From a84c877e5669708e9ff2b8f8bb487a5f7ca093aa Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Wed, 5 Aug 2026 21:07:48 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[MEDIUM]=20?=
 =?UTF-8?q?Fix=20Slowloris=20(CWE-400)=20vulnerability?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

🚨 Severity: MEDIUM
💡 Vulnerability: Found `http.Server` instances lacking `ReadHeaderTimeout` configuration.
🎯 Impact: This makes the HTTP server vulnerable to Slowloris attacks (CWE-400), which can lead to resource exhaustion and Denial of Service (DoS) by keeping connections open indefinitely.
🔧 Fix: Added `ReadHeaderTimeout: 10 * time.Second` to `http.Server` initializations in `internal/mcp/oauth.go`, `internal/oauth/loopback.go`, and `internal/provideroauth/openrouter.go`.
✅ Verification: Ran `gosec` to verify G112 rules are no longer flagged for these files. Tested via `make test` and `make lint`.

Co-authored-by: euxaristia <25621994+euxaristia@users.noreply.github.com>
---
 .jules/sentinel.md                   |  4 +++
 internal/mcp/oauth.go                |  1 +
 internal/oauth/loopback.go           |  5 +++-
 internal/provideroauth/openrouter.go | 37 +++++++++++++++-------------
 4 files changed, 29 insertions(+), 18 deletions(-)
 create mode 100644 .jules/sentinel.md

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 000000000..65add249b
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,4 @@
+## 2026-08-05 - Add `ReadHeaderTimeout` to `http.Server` to prevent Slowloris Attacks (CWE-400)
+**Vulnerability:** Found `http.Server` instances in `internal/mcp/oauth.go`, `internal/oauth/loopback.go`, and `internal/provideroauth/openrouter.go` lacking `ReadHeaderTimeout` configuration.
+**Learning:** This is a common pattern flagged by gosec as G112 (CWE-400) where an HTTP server is vulnerable to Slowloris attacks because it lacks timeouts for reading request headers, which can lead to resource exhaustion.
+**Prevention:** Always configure `ReadHeaderTimeout` when initializing `http.Server` in Go.
diff --git a/internal/mcp/oauth.go b/internal/mcp/oauth.go
index 678d58045..e402e5e6a 100644
--- a/internal/mcp/oauth.go
+++ b/internal/mcp/oauth.go
@@ -409,6 +409,7 @@ func Login(ctx context.Context, options LoginOptions) (StoredToken, error) {
 	}
 	resultChan := make(chan callbackResult, 1)
 	server := &http.Server{
+		ReadHeaderTimeout: 10 * time.Second,
 		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			if r.URL.Path != "/callback" {
 				http.NotFound(w, r)
diff --git a/internal/oauth/loopback.go b/internal/oauth/loopback.go
index 6b29e0f27..463e5d5be 100644
--- a/internal/oauth/loopback.go
+++ b/internal/oauth/loopback.go
@@ -50,7 +50,10 @@ func NewLoopbackListenerOnPort(state string, port int) (*LoopbackListener, error
 		state:    state,
 		result:   make(chan callbackResult, 1),
 	}
-	l.server = &http.Server{Handler: http.HandlerFunc(l.handle)}
+	l.server = &http.Server{
+		ReadHeaderTimeout: 10 * time.Second,
+		Handler:           http.HandlerFunc(l.handle),
+	}
 	go func() { _ = l.server.Serve(ln) }()
 	return l, nil
 }
diff --git a/internal/provideroauth/openrouter.go b/internal/provideroauth/openrouter.go
index 8a99b3148..143d010a4 100644
--- a/internal/provideroauth/openrouter.go
+++ b/internal/provideroauth/openrouter.go
@@ -79,26 +79,29 @@ func OpenRouterLogin(ctx context.Context, opts OpenRouterOptions) (string, error
 
 	codeCh := make(chan string, 1)
 	errCh := make(chan error, 1)
-	server := &http.Server{Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path != "/callback" {
-			http.NotFound(w, r)
-			return
-		}
-		if code := strings.TrimSpace(r.URL.Query().Get("code")); code != "" {
-			_, _ = io.WriteString(w, "OpenRouter authorization complete. You may close this window.")
+	server := &http.Server{
+		ReadHeaderTimeout: 10 * time.Second,
+		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if r.URL.Path != "/callback" {
+				http.NotFound(w, r)
+				return
+			}
+			if code := strings.TrimSpace(r.URL.Query().Get("code")); code != "" {
+				_, _ = io.WriteString(w, "OpenRouter authorization complete. You may close this window.")
+				select {
+				case codeCh <- code:
+				default:
+				}
+				return
+			}
+			w.WriteHeader(http.StatusBadRequest)
+			_, _ = io.WriteString(w, "Authorization failed. You may close this window.")
 			select {
-			case codeCh <- code:
+			case errCh <- errors.New("provideroauth: callback missing authorization code"):
 			default:
 			}
-			return
-		}
-		w.WriteHeader(http.StatusBadRequest)
-		_, _ = io.WriteString(w, "Authorization failed. You may close this window.")
-		select {
-		case errCh <- errors.New("provideroauth: callback missing authorization code"):
-		default:
-		}
-	})}
+		}),
+	}
 	go func() { _ = server.Serve(listener) }()
 	defer func() {
 		shutdownCtx, cancelShutdown := context.WithTimeout(context.Background(), time.Second)