From 55cc794ed7bde8874a5856f771959f0a79657b50 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Tue, 13 Oct 2026 23:22:42 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[MEDIUM]=20?= =?UTF-8?q?Fix=20missing=20WriteTimeout=20configuration?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * **Severity:** MEDIUM * **Vulnerability:** The HTTP server lacked a default `WriteTimeout` (or `WriteDeadline`) for responses that had no configured delay. * **Impact:** A malicious client could perform a Slowloris-style slow-read attack, keeping connections open indefinitely and causing resource exhaustion. * **Fix:** Moved the `SetWriteDeadline` call outside the conditional check for `resp.Delay > 0` in `internal/server/server.go`. This ensures all responses have a default 30-second write deadline (plus any configured delay) unconditionally. * **Verification:** Ran test suite (`make check`) to ensure no regressions were introduced. Co-authored-by: tejjasdev <213147578+tejjasdev@users.noreply.github.com> --- .jules/sentinel.md | 4 ++++ internal/server/server.go | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) create mode 100644 .jules/sentinel.md diff --git a/.jules/sentinel.md b/.jules/sentinel.md new file mode 100644 index 0000000..644de2f --- /dev/null +++ b/.jules/sentinel.md @@ -0,0 +1,4 @@ +## 2024-05-18 - Missing WriteTimeout +**Vulnerability:** The HTTP server in `internal/server/server.go` was missing a default `WriteTimeout` configuration when there was no request delay (`resp.Delay > 0`), which leaves the server vulnerable to resource exhaustion or Slowloris-style slow-read attacks. +**Learning:** In Go `net/http` servers with dynamic response delay configurations, developers sometimes forget to apply the timeout universally. Here, the `SetWriteDeadline` call was inside the `if resp.Delay > 0` condition, meaning that without a configured delay, connections could potentially hang open indefinitely waiting for client reads. +**Prevention:** Always ensure that network connections have bounded wait/read/write times (deadlines or timeouts). When using Go 1.20+ `http.ResponseController(w).SetWriteDeadline()`, configure a generous base deadline globally, even if the primary goal is supporting long deliberate delays. diff --git a/internal/server/server.go b/internal/server/server.go index 5883929..a39f2e9 100644 --- a/internal/server/server.go +++ b/internal/server/server.go @@ -124,8 +124,8 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) { } resp := s.resp.Render() + _ = http.NewResponseController(w).SetWriteDeadline(time.Now().Add(resp.Delay + 30*time.Second)) if resp.Delay > 0 { - _ = http.NewResponseController(w).SetWriteDeadline(time.Now().Add(resp.Delay + 30*time.Second)) timer := time.NewTimer(resp.Delay) defer timer.Stop() select {