[Javascript clients] Vulnerability in one of the dependencies.

Description

The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such responses, it may result in excessive CPU and/or memory consumption. An attacker might exploit such a weakness for a DoS attack. To exploit this the attacker must control the location (URL) that superagent makes a request to.
https://nvd.nist.gov/vuln/detail/CVE-2017-16129

Github is issuing a warning in generated clients, see for example:
https://github.com/bitcoind-rest/javascript-client

Swagger-codegen version

Current versions of:

• javascript-es6
• javascript-promise-es6

Suggest a fix/enhancement

Update superagent or use fetch API or any other clients.

先从 samples/client/petstore/javascript-es6 和 javascript-promise-es6 的 package.json 文件开始，然后追踪这些依赖项在生成的 JavaScript 客户端中的使用方式。确认受影响的 superagent 版本，并检查生成的客户端输出。当易受攻击的依赖项不再存在，并且客户端仍能在没有所报告警告的情况下正常工作时，即视为完成。