# Risk map — gin-gonic/gin

> Canonical page: https://codevetter.com/unpack/gin/risk-map

# Risk map — gin-gonic/gin

Scanned commit 43fe48e8a0f44af783116cdb010725e6bb50255f (2026-09-29). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

The main source-observed security boundaries are forwarded identity, request logging, body buffering, and caller-controlled filesystem operations. Routing and global codec configuration also require careful lifecycle management. The observations below describe contracts and review hotspots, not confirmed vulnerabilities. Runtime exploitability, operational severity, and exhaustive test coverage were not established.
- New trusts all IPv4/IPv6 proxies by default; ClientIP accepts forwarded headers when the peer is trusted, and a nonempty TrustedPlatform header is returned before CIDR checking. — [gin.go#L227-L240](https://github.com/gin-gonic/gin/blob/43fe48e8a0f44af783116cdb010725e6bb50255f/gin.go#L227-L240) [context.go#L997-L1044](https://github.com/gin-gonic/gin/blob/43fe48e8a0f44af783116cdb010725e6bb50255f/context.go#L997-L1044) [docs/doc.md#L2591-L2599](https://github.com/gin-gonic/gin/blob/43fe48e8a0f44af783116cdb010725e6bb50255f/docs/doc.md#L2591-L2599)
- Recovery's request dump masks only Authorization; debug panic and broken-connection logging can retain other headers and the request target. Logger also includes RawQuery unless SkipQueryString is enabled. — [recovery.go#L70-L78](https://github.com/gin-gonic/gin/blob/43fe48e8a0f44af783116cdb010725e6bb50255f/recovery.go#L70-L78) [recovery.go#L94-L106](https://github.com/gin-gonic/gin/blob/43fe48e8a0f44af783116cdb010725e6bb50255f/recovery.go#L94-L106) [logger.go#L51-L54](https://github.com/gin-gonic/gin/blob/43fe48e8a0f44af783116cdb010725e6bb50255f/logger.go#L51-L54) [logger.go#L306-L312](https://github.com/gin-gonic/gin/blob/43fe48e8a0f44af783116cdb010725e6bb50255f/logger.go#L306-L312)
- SaveUploadedFile uses caller-supplied dst with MkdirAll and os.Create, without a root-confinement check in this helper; documentation explicitly warns against trusting file.Filename. — [context.go#L733-L767](https://github.com/gin-gonic/gin/blob/43fe48e8a0f44af783116cdb010725e6bb50255f/context.go#L733-L767) [docs/doc.md#L321-L336](https://github.com/gin-gonic/gin/blob/43fe48e8a0f44af783116cdb010725e6bb50255f/docs/doc.md#L321-L336)
- ShouldBindBodyWith buffers via io.ReadAll without setting a local size cap; multipart parsing uses memory thresholds, and the request-size test explicitly supplies http.MaxBytesReader. — [context.go#L950-L964](https://github.com/gin-gonic/gin/blob/43fe48e8a0f44af783116cdb010725e6bb50255f/context.go#L950-L964) [context.go#L707-L724](https://github.com/gin-gonic/gin/blob/43fe48e8a0f44af783116cdb010725e6bb50255f/context.go#L707-L724) [binding/form.go#L12-L28](https://github.com/gin-gonic/gin/blob/43fe48e8a0f44af783116cdb010725e6bb50255f/binding/form.go#L12-L28) [context_test.go#L2335-L2345](https://github.com/gin-gonic/gin/blob/43fe48e8a0f44af783116cdb010725e6bb50255f/context_test.go#L2335-L2345)
- node.addRoute is explicitly not concurrency-safe, while ServeHTTP reuses pooled Contexts; Copy detaches the response writer but shallowly clones Keys values and retains the Request pointer. — [tree.go#L133-L143](https://github.com/gin-gonic/gin/blob/43fe48e8a0f44af783116cdb010725e6bb50255f/tree.go#L133-L143) [gin.go#L691-L704](https://github.com/gin-gonic/gin/blob/43fe48e8a0f44af783116cdb010725e6bb50255f/gin.go#L691-L704) [context.go#L120-L145](https://github.com/gin-gonic/gin/blob/43fe48e8a0f44af783116cdb010725e6bb50255f/context.go#L120-L145)
- Run, RunTLS, and RunListener apply ReadHeaderTimeout, but the inspected RunUnix server supplies only Handler and RunQUIC delegates server construction to http3.ListenAndServeQUIC. — [gin.go#L176-L180](https://github.com/gin-gonic/gin/blob/43fe48e8a0f44af783116cdb010725e6bb50255f/gin.go#L176-L180) [gin.go#L618-L629](https://github.com/gin-gonic/gin/blob/43fe48e8a0f44af783116cdb010725e6bb50255f/gin.go#L618-L629) [gin.go#L657-L687](https://github.com/gin-gonic/gin/blob/43fe48e8a0f44af783116cdb010725e6bb50255f/gin.go#L657-L687)
- MustBindWith's 413 branch depends on propagation of http.MaxBytesError; source comments identify codec differences, and the test expects 400 specifically for go-json. — [context.go#L832-L845](https://github.com/gin-gonic/gin/blob/43fe48e8a0f44af783116cdb010725e6bb50255f/context.go#L832-L845) [context_test.go#L2323-L2350](https://github.com/gin-gonic/gin/blob/43fe48e8a0f44af783116cdb010725e6bb50255f/context_test.go#L2323-L2350)
- Basic authentication retains base64 credential headers in middleware memory and compares them directly; transport encryption and cookie Secure/HttpOnly settings are separate caller-controlled boundaries. — [auth.go#L32-L41](https://github.com/gin-gonic/gin/blob/43fe48e8a0f44af783116cdb010725e6bb50255f/auth.go#L32-L41) [auth.go#L76-L93](https://github.com/gin-gonic/gin/blob/43fe48e8a0f44af783116cdb010725e6bb50255f/auth.go#L76-L93) [gin.go#L585-L606](https://github.com/gin-gonic/gin/blob/43fe48e8a0f44af783116cdb010725e6bb50255f/gin.go#L585-L606) [context.go#L1158-L1171](https://github.com/gin-gonic/gin/blob/43fe48e8a0f44af783116cdb010725e6bb50255f/context.go#L1158-L1171)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)