forwardemail / forwardemail/superagent
Security issue: UNIX sockets are always allowed (opt-in required)
- Dominant language
- JavaScript
- Stars
- 16.6k
- Forks
- 1.3k
- PR merge metrics
- No merged PRs in 30d
Description
In the documentation here: https://visionmedia.github.io/superagent/#request-basics is written that
> The Node client supports making requests to Unix Domain Sockets
Such as `pattern: https?+unix://SOCKET_PATH/REQUEST_PATH`. This seems like a major security concern and should probably be disabled by default. Can we make an option like `.enableUnixSockets()` on superagent and disable it by default?
I'm not too familiar with UNIX sockets but I suppose something like matching `unix://` with a regex will do. Then by default rejecting / throwing an error for all requests that contain it unless `.enableUnixSockets()` is enabled by the developer.
If the URL input is dynamic and possibly untrusted it is very much disagreeable to allow unix sockets there.
Contributor guide
Research direction
Start with the request-basics documentation at https://visionmedia.github.io/superagent/#request-basics and trace the Node client path that handles the documented https?+unix:// pattern. Determine where Unix socket URLs are accepted, then verify that they are rejected by default and allowed only through an explicit opt-in, with coverage for both behaviors.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100