linting: gosec: fix or suppress G112, G114 in test code
Updating test-code only; set ReadHeaderTimeout for some, or suppress the linter
error for others.
contrib/httpserver/server.go:11:12: G114: Use of net/http serve function that has no support for setting timeouts (gosec)
log.Panic(http.ListenAndServe(":80", nil))
^
integration/plugin/logging/cmd/close_on_start/main.go:42:12: G112: Potential Slowloris Attack because ReadHeaderTimeout is not configured in the http.Server (gosec)
server := http.Server{
Addr: l.Addr().String(),
Handler: mux,
}
integration/plugin/logging/cmd/discard/main.go:17:12: G112: Potential Slowloris Attack because ReadHeaderTimeout is not configured in the http.Server (gosec)
server := http.Server{
Addr: l.Addr().String(),
Handler: mux,
}
integration/plugin/logging/cmd/dummy/main.go:14:12: G112: Potential Slowloris Attack because ReadHeaderTimeout is not configured in the http.Server (gosec)
server := http.Server{
Addr: l.Addr().String(),
Handler: http.NewServeMux(),
}
integration/plugin/volumes/cmd/dummy/main.go:14:12: G112: Potential Slowloris Attack because ReadHeaderTimeout is not configured in the http.Server (gosec)
server := http.Server{
Addr: l.Addr().String(),
Handler: http.NewServeMux(),
}
testutil/fixtures/plugin/basic/basic.go:25:12: G112: Potential Slowloris Attack because ReadHeaderTimeout is not configured in the http.Server (gosec)
server := http.Server{
Addr: l.Addr().String(),
Handler: http.NewServeMux(),
}
volume/testutils/testutils.go:170:5: G114: Use of net/http serve function that has no support for setting timeouts (gosec)
go http.Serve(l, mux)
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Sebastiaan van Stijn authored on 2022/09/04 21:44:55Showing 7 changed files
- contrib/httpserver/server.go
- integration/plugin/logging/cmd/close_on_start/main.go
- integration/plugin/logging/cmd/discard/main.go
- integration/plugin/logging/cmd/dummy/main.go
- integration/plugin/volumes/cmd/dummy/main.go
- testutil/fixtures/plugin/basic/basic.go
- volume/testutils/testutils.go
| ... | ... |
@@ -8,5 +8,5 @@ import ( |
| 8 | 8 |
func main() {
|
| 9 | 9 |
fs := http.FileServer(http.Dir("/static"))
|
| 10 | 10 |
http.Handle("/", fs)
|
| 11 |
- log.Panic(http.ListenAndServe(":80", nil))
|
|
| 11 |
+ log.Panic(http.ListenAndServe(":80", nil)) // #nosec G114 -- Ignoring for test-code: G114: Use of net/http serve function that has no support for setting timeouts (gosec)
|
|
| 12 | 12 |
} |
| ... | ... |
@@ -6,6 +6,7 @@ import ( |
| 6 | 6 |
"net" |
| 7 | 7 |
"net/http" |
| 8 | 8 |
"os" |
| 9 |
+ "time" |
|
| 9 | 10 |
) |
| 10 | 11 |
|
| 11 | 12 |
type start struct {
|
| ... | ... |
@@ -40,8 +41,9 @@ func main() {
|
| 40 | 40 |
fmt.Fprintln(w, `{}`)
|
| 41 | 41 |
}) |
| 42 | 42 |
server := http.Server{
|
| 43 |
- Addr: l.Addr().String(), |
|
| 44 |
- Handler: mux, |
|
| 43 |
+ Addr: l.Addr().String(), |
|
| 44 |
+ Handler: mux, |
|
| 45 |
+ ReadHeaderTimeout: 2 * time.Second, // This server is not for production code; picked an arbitrary timeout to statisfy gosec (G112: Potential Slowloris Attack) |
|
| 45 | 46 |
} |
| 46 | 47 |
|
| 47 | 48 |
server.Serve(l) |
| ... | ... |
@@ -3,6 +3,7 @@ package main |
| 3 | 3 |
import ( |
| 4 | 4 |
"net" |
| 5 | 5 |
"net/http" |
| 6 |
+ "time" |
