BUG/MEDIUM: pprof: remove pprof from user defined mapping

oktalz · oktalz · commit 02035e8bae4d · 2025-08-13T15:49:30.000+02:00
pprof should only be allowed to be read from controller admin port, not on the same frontent as normal traffic
diff --git a/.aspell.yml b/.aspell.yml
@@ -61,3 +61,5 @@ allowed:
   - gwapi
   - init
   - svc
+  - frontent
+  - pprof
diff --git a/pkg/controller/handler.go b/pkg/controller/handler.go
@@ -65,10 +65,6 @@ func (c *HAProxyController) initHandlers() {
 			},
 		}
 	}
-	// Need to be before Refresh. If after, maps are refreshed without pprof content
-	if c.osArgs.PprofEnabled {
-		c.beforeUpdateHandlers = append(c.beforeUpdateHandlers, handler.Pprof{})
-	}
 
 	if !c.osArgs.DisableQuic {
 		c.updateHandlers = append(c.updateHandlers, &handler.Quic{
diff --git a/pkg/handler/pprof.go b/pkg/handler/pprof.go

-Original file line number
+Diff line change
   - gwapi
   - init
   - svc
 +  - frontent
 +  - pprof
Original file line number	Diff line number	Diff line change
`@@ -65,10 +65,6 @@ func (c *HAProxyController) initHandlers() {`
`65`	`65`	`},`
`66`	`66`	`}`
`67`	`67`	`}`
`68`		`- // Need to be before Refresh. If after, maps are refreshed without pprof content`
`69`		`- if c.osArgs.PprofEnabled {`
`70`		`- c.beforeUpdateHandlers = append(c.beforeUpdateHandlers, handler.Pprof{})`
`71`		`- }`
`72`	`68`
`73`	`69`	`if !c.osArgs.DisableQuic {`
`74`	`70`	`c.updateHandlers = append(c.updateHandlers, &handler.Quic{`