From d84dcb002c6426b9c89d373a6ca3a472f26c02b2 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Wed, 7 Oct 2026 23:37:03 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH]=20Fi?= =?UTF-8?q?x=20potential=20slowloris=20resource=20exhaustion?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add write deadlines to all HTTP responses to prevent slow readers from keeping connections open indefinitely. Previously, write deadlines were only set for responses with a configured delay. This change ensures that both CORS preflight responses and normal immediate responses also enforce a 30-second write timeout. Co-authored-by: tejjasdev <213147578+tejjasdev@users.noreply.github.com> --- .jules/sentinel.md | 4 ++++ internal/server/server.go | 3 ++- 2 files changed, 6 insertions(+), 1 deletion(-) create mode 100644 .jules/sentinel.md diff --git a/.jules/sentinel.md b/.jules/sentinel.md new file mode 100644 index 0000000..804c842 --- /dev/null +++ b/.jules/sentinel.md @@ -0,0 +1,4 @@ +## 2025-02-28 - Missing Write Deadline for HTTP Server Handlers +**Vulnerability:** The HTTP server handlers, including CORS preflight handling, missed an explicit write deadline for standard responses, potentially causing the server to hang or consume resources against a slow reader (slowloris-style attack). Only delayed responses had a write deadline configured previously. +**Learning:** `http.Server` configured with `ReadTimeout` does not apply to writing the response. Unless `WriteTimeout` is configured at the server level, or `SetWriteDeadline` is set explicitly on the ResponseController/connection per request, the handlers can block indefinitely when trying to send data to slow clients. +**Prevention:** Always ensure an explicit write deadline using `http.NewResponseController(w).SetWriteDeadline(...)` for every request before calling `w.Write`, or set a server-level `WriteTimeout`. diff --git a/internal/server/server.go b/internal/server/server.go index 5883929..170f054 100644 --- a/internal/server/server.go +++ b/internal/server/server.go @@ -117,6 +117,7 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) { }) if s.opts.CORS && isPreflight(r) { + _ = http.NewResponseController(w).SetWriteDeadline(time.Now().Add(30 * time.Second)) resp := events.Response{Status: http.StatusNoContent, Headers: corsHeaders(r, true)} write(w, resp) s.store.Complete(id, resp, time.Since(start)) @@ -124,8 +125,8 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) { } resp := s.resp.Render() + _ = http.NewResponseController(w).SetWriteDeadline(time.Now().Add(resp.Delay + 30*time.Second)) if resp.Delay > 0 { - _ = http.NewResponseController(w).SetWriteDeadline(time.Now().Add(resp.Delay + 30*time.Second)) timer := time.NewTimer(resp.Delay) defer timer.Stop() select {