Fix HTTP server timeout exposure and XSS in monitoring exporter

[Copilot]

Four security vulnerabilities identified by gosec scan: two Slowloris-susceptible HTTP servers, one XSS injection point, and use of math/rand where crypto/rand was already available.

Changes

• server/http.go — HTTP→HTTPS redirect server used bare http.ListenAndServe with no timeouts. Replaced with http.Server carrying ReadHeaderTimeout: 10s / IdleTimeout: 30s / WriteTimeout: 90s, matching the main server config.

• monitoring/exporter/main.go — Same no-timeout issue on the exporter server. Also, the /push endpoint embedded err.Error() directly into an HTML response:

  // Before — XSS if error string contains attacker-influenced content
  w.Write([]byte(`<pre>` + msg + `</pre>`))
  
  // After
  w.Write([]byte(`<pre>` + html.EscapeString(msg) + `</pre>`))

• server/validate/email/validate.go — randomBoundary() called math/rand.Read despite crypto/rand already being imported for OTP generation. Switched to crand.Read with error handling (time-based fallback on entropy failure).

[Copilot]

Pull request overview

This PR addresses security findings from gosec by hardening HTTP server configurations against Slowloris-style attacks, mitigating an XSS vector in the monitoring exporter, and using crypto/rand for boundary generation where appropriate.

Changes:

• Replaced a bare http.ListenAndServe HTTP→HTTPS redirect listener with an http.Server configured with timeouts and header limits.
• Escaped error output in the exporter’s /push HTML response and replaced ListenAndServe with a timeout-configured http.Server.
• Updated email validator boundary generation to use crypto/rand with a time-based fallback on entropy failure.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

File	Description
server/validate/email/validate.go	Switches boundary generation from math/rand to crypto/rand with error handling.
server/http.go	Hardens the HTTP→HTTPS redirect server by using http.Server timeouts/header limits.
monitoring/exporter/main.go	Escapes HTML in /push output and adds timeouts to the exporter HTTP server.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.