RHINENG-12951: fix CWE-918

RedHatInsights · Oct 7, 2024 · f815954 · f815954
1 parent 0ccb679
commit f815954
Showing 1 changed file with 8 additions and 1 deletion.
diff --git a/turnpike/controllers/admin.go b/turnpike/controllers/admin.go
@@ -290,10 +290,17 @@ func GetManagerPprof(c *gin.Context) {
 	pprofHandler(c, utils.CoreCfg.ManagerPrivateAddress)
 }
 
+var paramRegexp = regexp.MustCompile("^(heap|profile|block|mutex|trace)$")
+
 func pprofHandler(c *gin.Context, address string) {
 	query := c.Request.URL.RawQuery
 	param := c.Param("param")
-	data, err := getPprof(address, param, query)
+	match := paramRegexp.FindStringSubmatch(param)
+	if len(match) < 1 {
+		c.Status(http.StatusBadRequest)
+		return
+	}
+	data, err := getPprof(address, match[0], query)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"err": err.Error()})
 		return