checker: go_pprof_endpoint_automatic_exposure

[Thiru-moorthi]

Description

This PR introduces a Go checker that detects imports of the net/http/pprof package, which automatically exposes the /debug/pprof endpoint.

Detection Logic

The checker flags instances where the "net/http/pprof" package is imported, even with a blank identifier.

Why is this a problem?

• Information Disclosure: Exposes runtime details (goroutines, heap, CPU profiles) that attackers can exploit.
• Production Risk: Accessible endpoints can leak sensitive operational data.
• Security Concern: Profiling information should not be publicly exposed in production environments.

Remediation Steps

Option 1: Remove in Production

Use build tags to include pprof only in non-production builds:

//go:build debug
import _ "net/http/pprof"

Exclusions

test/**,*_test.rb,tests/**,__tests__/**

References

pprof security considerations

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

1 Skipped Deployment

Name	Status	Preview	Comments	Updated (UTC)
globstar	⬜️ Ignored (Inspect)	Visit Preview		Feb 25, 2025 0:50am