When building parallelized applications using Java, a developer sometimes finds himself with a thread being blocked indefinitely because of a four-year-old bug in the
spring-bean-web-rest-foo-bar-factory - dependency, possibly ruining the carefully orchestrated parallel architecture without any log message pointing to a problem.
Sometimes though, the developer also just forgets to allocate enough threads or forgets to set a timeout.
I have been there both.
So, usually, you would simply restart the application and take a thread dump using JStack or similar. But sometimes you are working in a thin Linux image on Docker with nothing more than a barebones JRE running the application and an irreproducible hangup that only occurs once per month and only with production workloads.
So, I was thinking of adding a (hidden) REST endpoint that will return a nice thread dump like this to the caller.
But of course, leaking technical information of the service to a possible end-user? That sounds like I created a gaping security hole for attackers to exploit. But maybe not? I mean, it's just a thread dump after all, you don't see what kind of information is being processed. Heap dumps would be much, much worse.
So, are publicly available thread dumps a security concern? I am very exited to see your answers.