From 723dcd057845511f5c7195e2cd5c0e85d2538a80 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Tue, 4 Aug 2026 02:17:53 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[MEDIUM]=20?=
 =?UTF-8?q?Fix=20DoS=20risk=20by=20adding=20timeouts=20to=20HTTP=20request?=
 =?UTF-8?q?s?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: himattm <6266621+himattm@users.noreply.github.com>
---
 .jules/sentinel.md         | 4 ++++
 internal/plugin/manager.go | 6 ++++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index 80620ce..0504702 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -16,3 +16,7 @@
 **Vulnerability:** Writing fully buffered in-memory data to temporary disk files solely for parsing.
 **Learning:** This increases attack surface, risks disk exhaustion, and violates the principle of least privilege.
 **Prevention:** Refactor parsing functions to accept byte slices or `io.Reader` directly to process data in memory.
+## 2024-08-04 - Fix DoS risk by adding timeouts to HTTP requests
+**Vulnerability:** External HTTP requests were made using `http.Get()`, which relies on `http.DefaultClient` and lacks request timeouts, leading to potential DoS or resource exhaustion.
+**Learning:** `http.Get()` has no timeout. A malicious or unoptimized external server could hang connections infinitely, causing goroutine or connection leaks.
+**Prevention:** Always replace `http.Get()` with a custom `http.Client` that is configured with appropriate timeouts (e.g., `Timeout: 10 * time.Second`).
diff --git a/internal/plugin/manager.go b/internal/plugin/manager.go
index 7aad027..e39a83b 100644
--- a/internal/plugin/manager.go
+++ b/internal/plugin/manager.go
@@ -410,7 +410,8 @@ func (m *Manager) addScriptPlugin(owner, repo, pluginName string) error {
 
 	fmt.Printf("Fetching script from: %s\n", rawURL)
 
-	resp, err := http.Get(rawURL)
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Get(rawURL)
 	if err != nil {
 		return fmt.Errorf("failed to fetch plugin: %w", err)
 	}
@@ -468,7 +469,8 @@ func (m *Manager) addFromDirectURL(rawURL string) error {
 		return fmt.Errorf("unsupported URL scheme: %s", parsedURL.Scheme)
 	}
 
-	resp, err := http.Get(parsedURL.String())
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Get(parsedURL.String())
 	if err != nil {
 		return fmt.Errorf("failed to fetch plugin: %w", err)
 	}