vetkit.resilience.http-call-without-timeout.go-client-literal
http.Client is created without a Timeout and used in the same function for requests that carry no context deadline, so a slow or unresponsive server blocks the call indefinitely.
Last updated:
Suite: Production readiness
go
http.Client is created without a Timeout and used in the same function for requests that carry no context deadline, so a slow or unresponsive server blocks the call indefinitely.
Category: RESILIENCE · Engine rule severity: WARNING
How to fix it
Set Timeout on the client (for example &http.Client{Timeout: 30 * time.Second}), or build the request with http.NewRequestWithContext and a context that has a deadline. Streaming or long-polling clients can instead bound the dial, TLS and header phases on the http.Transport.
References
Source: packages/engine/rules/resilience/go.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.