[Javascript clients] Vulnerability in one of the dependencies.

Description

The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such responses, it may result in excessive CPU and/or memory consumption. An attacker might exploit such a weakness for a DoS attack. To exploit this the attacker must control the location (URL) that superagent makes a request to.
https://nvd.nist.gov/vuln/detail/CVE-2017-16129

Github is issuing a warning in generated clients, see for example:
https://github.com/bitcoind-rest/javascript-client

Swagger-codegen version

Current versions of:

• javascript-es6
• javascript-promise-es6

Suggest a fix/enhancement

Update superagent or use fetch API or any other clients.

Commencez par les fichiers package.json de samples/client/petstore/javascript-es6 et javascript-promise-es6, puis suivez la manière dont ces dépendances sont utilisées dans les clients JavaScript générés. Confirmez la version concernée de superagent et examinez les sorties des clients générés. Le travail est terminé lorsque la dépendance vulnérable n’est plus présente et que les clients fonctionnent toujours sans l’avertissement signalé.