|
| 6 | 7 |
) |
| 7 | 8 |
|
| 8 | 9 |
func main() {
|
| ... | ... |
@@ -15,8 +16,9 @@ func main() {
|
| 15 | 15 |
handle(mux) |
| 16 | 16 |
|
| 17 | 17 |
server := http.Server{
|
| 18 |
- Addr: l.Addr().String(), |
|
| 19 |
- Handler: mux, |
|
| 18 |
+ Addr: l.Addr().String(), |
|
| 19 |
+ Handler: mux, |
|
| 20 |
+ ReadHeaderTimeout: 2 * time.Second, // This server is not for production code; picked an arbitrary timeout to statisfy gosec (G112: Potential Slowloris Attack) |
|
| 20 | 21 |
} |
| 21 | 22 |
server.Serve(l) |
| 22 | 23 |
} |
| ... | ... |
@@ -3,6 +3,7 @@ package main |
| 3 | 3 |
import ( |
| 4 | 4 |
"net" |
| 5 | 5 |
"net/http" |
| 6 |
+ "time" |
|
| 6 | 7 |
) |
| 7 | 8 |
|
| 8 | 9 |
func main() {
|
| ... | ... |
@@ -12,8 +13,9 @@ func main() {
|
| 12 | 12 |
} |
| 13 | 13 |
|
| 14 | 14 |
server := http.Server{
|
| 15 |
- Addr: l.Addr().String(), |
|
| 16 |
- Handler: http.NewServeMux(), |
|
| 15 |
+ Addr: l.Addr().String(), |
|
| 16 |
+ Handler: http.NewServeMux(), |
|
| 17 |
+ ReadHeaderTimeout: 2 * time.Second, // This server is not for production code; picked an arbitrary timeout to statisfy gosec (G112: Potential Slowloris Attack) |
|
| 17 | 18 |
} |
| 18 | 19 |
server.Serve(l) |
| 19 | 20 |
} |
| ... | ... |
@@ -3,6 +3,7 @@ package main |
| 3 | 3 |
import ( |
| 4 | 4 |
"net" |
| 5 | 5 |
"net/http" |
| 6 |
+ "time" |
|
| 6 | 7 |
) |
| 7 | 8 |
|
| 8 | 9 |
func main() {
|
| ... | ... |
@@ -12,8 +13,9 @@ func main() {
|
| 12 | 12 |
} |
| 13 | 13 |
|
| 14 | 14 |
server := http.Server{
|
| 15 |
- Addr: l.Addr().String(), |
|
| 16 |
- Handler: http.NewServeMux(), |
|
| 15 |
+ Addr: l.Addr().String(), |
|
| 16 |
+ Handler: http.NewServeMux(), |
|
| 17 |
+ ReadHeaderTimeout: 2 * time.Second, // This server is not for production code; picked an arbitrary timeout to statisfy gosec (G112: Potential Slowloris Attack) |
|
| 17 | 18 |
} |
| 18 | 19 |
server.Serve(l) |
| 19 | 20 |
} |
| ... | ... |
@@ -6,6 +6,7 @@ import ( |
| 6 | 6 |
"net/http" |
| 7 | 7 |
"os" |
| 8 | 8 |
"path/filepath" |
| 9 |
+ "time" |
|
| 9 | 10 |
) |
| 10 | 11 |
|
| 11 | 12 |
func main() {
|
| ... | ... |
@@ -23,8 +24,9 @@ func main() {
|
| 23 | 23 |
|
| 24 | 24 |
mux := http.NewServeMux() |
| 25 | 25 |
server := http.Server{
|
| 26 |
- Addr: l.Addr().String(), |
|
| 27 |
- Handler: http.NewServeMux(), |
|
| 26 |
+ Addr: l.Addr().String(), |
|
| 27 |
+ Handler: http.NewServeMux(), |
|
| 28 |
+ ReadHeaderTimeout: 2 * time.Second, // This server is not for production code; picked an arbitrary timeout to statisfy gosec (G112: Potential Slowloris Attack) |
|
| 28 | 29 |
} |
| 29 | 30 |
mux.HandleFunc("/Plugin.Activate", func(w http.ResponseWriter, r *http.Request) {
|
| 30 | 31 |
w.Header().Set("Content-Type", "application/vnd.docker.plugins.v1.1+json")
|
| ... | ... |
@@ -167,7 +167,7 @@ func MakeFakePlugin(d volume.Driver, l net.Listener) (plugingetter.CompatPlugin, |
| 167 | 167 |
w.Write([]byte("{}"))
|
| 168 | 168 |
}) |
| 169 | 169 |
|
| 170 |
- go http.Serve(l, mux) |
|
| 170 |
+ go http.Serve(l, mux) // #nosec G114 -- Ignoring for test-code: G114: Use of net/http serve function that has no support for setting timeouts (gosec) |
|
| 171 | 171 |
return &fakePlugin{client: c, name: d.Name()}, nil
|
| 172 | 172 |
} |
| 173 | 173 |
|