github-starred/gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-07-21 04:02:17 -05:00
Code Issues 2.6k Packages Projects Releases 100 Wiki Activity

pprof is public accessible even when ENABLE_PPROF=false #2350

New Issue
Closed
opened 2025-11-02 04:33:34 -06:00 by GiteaMirror · 1 comment
GiteaMirror commented 2025-11-02 04:33:34 -06:00
Owner
Copy Link
Copy Source

Originally created by @krombel on GitHub (Sep 20, 2018).

Description

I do not expect to have those debug information public available.

Those get added in go-macaron/toolbox
https://github.com/go-gitea/gitea/blob/364c02924607eeebbe7d76983a7c5e45e9017fe0/vendor/github.com/go-macaron/toolbox/toolbox.go#L136-L140
which got added in #1290:
https://github.com/go-gitea/gitea/blob/364c02924607eeebbe7d76983a7c5e45e9017fe0/routers/routes/routes.go#L127-L134

Badly there does not seem to be an option to disable this without removing the Toolbox completly.

//EDIT: As a temporary workaround I added this to my nginx config:

        location /debug {
                return 403;
        }
Originally created by @krombel on GitHub (Sep 20, 2018). - Gitea version (or commit ref): 364c029 - Can you reproduce the bug at https://try.gitea.io: - [x] Yes: e.g. https://try.gitea.io/debug/pprof/heap?debug=1 ## Description I do not expect to have those debug information public available. Those get added in go-macaron/toolbox https://github.com/go-gitea/gitea/blob/364c02924607eeebbe7d76983a7c5e45e9017fe0/vendor/github.com/go-macaron/toolbox/toolbox.go#L136-L140 which got added in [#1290](https://github.com/go-gitea/gitea/pull/1290/files#diff-7aa71b75b5fddf1332a485052ffbca9aR117): https://github.com/go-gitea/gitea/blob/364c02924607eeebbe7d76983a7c5e45e9017fe0/routers/routes/routes.go#L127-L134 Badly there does not seem to be an option to disable this without removing the Toolbox completly. //EDIT: As a temporary workaround I added this to my nginx config: ``` location /debug { return 403; } ```
GiteaMirror added the type/bug label 2025-11-02 04:33:34 -06:00
GiteaMirror commented 2025-11-02 04:33:35 -06:00
Author
Owner
Copy Link
Copy Source

@L-P commented on GitHub (Sep 26, 2018):

I can confirm this issue is present on the official v1.5.1 docker image.

@L-P commented on GitHub (Sep 26, 2018): I can confirm this issue is present on the official v1.5.1 docker image.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
$20
$250
$50
$500
backport/done
💎 Bounty
docs-update-needed
good first issue
hacktoberfest
issue/bounty
issue/confirmed
issue/critical
issue/duplicate
issue/needs-feedback
issue/not-a-bug
issue/regression
issue/stale
issue/workaround
lgtm/need 2
modifies/api
modifies/translation
outdated/backport/v1.18
outdated/theme/markdown
outdated/theme/timetracker
performance/bigrepo
performance/cpu
performance/memory
performance/speed
pr/breaking
proposal/accepted
proposal/rejected
pr/wip
pull-request
Mirrored from GitHub Pull Request
 reviewed/wontfix
💰 Rewarded
skip-changelog
status/blocked
topic/accessibility
topic/api
topic/authentication
topic/build
topic/code-linting
topic/commit-signing
topic/content-rendering
topic/deployment
topic/distribution
topic/federation
topic/gitea-actions
topic/issues
topic/lfs
topic/mobile
topic/moderation
topic/packages
topic/pr
topic/projects
topic/repo
topic/repo-migration
topic/security
topic/theme
topic/ui
topic/ui-interaction
topic/ux
topic/webhooks
topic/wiki
type/bug
type/deprecation
type/docs
type/enhancement
type/feature
type/miscellaneous
type/proposal
type/question
type/refactoring
type/summary
type/testing
type/upstream
No labels type/bug
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/gitea#2350