# Summary Report

## Issue
The `/pprof/heap` built-in handler passed the user-supplied `extra_options` query parameter directly into the `jeprof` command line. Attackers could inject shell metacharacters and execute arbitrary commands when heap profiling was enabled.

## Fix
- Added an allow-list (`g_extra_options_set`) of supported jemalloc profiling options and reject anything else with a warning.
- Replaced ad-hoc string concatenation with `butil::string_printf/string_appendf` to build the command safely, covering both the base invocation and the flamegraph pipe construction.
- Included the necessary headers for the new helpers.

## Validation
- `cmake --build /home/user/pruva/work/brpc-1.14.1/build --target brpc -j$(nproc)`
- `bash coding/verify_fix.sh`

> Note: The referenced `repro/reproduction_steps.sh` script was not present in the workspace, so compilation was used to validate the changes.