🩹 fix: Timeout middleware not enforced

middleware/timeout/timeout.go

@@ -32,30 +32,60 @@ func New(h fiber.Handler, config ...Config) fiber.Handler {
 			ctx.SetContext(parent)
 		}()
 
-		err := runHandler(ctx, h, cfg)
+		return runHandler(ctx, h, cfg)
+	}
+}
 
-		if errors.Is(tCtx.Err(), context.DeadlineExceeded) && err == nil {
-			if cfg.OnTimeout != nil {
-				return cfg.OnTimeout(ctx)
+func safeCall(fn func() error) error {
+	err := error(nil)
+	func() {
+		defer func() {
+			if r := recover(); r != nil {
+				err = fiber.ErrRequestTimeout
 			}
-			return fiber.ErrRequestTimeout
-		}
-		return err
-	}
+		}()
+		err = fn()
+	}()
+	return err
 }
 
 // runHandler executes the handler and returns fiber.ErrRequestTimeout if it
 // sees a deadline exceeded error or one of the custom "timeout-like" errors.
 func runHandler(c fiber.Ctx, h fiber.Handler, cfg Config) error {
-	err := h(c)
-	if err != nil && (errors.Is(err, context.DeadlineExceeded) || (len(cfg.Errors) > 0 && isCustomError(err, cfg.Errors))) {
-		if cfg.OnTimeout != nil {
-			if toErr := cfg.OnTimeout(c); toErr != nil {
-				return toErr
+	done := make(chan error, 1)
+	panicChan := make(chan any, 1)
+
+	go func() {
+		defer func() {
+			if p := recover(); p != nil {
+				panicChan <- p
+			}
+		}()
+		done <- h(c)
+	}()
+
+	err := safeCall(func() error {
+		select {
+		case err := <-done:
+			if err != nil && (errors.Is(err, context.DeadlineExceeded) || (len(cfg.Errors) > 0 && isCustomError(err, cfg.Errors))) {
+				if cfg.OnTimeout != nil {
+					if toErr := cfg.OnTimeout(c); toErr != nil {
+						return toErr
+					}
+				}
+				return fiber.ErrRequestTimeout
+			}
+			return err
+		case <-panicChan:
+			return fiber.ErrRequestTimeout
+		case <-c.Context().Done():
+			if cfg.OnTimeout != nil {
+				return cfg.OnTimeout(c)
 			}
+			return fiber.ErrRequestTimeout
 		}
-		return fiber.ErrRequestTimeout
-	}
+	})
+
 	return err
 }
 

middleware/timeout/timeout_test.go

@@ -211,3 +211,111 @@
 	require.True(t, called)
 	require.EqualError(t, err, "handled")
 }
+
+// TestTimeout_Issue_3671 tests various edge cases for the timeout middleware.
+func TestTimeout_Issue_3671(t *testing.T) {
+	t.Parallel()
+	app := fiber.New()
+	testCases := []struct {
+		name       string
+		path       string
+		handler    fiber.Handler
+		config     Config
+		expectCode int
+	}{
+		{
+			name: "Handler panics after timeout",
+			path: "/panic-after-timeout",
+			handler: func(_ fiber.Ctx) error {
+				time.Sleep(50 * time.Millisecond)
+				panic("panic after timeout")
+			},
+			config:     Config{Timeout: 10 * time.Millisecond},
+			expectCode: fiber.StatusRequestTimeout,
+		},
+		{
+			name: "Handler blocks forever",
+			path: "/block-forever",
+			handler: func(_ fiber.Ctx) error {
+				select {} // Block forever
+			},
+			config:     Config{Timeout: 10 * time.Millisecond},
+			expectCode: fiber.StatusRequestTimeout,
+		},
+		{
+			name: "Timeout set to 1 nanosecond",
+			path: "/nano",
+			handler: func(c fiber.Ctx) error {
+				time.Sleep(1 * time.Millisecond)
+				return c.SendString("late")
+			},
+			config:     Config{Timeout: 1 * time.Nanosecond},
+			expectCode: fiber.StatusRequestTimeout,
+		},
+		{
+			name: "Timeout set to a very large value",
+			path: "/maxint",
+			handler: func(c fiber.Ctx) error {
+				return c.SendString("ok")
+			},
+			config:     Config{Timeout: 1<<63 - 1},
+			expectCode: fiber.StatusOK,
+		},
+		{
+			name: "Custom OnTimeout handler panics",
+			path: "/panic-ontimeout",
+			handler: func(_ fiber.Ctx) error {
+				time.Sleep(50 * time.Millisecond)
+				return nil
+			},
+			config: Config{
+				Timeout: 10 * time.Millisecond,
+				OnTimeout: func(_ fiber.Ctx) error {
+					panic("custom panic on timeout")
+				},
+			},
+			expectCode: fiber.StatusRequestTimeout,
+		},
+		{
+			name: "Custom OnTimeout",
+			path: "/panic-ontimeout",
+			handler: func(c fiber.Ctx) error {
+				if err := sleepWithContext(c.Context(), 100*time.Millisecond, context.DeadlineExceeded); err != nil {
+					return err
+				}
+				return c.SendString("should not reach")
+			},
+			config: Config{
+				Timeout: 20 * time.Millisecond,
+				OnTimeout: func(c fiber.Ctx) error {
+					return c.Status(408).JSON(fiber.Map{"error": "timeout"})
+				},
+			},
+			expectCode: fiber.StatusRequestTimeout,
+		},
+	}
+
+	for _, tc := range testCases {
+		app.Get(tc.path, New(tc.handler, tc.config))
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			req := httptest.NewRequest(fiber.MethodGet, tc.path, nil)
+			resp, err := app.Test(req)
+
+			require.NoError(t, err)
+			require.Equal(t, tc.expectCode, resp.StatusCode)
+		})
+	}
+}
+
+func TestSafeCall_Panic(t *testing.T) {
+	t.Parallel()
+	err := safeCall(func() error {
+		panic("test panic")
+	})
+
+	require.Equal(t, fiber.ErrRequestTimeout, err)
+}