Linter: gosec, Rule: G112 - Potential slowloris attack. Should we enable it?

[zak-pawel]

Use Case

This issue starts discussion about enabling:

• linter: gosec - Inspects source code for security problems by scanning the Go AST.
• rule: G112 - Potential slowloris attack

Rule is mapped to CWE-400: Uncontrolled Resource Consumption.

Expected behavior

Decision if rule should be enabled or not.

Actual behavior

For this rule following findings were found in current code:

plugins/inputs/influxdb_v2_listener/influxdb_v2_listener.go:132:13  gosec  G112: Potential Slowloris Attack because ReadHeaderTimeout is not configured in the http.Server
plugins/inputs/webhooks/webhooks.go:91:12                           gosec  G112: Potential Slowloris Attack because ReadHeaderTimeout is not configured in the http.Server
plugins/inputs/zipkin/zipkin.go:93:14                               gosec  G112: Potential Slowloris Attack because ReadHeaderTimeout is not configured in the http.Server
plugins/outputs/prometheus_client/prometheus_client.go:144:14       gosec  G112: Potential Slowloris Attack because ReadHeaderTimeout is not configured in the http.Server

Additional info

For this rule no additional configuration can be provided.

[powersj]

+1 seems wise to set

[zak-pawel]

More info: https://deepsource.io/directory/analyzers/go/issues/GO-S2112