vetkit.resilience.http-call-without-timeout.go-default-client
$CALL sends the request through http.DefaultClient, which has no timeout. A slow or unresponsive server keeps the goroutine, its connection and everything waiting on the result blocked indefinitely.
Last updated:
Suite: Production readiness
go
$CALL sends the request through http.DefaultClient, which has no timeout. A slow or unresponsive server keeps the goroutine, its connection and everything waiting on the result blocked indefinitely.
Category: RESILIENCE · Engine rule severity: WARNING
How to fix it
Send requests through a shared client with a timeout, for example var httpClient = &http.Client{Timeout: 10 * time.Second}, or build them with http.NewRequestWithContext and a context that has a deadline. The package-level helpers (http.Get, http.Post, http.Head, http.PostForm) cannot take either.
References
Source: packages/engine/rules/resilience/go.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.