fix gosec G114 (Use of net/http serve function that has no support fo…

…r setting timeouts)

Signed-off-by: Markus Blaschke <[email protected]>

config/opts.go

@@ -16,10 +16,15 @@ type (
 			LogJson bool `           long:"log.json"     env:"LOG_JSON" description:"Switch log output to json format"`
 		}
 
-		General struct {
+		Server struct {
 			// general options
-			ServerBind string        `long:"bind"                env:"SERVER_BIND"   description:"Server address"                default:":8080"`
-			ScrapeTime time.Duration `long:"scrape-time"         env:"SCRAPE_TIME"   description:"Scrape time in seconds"        default:"1m"`
+			Bind         string        `long:"server.bind"       env:"SERVER_BIND"           description:"Server address"        default:":8080"`
+			ReadTimeout  time.Duration `long:"server.timeout.read"      env:"SERVER_TIMEOUT_READ"   description:"Server read timeout"   default:"5s"`
+			WriteTimeout time.Duration `long:"server.timeout.write"     env:"SERVER_TIMEOUT_WRITE"  description:"Server write timeout"  default:"10s"`
+		}
+
+		Scrape struct {
+			Time time.Duration `long:"scrape.time"   env:"SCRAPE_TIME"   description:"Scrape time in seconds"  default:"1m"`
 		}
 
 		// Api option

main.go

@@ -106,7 +106,7 @@ func main() {
 	log.Infof("starting manager")
 	scheduledEventsManager.Start()
 
-	log.Infof("starting http server on %s", opts.General.ServerBind)
+	log.Infof("starting http server on %s", opts.Server.Bind)
 	startHttpServer()
 }
 
@@ -219,15 +219,17 @@ func initArgparser() {
 }
 
 func startHttpServer() {
+	mux := http.NewServeMux()
+
 	// healthz
-	http.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) {
+	mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) {
 		if _, err := fmt.Fprint(w, "Ok"); err != nil {
 			log.Error(err)
 		}
 	})
 
 	// readyz
-	http.HandleFunc("/readyz", func(w http.ResponseWriter, r *http.Request) {
+	mux.HandleFunc("/readyz", func(w http.ResponseWriter, r *http.Request) {
 		if readyzStatus == 0 {
 			if _, err := fmt.Fprint(w, "Ok"); err != nil {
 				log.Error(err)
@@ -241,7 +243,7 @@ func startHttpServer() {
 	})
 
 	// drainz
-	http.HandleFunc("/drainz", func(w http.ResponseWriter, r *http.Request) {
+	mux.HandleFunc("/drainz", func(w http.ResponseWriter, r *http.Request) {
 		if drainzStatus == 0 {
 			if _, err := fmt.Fprint(w, "Ok"); err != nil {
 				log.Error(err)
@@ -254,6 +256,13 @@ func startHttpServer() {
 		}
 	})
 
-	http.Handle("/metrics", promhttp.Handler())
-	log.Fatal(http.ListenAndServe(opts.General.ServerBind, nil))
+	mux.Handle("/metrics", promhttp.Handler())
+
+	srv := &http.Server{
+		Addr:         opts.Server.Bind,
+		Handler:      mux,
+		ReadTimeout:  opts.Server.ReadTimeout,
+		WriteTimeout: opts.Server.WriteTimeout,
+	}
+	log.Fatal(srv.ListenAndServe())
 }

manager/manager.go

@@ -110,7 +110,7 @@ func (m *ScheduledEventsManager) Start() {
 	go func() {
 		for {
 			m.collect()
-			time.Sleep(m.Conf.General.ScrapeTime)
+			time.Sleep(m.Conf.Scrape.Time)
 		}
 	}()
 }