forwardemail / forwardemail/superagent

Security issue: UNIX sockets are always allowed (opt-in required)

Open
#1,532 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
16.6k
Forks
1.3k
PR merge metrics
No merged PRs in 30d

Description

In the documentation here: https://visionmedia.github.io/superagent/#request-basics is written that

> The Node client supports making requests to Unix Domain Sockets

Such as `pattern: https?+unix://SOCKET_PATH/REQUEST_PATH`. This seems like a major security concern and should probably be disabled by default. Can we make an option like `.enableUnixSockets()` on superagent and disable it by default?

I'm not too familiar with UNIX sockets but I suppose something like matching `unix://` with a regex will do. Then by default rejecting / throwing an error for all requests that contain it unless `.enableUnixSockets()` is enabled by the developer.

If the URL input is dynamic and possibly untrusted it is very much disagreeable to allow unix sockets there.

Contributor guide

Open the contributing guide

Research direction

Start with the request-basics documentation at https://visionmedia.github.io/superagent/#request-basics and trace the Node client path that handles the documented https?+unix:// pattern. Determine where Unix socket URLs are accepted, then verify that they are rejected by default and allowed only through an explicit opt-in, with coverage for both behaviors.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.