Fix GO-S2114 security issue

See https://deepsource.io/directory/analyzers/go/issues/GO-S2114
navidrome · Sep 27, 2022 · 2a3cd08 · 2a3cd08
1 parent a7a0e23
commit 2a3cd08
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/consts/consts.go b/consts/consts.go
@@ -41,6 +41,8 @@ const (
 	RequestThrottleBacklogLimit   = 100
 	RequestThrottleBacklogTimeout = time.Minute
 
+	ServerReadHeaderTimeout = 3 * time.Second
+
 	ArtistInfoTimeToLive = 24 * time.Hour
 
 	I18nFolder   = "i18n"

diff --git a/server/server.go b/server/server.go
@@ -45,7 +45,12 @@ var startTime = time.Now()
 func (s *Server) Run(addr string) error {
 	s.MountRouter("WebUI", consts.URLPathUI, s.frontendAssetsHandler())
 	log.Info("Navidrome server is ready!", "address", addr, "startupTime", time.Since(startTime))
-	return http.ListenAndServe(addr, s.router)
+	server := &http.Server{
+		Addr:              addr,
+		ReadHeaderTimeout: consts.ServerReadHeaderTimeout,
+	}
+
+	return server.ListenAndServe()
 }
 
 func (s *Server) initRoutes() {