fix: fixes response.attachment behaviour leads to Content-Type Sniffing#1904
fix: fixes response.attachment behaviour leads to Content-Type Sniffing#1904
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #1904 +/- ##
=======================================
Coverage 99.90% 99.90%
=======================================
Files 9 9
Lines 2064 2066 +2
=======================================
+ Hits 2062 2064 +2
Misses 2 2 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Pull Request Overview
This PR fixes a security vulnerability related to Content-Type sniffing in the response.attachment() method by preventing it from overriding an already-set Content-Type header.
- Modified the
attachment()method to only set Content-Type when not already present - Added comprehensive security tests to verify the fix prevents XSS vulnerabilities
- Maintains backward compatibility by still setting Content-Type when not previously defined
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| lib/response.js | Modified attachment method to check for existing Content-Type before setting it |
| tests/response/attachment.test.js | Added security-focused tests to verify Content-Type preservation and XSS prevention |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
|
@fengmk2 sorry about my last pr for the same security issue. I have 2 other bug fix prs for your review when you have time. 🙏
Very small changes with mainly tests that address long standing issues Jon asked me to look at. 🙇 |
|
@fengmk2 or @3imed-jaberi Do you have a few moments to review this PR and the other linked? 🙇 |
|
Hey @fengmk2, @3imed-jaberi could I trouble you to do a patch release for this one so I can silence my SNYK alarms? 🙏 |
|
@samchungy sorry for the delay https://github.com/koajs/koa/releases/tag/v3.0.2 |
Checklist
Added security-focused tests to verify:
credit "Luca Carettoni of Doyensec LLC" as requested in the advisory.