Function SanitizedDefaultServeMux

x/server.go:123–135

SanitizedDefaultServeMux returns an http.Handler that wraps http.DefaultServeMux but blocks endpoints that expose the full process command line (which may include the admin token from --security "token=..."): - /debug/pprof/cmdline — registered by net/http/pprof - /debug/vars — served with

()

//   - /debug/pprof/cmdline — registered by net/http/pprof
//   - /debug/vars          — served with a filtered handler that omits "cmdline"
func SanitizedDefaultServeMux() http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.URL.Path == "/debug/pprof/cmdline" {
			http.NotFound(w, r)
			return
		}
		if r.URL.Path == "/debug/vars" {
			filteredExpvarHandler(w, r)
			return
		}
		http.DefaultServeMux.ServeHTTP(w, r)
	})
}