swagger-api / swagger-api/swagger-codegen
[Javascript clients] Vulnerability in one of the dependencies.
Nobody has claimed this yet.
- Dominant language
- Mustache
- Stars
- 17.8k
- Forks
- 6k
- PR merge metrics
- No merged PRs in 30d
Description
Description
The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such responses, it may result in excessive CPU and/or memory consumption. An attacker might exploit such a weakness for a DoS attack. To exploit this the attacker must control the location (URL) that superagent makes a request to.
https://nvd.nist.gov/vuln/detail/CVE-2017-16129
Github is issuing a warning in generated clients, see for example:
https://github.com/bitcoind-rest/javascript-client
Swagger-codegen version
Current versions of:
Suggest a fix/enhancement
Update superagent or use fetch API or any other clients.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the package.json files for samples/client/petstore/javascript-es6 and javascript-promise-es6, then trace how those dependencies are used in the generated JavaScript clients. Confirm the affected superagent version and review the generated client outputs. Done means the vulnerable dependency is no longer present and the clients still work without the reported warning.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100