Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

net/http/pprof: disallow package to register to the default mux in Go 2 #42834

Open
rakyll opened this issue Nov 25, 2020 · 1 comment
Open

net/http/pprof: disallow package to register to the default mux in Go 2 #42834

rakyll opened this issue Nov 25, 2020 · 1 comment
Milestone

Comments

@rakyll
Copy link
Contributor

@rakyll rakyll commented Nov 25, 2020

net/http/pprof registers handlers to the default mux at init time. In order to register the handlers on a custom mux, you still have to import to package and have the debug handlers registered to the default mux. This creates the situation everyone who has a direct or transient dependency to the net/http/pprof package has the debug handles registered.

This creates security issues and long-term maintenance problems where you want to 100% avoid the use of the default mux to make sure debug endpoints are never exposed to the Internet accidentally. Instead of the current model, export a new API that registers these handlers to the default mux if users want to opt in.

(I remember seeing a similar issue but couldn't find it, filing another one but please close if it's a duplicate.)

@cagedmantis cagedmantis changed the title Disallow net/http/pprof to register to the default mux in Go 2 net/http/pprof: disallow package to register to the default mux in Go 2 Dec 2, 2020
@cagedmantis cagedmantis added this to the Go 2 milestone Dec 2, 2020
@cagedmantis
Copy link
Contributor

@cagedmantis cagedmantis commented Dec 2, 2020

/cc @rsc

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
2 participants