Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
const validate = ({ element, resource, response }: FetchEnd) => {
// This check does not make sense for data URI.
if (isDataURI(resource)) {
debug(`Check does not apply for data URI: ${resource}`);
return;
}
if (!willBeTreatedAsHTML(response)) {
let headersToValidate = unneededHeaders;
if (exceptionMediaTypes.includes(response.mediaType)) {
headersToValidate = mergeIgnoreIncludeArrays(headersToValidate, exceptionHeaders, []);
}
const headers = includedHeaders(response.headers, headersToValidate);
const numberOfHeaders = headers.length;
if (numberOfHeaders > 0) {
let message: string;
if (numberOfHeaders === 1) {
message = getMessage('unneededHeader', context.language, prettyPrintArray(headers));
} else {
message = getMessage('unneededHeaders', context.language, prettyPrintArray(headers));
}
context.report(resource, message, { element, severity: Severity.warning });
}
}
};
const validate = ({ response, resource }: FetchEnd) => {
// This check does not make sense for data URI.
if (isDataURI(resource)) {
debug(`Check does not apply for data URI: ${resource}`);
return;
}
const headers: string[] = includedHeaders(response.headers, disallowedHeaders);
const numberOfHeaders: number = headers.length;
/*
* If the response contains the `server` header, and
* `server` is not specified by the user as a disallowed
* header or a header to be ignored, check if it provides
* more information than it should.
*
* The `Server` header is treated differently than the
* other ones because it cannot always be remove. In some
* cases such as Apache the best that the user can do is
* limit it's value to the name of the server (i.e. apache).
*
* See also:
*
* * https://bz.apache.org/bugzilla/show_bug.cgi?id=40026
const validateHeaders = ({ element, resource, response }: FetchEnd) => {
const headers: string[] = includedHeaders(response.headers, ['p3p']);
const numberOfHeaders: number = headers.length;
if (numberOfHeaders > 0) {
let codeSnippet = '';
for (const header of headers) {
codeSnippet += `P3P: ${response.headers[header]}\n`;
}
context.report(resource, errorMessage, {
codeLanguage: 'http',
codeSnippet: codeSnippet.trim(),
element,
severity: Severity.error
});
}