forwardemail / forwardemail/superagent
Polluting the Response object from a malicious content-type value
Open
- Dominant language
- JavaScript
- Stars
- 16.6k
- Forks
- 1.3k
- PR merge metrics
- No merged PRs in 30d
Description
Hi!
I was looking at the source code (to build a flow libdef for the project), and found this line:
https://github.com/visionmedia/superagent/blob/db35cdcdb4c9ed388679034dfaceec8e0f41144c/src/response-base.js#L76
My concern is that I believe it can be abused by a rogue server to override existing properties on the object.
I'm not a security expert so I don't know what the implications are or could be.
What's your analysis?
Contributor guide
Assessment
This issue has not been assessed yet.