CERBERUS/caddy
1
0
Fork 0
mirror of https://github.com/caddyserver/caddy.git synced 2026-06-28 04:41:41 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge b38b107000 into 13a4c3f43c

Browse source
This commit is contained in:
Gaurav Poudel 2026-06-22 23:13:15 +00:00 • committed by GitHub
commit ff0f1db4f2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 20 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

22
admin.go
View file

@ -267,9 +267,9 @@ func (admin *AdminConfig) newAdminHandler(addr NetworkAddress, remote bool, ctx
// register debugging endpoints
addRouteWithMetrics("/debug/pprof/", handlerLabel, http.HandlerFunc(pprof.Index))
addRouteWithMetrics("/debug/pprof/cmdline", handlerLabel, http.HandlerFunc(pprof.Cmdline))
addRouteWithMetrics("/debug/pprof/profile", handlerLabel, http.HandlerFunc(pprof.Profile))
addRouteWithMetrics("/debug/pprof/profile", handlerLabel, pprofRateLimited(http.HandlerFunc(pprof.Profile)))
addRouteWithMetrics("/debug/pprof/symbol", handlerLabel, http.HandlerFunc(pprof.Symbol))
addRouteWithMetrics("/debug/pprof/trace", handlerLabel, http.HandlerFunc(pprof.Trace))
addRouteWithMetrics("/debug/pprof/trace", handlerLabel, pprofRateLimited(http.HandlerFunc(pprof.Trace)))
addRouteWithMetrics("/debug/vars", handlerLabel, expvar.Handler())
// register third-party module endpoints
@ -1386,6 +1386,24 @@ func (e APIError) Error() string {
return e.Message
}
// pprofSem limits concurrent CPU-intensive pprof operations (profile, trace)
// to prevent a DoS via repeated 30-second profiling sessions.
var pprofSem = make(chan struct{}, 1)
// pprofRateLimited wraps an http.Handler so that at most one request is
// served at a time. Additional concurrent callers receive 429.
func pprofRateLimited(h http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
select {
case pprofSem <- struct{}{}:
defer func() { <-pprofSem }()
h.ServeHTTP(w, r)
default:
http.Error(w, "too many profiling requests; try again later", http.StatusTooManyRequests)
}
})
}
// parseAdminListenAddr extracts a singular listen address from either addr
// or defaultAddr, returning the network and the address of the listener.
func parseAdminListenAddr(addr string, defaultAddr string) (NetworkAddress, error) {