mcp-server-semgrep/semgrep-rules/go/lang/security/audit/net/pprof.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: pprof-debug-exposure
  metadata:
    cwe:
    - 'CWE-489: Active Debug Code'
    owasp: 'A06:2017 - Security Misconfiguration'
    source-rule-url: https://github.com/securego/gosec#available-rules
    references:
    - https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/
    category: security
    technology:
    - go
    confidence: LOW
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
  message: >-
    The profiling 'pprof' endpoint is automatically exposed on /debug/pprof.
    This could leak information about the server.
    Instead, use `import "net/http/pprof"`. See
    https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/
    for more information and mitigation.
  languages: [go]
  severity: WARNING
  patterns:
  - pattern-inside: |
      import _ "net/http/pprof"
      ...
  - pattern-inside: |
      func $ANY(...) {
        ...
      }
  - pattern-not-inside: |
      $MUX = http.NewServeMux(...)
      ...
      http.ListenAndServe($ADDR, $MUX)
  - pattern-not: http.ListenAndServe("=~/^localhost.*/", ...)
  - pattern-not: http.ListenAndServe("=~/^127[.]0[.]0[.]1.*/", ...)
  - pattern: http.ListenAndServe(...)