Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

`middleware.BodyDump`: data race — error response is written into a dump buffer already returned to `sync.Pool`

Aperta
  • Qualcosa non va?
#3,173 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@rajpreetcodes ci sta già lavorando.

Dal 14/10/2026.

  • #3174 di @rajpreetcodes — aperta

Valutazione

Difficoltà
3/5
Tempo stimato
Mezza giornata
Idoneità per principianti
62/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
go
Ambito
backend

Direzione di ricerca

Start in middleware/body_dump.go, where the response writer is installed with c.SetResponse and the dump buffer is returned to bodyDumpBufferPool, then check echo.go around serveHTTP to see when HTTPErrorHandler runs after the chain returns. Add a regression test based on the reproduction in the issue and run it with go test -race. Done means the race is gone, the writer is restored before BodyDump returns, and the error response body is unchanged.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Echo version: github.com/labstack/echo/v5 v5.4.0
Go version: 1.25

Summary

BodyDump installs a response-writer wrapper on the Context via c.SetResponse and never restores it. It also returns its dump buffer to bodyDumpBufferPool when the middleware returns.

Because Echo.serveHTTP invokes the global HTTPErrorHandler after the middleware chain has returned, the error response is written through the still-installed wrapper — landing in a *bytes.Buffer that has already been handed back to the pool.

Root cause

middleware/body_dump.go:

resBuf := bodyDumpBufferPool.Get().(*bytes.Buffer)   // L116
resBuf.Reset()
defer bodyDumpBufferPool.Put(resBuf)                 // L118  <- returned to pool
...
writer := &bodyDumpResponseWriter{...}
c.SetResponse(writer)                                // L134  <- never restored
err := next(c)                                       // L136
config.Handler(c, reqBody, resBuf.Bytes(), err)      // L139
return err                                           // L141  <- deferred Put runs here

echo.go:

err = e.preChain(c)          // L841
...
if err != nil {
    e.HTTPErrorHandler(c, err)   // L845  <- runs after the chain returned
}

So the ordering is: buffer returned to pool → error handler writes JSON → limitedWriter.Write (L193) → dumpBuf.Write on the pooled buffer.

Reproduction
package middleware_test

import (
	"bytes"
	"net/http"
	"net/http/httptest"
	"sync"
	"testing"

	"github.com/labstack/echo/v5"
	"github.com/labstack/echo/v5/middleware"
)

func TestBodyDumpErrorHandlerWritesToReturnedBuffer(t *testing.T) {
	e := echo.New()
	e.HTTPErrorHandler = func(c *echo.Context, err error) {
		_ = c.JSON(http.StatusOK, map[string]any{"error": err.Error()})
	}
	e.Pre(middleware.BodyDump(func(c *echo.Context, reqBody, rspBody []byte, err error) {}))
	e.POST("/err", func(c *echo.Context) error {
		return echo.NewHTTPError(http.StatusBadRequest, "boom")
	})

	var wg sync.WaitGroup
	for i := 0; i < 16; i++ {
		wg.Add(1)
		go func() {
			defer wg.Done()
			for j := 0; j < 500; j++ {
				req := httptest.NewRequest(http.MethodPost, "/err", bytes.NewReader(make([]byte, 256)))
				e.ServeHTTP(httptest.NewRecorder(), req)
			}
		}()
	}
	wg.Wait()
}

$ go test -race -run TestBodyDumpErrorHandlerWritesToReturnedBuffer ./middleware/
WARNING: DATA RACE
Write at 0x00c00028e0e0 by goroutine 11:
  bytes.(*Buffer).Write()
  middleware.(*limitedWriter).Write()
      middleware/body_dump.go:193
  middleware.(*bodyDumpResponseWriter).Write()
      middleware/body_dump.go:151
  echo.(*delayedStatusWriter).Write()
      response.go:157
  encoding/json.(*Encoder).Encode()
  echo.(*Context).JSON()
  main.TestBodyDumpErrorHandlerWritesToReturnedBuffer.func1()
  echo.(*Echo).serveHTTP()
      echo.go:845

The conflicting access is another request's reqBuf.Reset() at body_dump.go:94. Reproduced on every run (35–43 races per run with 16 goroutines × 500 requests).

Note this needs e.Pre(...) or e.Use(...) — either works, since HTTPErrorHandler is always called after the chain returns.

Impact
  • Genuine data race on bytes.Buffer internals — undefined behaviour per the Go memory model, flagged by -race.
  • The pool is shared by reqBuf (L93) and resBuf (L116), so the stale write can land in another request's reqBuf. BodyDump rebuilds c.Request().Body from that buffer (L111-113), so a concurrent request can have its request body corrupted before it reaches the handler — not just polluted dump output.
  • Client-visible responses are not affected: limitedWriter.Write (L184) writes to the real writer before mirroring into the dump buffer.
  • Intermittent by nature: sync.Pool may drop the object at GC, so it can go unnoticed in short runs.
Suggested fix

Restore the previous response writer before the middleware returns, so that writes occurring after the chain has unwound do not go through the wrapper:

prev := c.Response()
c.SetResponse(writer)
defer c.SetResponse(prev)

Either defer ordering works — the requirement is only that c.Response() is back to the previous writer by the time BodyDump returns.

Workaround

Wrap BodyDump and restore the writer after next returns:

inner := middleware.BodyDumpWithConfig(cfg)
return func(c *echo.Context) error {
	orig := c.Response()
	err := inner(next)(c)
	c.SetResponse(orig)
	return err
}

Or restore it in the global error handler:

if r, uerr := echo.UnwrapResponse(c.Response()); uerr == nil && r != nil {
	c.SetResponse(r)
}

Both verified to eliminate the race (-race clean, error response body unchanged).

Lingua principale
Go
Stelle
32.8k
Fork
5.1k
Merge medio
14h 51m
PR unite (30g)
32

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di labstack/echo

Tutte le issue di labstack/echo

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.