bootstrap: set ReadHeaderTimeout on the HTTP server

The *http.Server built by Runner.newServer left ReadHeaderTimeout unset,
so request-header reads were unbounded -- a Slowloris-style connection
exhaustion vector (gosec G112). The exporter-toolkit web package does not
set server timeouts either, so every bootstrap-based exporter inherited
the gap.

Set ReadHeaderTimeout to one minute. It bounds only header reading, not
the metrics handler, so it never affects legitimate scrapes. The value is
a package var so tests can shorten it.

Follow-up to prometheus/blackbox_exporter#1626, which made the same change
on the caller side; setting it here fixes it once for all toolkit users.

go build, go vet, and go test ./... pass; gosec G112 clears.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: randomizedcoder dave.seddon.ca@gmail.com <dave.seddon.ca@gmail.com>

Author: randomizedcoder

bootstrap/bootstrap.go

@@ -22,6 +22,7 @@ import (
 	"log/slog"
 	"net/http"
 	"os"
+	"time"
 
 	"github.com/alecthomas/kingpin/v2"
 	"github.com/prometheus/common/promslog"
@@ -43,6 +44,12 @@ var (
 	errNegativeMaxRequests = errors.New("web max requests must be greater than or equal to zero")
 )
 
+// serverReadHeaderTimeout bounds how long the server waits to read request
+// headers, mitigating Slowloris-style connection exhaustion (gosec G112). It
+// covers only header reading, not the metrics handler, so a generous value is
+// safe for legitimate scrapes. It is a package var so tests can shorten it.
+var serverReadHeaderTimeout = time.Minute
+
 // MetricsHandlerFactory builds an exporter-specific metrics handler after the
 // common toolkit flags have been parsed.
 type MetricsHandlerFactory func(*Bootstrap) (http.Handler, error)
@@ -250,7 +257,10 @@ func (t *Runner) newServer(metricsHandler http.Handler) (*http.Server, error) {
 		mux.Handle("/", landingPage)
 	}
 
-	return &http.Server{Handler: mux}, nil
+	return &http.Server{
+		Handler:           mux,
+		ReadHeaderTimeout: serverReadHeaderTimeout,
+	}, nil
 }
 
 func (t *Runner) defaultLandingConfig() web.LandingConfig {

bootstrap/bootstrap_test.go

@@ -14,10 +14,12 @@
 package bootstrap
 
 import (
+	"net"
 	"net/http"
 	"net/http/httptest"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/alecthomas/kingpin/v2"
 	"github.com/prometheus/common/promslog"
@@ -129,3 +131,79 @@ func TestNewServerRegistersMetricsAndLandingPage(t *testing.T) {
 		t.Fatalf("unexpected landing body: %q", body)
 	}
 }
+
+// TestNewServerSetsReadHeaderTimeout verifies that the server built by newServer
+// bounds request-header reads (ReadHeaderTimeout), so a connection whose headers
+// never complete is closed rather than held open indefinitely (a Slowloris
+// vector, gosec G112). A well-formed request must still succeed.
+func TestNewServerSetsReadHeaderTimeout(t *testing.T) {
+	// Shorten the production timeout for the test; newServer reads this var.
+	orig := serverReadHeaderTimeout
+	serverReadHeaderTimeout = 250 * time.Millisecond
+	t.Cleanup(func() { serverReadHeaderTimeout = orig })
+
+	tk := New(Config{
+		App:            kingpin.New("test", ""),
+		Name:           "test_exporter",
+		Description:    "test description",
+		DefaultAddress: ":9100",
+		Logger:         promslog.NewNopLogger(),
+		MetricsHandler: http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusOK)
+		}),
+	})
+	if err := tk.parse([]string{"--web.listen-address=:0"}); err != nil {
+		t.Fatalf("unexpected parse error: %v", err)
+	}
+	handler, err := tk.resolveMetricsHandler()
+	if err != nil {
+		t.Fatalf("unexpected handler resolution error: %v", err)
+	}
+	server, err := tk.newServer(handler)
+	if err != nil {
+		t.Fatalf("unexpected server creation error: %v", err)
+	}
+	if server.ReadHeaderTimeout != serverReadHeaderTimeout {
+		t.Fatalf("unexpected ReadHeaderTimeout: got %v, want %v", server.ReadHeaderTimeout, serverReadHeaderTimeout)
+	}
+
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	t.Cleanup(func() { _ = ln.Close() })
+	go func() { _ = server.Serve(ln) }()
+	t.Cleanup(func() { _ = server.Close() })
+
+	// Sanity: a well-formed request still succeeds.
+	resp, err := http.Get("http://" + ln.Addr().String() + "/metrics")
+	if err != nil {
+		t.Fatalf("well-formed request failed: %v", err)
+	}
+	_ = resp.Body.Close()
+
+	// A client that starts request headers but never terminates them (no final
+	// CRLF), holding the connection open.
+	conn, err := net.Dial("tcp", ln.Addr().String())
+	if err != nil {
+		t.Fatalf("dial: %v", err)
+	}
+	t.Cleanup(func() { _ = conn.Close() })
+	if _, err := conn.Write([]byte("GET /metrics HTTP/1.1\r\nHost: localhost\r\n")); err != nil {
+		t.Fatalf("write partial request: %v", err)
+	}
+
+	// The server must close the stalled connection once ReadHeaderTimeout
+	// elapses. Read in a goroutine so the test never hangs if it does not.
+	done := make(chan struct{})
+	go func() {
+		_, _ = conn.Read(make([]byte, 1)) // unblocks on server-side close
+		close(done)
+	}()
+	select {
+	case <-done:
+		// Connection closed: ReadHeaderTimeout is effective.
+	case <-time.After(5 * time.Second):
+		t.Fatal("server did not close the stalled connection within 5s; ReadHeaderTimeout not effective")
+	}
+}