Re: [PATCH v5 31/58] perf gecko: Port gecko to use python module

sashiko-bot
2026-04-24T17:18:25Z

Sashiko AI review found 1 potential issue(s):
- [High] The local HTTP server exposes the entire current working directory to all local users without authentication, creating an information disclosure vulnerability.
--

commit b7680d27af3c4275fc4b69c75f01dad80db621ee
Author: Ian Rogers <irogers@google.com>

perf gecko: Port gecko to use python module

This commit ports the gecko script to use the perf python module directly.
This avoids creating intermediate dictionaries for all event fields, making
it significantly faster than using perf script callbacks.

> diff --git a/tools/perf/python/gecko.py b/tools/perf/python/gecko.py
> new file mode 100755
> index 00000000000000..cbcde6ec3c8b1d
> --- /dev/null
> +++ b/tools/perf/python/gecko.py

[ ... ]

> +class CORSRequestHandler(SimpleHTTPRequestHandler):
> + """Enable CORS for requests from profiler.firefox.com."""
> + def end_headers(self):
> + self.send_header('Access-Control-Allow-Origin', 'https://profiler.firefox.com')
> + super().end_headers()

Does this local HTTP server expose the entire current working directory to
all local users?

Since CORSRequestHandler inherits from SimpleHTTPRequestHandler, it appears
to serve all files and subdirectories of the current working directory by
default on the local network interface.

If the script is executed as root from a sensitive directory, could a local
unprivileged user on the same machine query the ephemeral port on 127.0.0.1
and download arbitrary files while the server runs?

Also, does the CORS header unconditionally allow https://profiler.firefox.com
to read any files served from this directory?

[ ... ]

> + # Create server in main thread to avoid race condition and find free port
> + server_address = ('127.0.0.1', 0)
> + try:
> + httpd = HTTPServer(server_address, CORSRequestHandler)
> + except OSError as e:
> + print(f"Error starting HTTP server: {e}", file=sys.stderr)
> + sys.exit(1)
> +
> + port = httpd.server_port
> +
> + def start_server():
> + httpd.serve_forever()
> +
> + thread = threading.Thread(target=start_server, daemon=True)
> + thread.start()

--
Sashiko AI review · https://sashiko.dev/#/patchset/20260424164721.2229025-1-irogers@google.com?part=31