(router, "GET", "/recovery")
+	// TEST
+	assert.Equal(t, http.StatusInternalServerError, w.Code)
+	assert.Contains(t, buffer.String(), "GET /recovery")
+
 }
 
 // TestPanicWithAbort assert that panic has been recovered even if context.Abort was used.