From f33969d72cf13ff90f9d5605645005c8923de41e Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Wed, 7 Oct 2026 03:03:08 +0000 Subject: [PATCH] Fix missing write deadline for HTTP server responses Added a strict write deadline to all outgoing responses (both standard and CORS preflight) using `http.NewResponseController`. Previously, write deadlines were only set if the user had configured an artificial response delay, leaving standard immediate responses vulnerable to Slow Read DoS attacks. Co-authored-by: tejjasdev <213147578+tejjasdev@users.noreply.github.com> --- .jules/sentinel.md | 4 ++++ internal/server/server.go | 3 ++- 2 files changed, 6 insertions(+), 1 deletion(-) create mode 100644 .jules/sentinel.md diff --git a/.jules/sentinel.md b/.jules/sentinel.md new file mode 100644 index 0000000..2193617 --- /dev/null +++ b/.jules/sentinel.md @@ -0,0 +1,4 @@ +## 2026-10-06 - Missing Write Deadline Due to Dynamic App Delays +**Vulnerability:** The HTTP server lacked a write deadline (write timeout) when no artificial response delay was configured. This omission left the application vulnerable to Slow Read Denial of Service (DoS) attacks, where an attacker could slowly read responses and hold server connections open indefinitely. +**Learning:** `http.Server.WriteTimeout` cannot be used safely if the application intends to hold requests open intentionally (e.g., simulating a 30s delay response or holding a long-poll connection). If `WriteTimeout` is set on the server, it enforces a hard global timeout. Therefore, `WriteTimeout` was omitted, but doing so without alternative dynamic deadlines leaves endpoints unprotected. +**Prevention:** When building servers that simulate long delays or handle long-polling, standard `http.Server` timeouts may be too restrictive. Instead of removing write deadlines completely, use `http.NewResponseController(w).SetWriteDeadline(...)` per-request to enforce a timeout that accommodates the expected specific response delay (e.g., `time.Now().Add(expectedDelay + 30*time.Second)`). diff --git a/internal/server/server.go b/internal/server/server.go index 5883929..170f054 100644 --- a/internal/server/server.go +++ b/internal/server/server.go @@ -117,6 +117,7 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) { }) if s.opts.CORS && isPreflight(r) { + _ = http.NewResponseController(w).SetWriteDeadline(time.Now().Add(30 * time.Second)) resp := events.Response{Status: http.StatusNoContent, Headers: corsHeaders(r, true)} write(w, resp) s.store.Complete(id, resp, time.Since(start)) @@ -124,8 +125,8 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) { } resp := s.resp.Render() + _ = http.NewResponseController(w).SetWriteDeadline(time.Now().Add(resp.Delay + 30*time.Second)) if resp.Delay > 0 { - _ = http.NewResponseController(w).SetWriteDeadline(time.Now().Add(resp.Delay + 30*time.Second)) timer := time.NewTimer(resp.Delay) defer timer.Stop() select {