CalvinBackup/ctrld
1
0
Fork 0
mirror of https://github.com/Control-D-Inc/ctrld.git synced 2026-09-04 13:36:35 +02:00
Code Issues Packages Projects Releases Wiki Activity

security: default metrics server to loopback

Browse Source 
Fixes unauthenticated metrics exposure be defaulting to 127.0.0.1 when
no host is provided. Logs a warning when bound to non-loopback addresses.
This commit is contained in:
Codescribe
2026-08-21 14:48:20 +07:00
committed by Cuong Manh Le
parent dfaad4a20d
commit b74937fcf3
1 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/cli/metrics.go
+16
View File
@@ -113,6 +113,22 @@ func (p *prog) runMetricsServer(ctx context.Context, reloadCh chan struct{}) {
}
addr := p.cfg.Service.MetricsListener
if addr != "" {
host, port, err := net.SplitHostPort(addr)
if err != nil {
mainLog.Load().Warn().Err(err).Msgf("Invalid metrics listener address (%s); expected host:port", addr)
} else {
if host == "" {
host = "127.0.0.1"
addr = net.JoinHostPort(host, port)
}
ip := net.ParseIP(host)
if (ip != nil && !ip.IsLoopback()) || (ip == nil && host != "localhost") {
mainLog.Load().Warn().Msgf("Metrics server is bound to a non-loopback address (%s). This exposes sensitive data without authentication.", addr)
}
}
}
ms, err := newMetricsServer(addr, reg)
if err != nil {
mainLog.Load().Warn().Err(err).Msg("could not create new metrics server")