search

hossein1376 / grape

Modern, zero-dependency HTTP library for Go
https://pkg.go.dev/github.com/hossein1376/grape
MIT License
149 stars 5 forks source link

Fix header timeout vulnerability and add linters #3

Closed janvhs closed 5 months ago

janvhs commented 5 months ago

Hi, while reading through your source, I noticed that you were not setting a timeout for reading the client's header. This is a security vulnerability, since the server would chew on those in indefinitely.

Because these types of errors can be detected via golangci-lint, I added a configuration for it. If you want, I would add my good documented nix flake as well, since it is useful to get the newest go version.

Feel free to make any changes. I tried to explain each change in the commit messages ^^

hossein1376 commented 5 months ago

Looks good to me! Appreciate your contribution :)