Skip to content

response_writer: don't panic on Hijack/CloseNotify when wrapper unsupported#4645

Open
SAY-5 wants to merge 2 commits into
gin-gonic:masterfrom
SAY-5:fix/hijack-closenotify-typecheck-4638
Open

response_writer: don't panic on Hijack/CloseNotify when wrapper unsupported#4645
SAY-5 wants to merge 2 commits into
gin-gonic:masterfrom
SAY-5:fix/hijack-closenotify-typecheck-4638

Conversation

@SAY-5
Copy link
Copy Markdown

@SAY-5 SAY-5 commented May 2, 2026

Closes #4638. http.TimeoutHandler's timeoutWriter doesn't implement http.Hijacker/http.CloseNotifier, direct type assertion panics. Match the existing Flush() graceful-degradation pattern (#4479): return http.ErrNotSupported from Hijack and nil from CloseNotify.

…ported

Closes gin-gonic#4638. http.TimeoutHandler's writer doesn't implement http.Hijacker/CloseNotifier; mirror Flush's graceful degradation.
@codecov
Copy link
Copy Markdown

codecov Bot commented May 2, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.37%. Comparing base (3dc1cd6) to head (1182339).
⚠️ Report is 276 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #4645      +/-   ##
==========================================
- Coverage   99.21%   98.37%   -0.84%     
==========================================
  Files          42       48       +6     
  Lines        3182     3143      -39     
==========================================
- Hits         3157     3092      -65     
- Misses         17       42      +25     
- Partials        8        9       +1     
Flag Coverage Δ
?
--ldflags="-checklinkname=0" -tags sonic 98.36% <100.00%> (?)
-tags go_json 98.30% <100.00%> (?)
-tags nomsgpack 98.35% <100.00%> (?)
go-1.18 ?
go-1.19 ?
go-1.20 ?
go-1.21 ?
go-1.25 98.37% <100.00%> (?)
go-1.26 98.37% <100.00%> (?)
macos-latest 98.37% <100.00%> (-0.84%) ⬇️
ubuntu-latest 98.37% <100.00%> (-0.84%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@SAY-5
Copy link
Copy Markdown
Author

SAY-5 commented May 5, 2026

The only failing check is codecov/project (project-level coverage delta). codecov/patch itself passes. The patch is two early-return guards in response_writer.go for unsupported writer types; happy to add a short test if helpful but the check should not block.

@appleboy appleboy requested a review from Copilot May 9, 2026 02:23
@appleboy appleboy added this to the v1.13 milestone May 9, 2026
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates Gin’s responseWriter wrapper to gracefully degrade (instead of panicking) when the underlying http.ResponseWriter does not implement http.Hijacker or http.CloseNotifier, aligning behavior with the existing Flush() pattern.

Changes:

  • Replace direct type assertions in Hijack() with an ok check and return http.ErrNotSupported when unsupported.
  • Replace direct type assertions in CloseNotify() with an ok check and return nil when unsupported.
  • Update TestResponseWriterHijack to expect non-panicking behavior for unsupported interfaces.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File Description
response_writer.go Adds safe interface checks for Hijack()/CloseNotify() to avoid panics with wrappers like http.TimeoutHandler.
response_writer_test.go Updates tests to validate graceful degradation (no panic) when the underlying writer lacks Hijacker/CloseNotifier.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread response_writer.go
Comment on lines 118 to +122
w.size = 0
}
return w.ResponseWriter.(http.Hijacker).Hijack()
hijacker, ok := w.ResponseWriter.(http.Hijacker)
if !ok {
return nil, nil, http.ErrNotSupported
Comment thread response_writer_test.go
Comment on lines +121 to 122
require.ErrorIs(t, err, http.ErrNotSupported)
assert.True(t, w.Written())
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Unsafe type assertions in Hijack() and CloseNotify() cause panic with http.TimeoutHandler

3 participants