Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
const validate = (fetchEnd: FetchEnd, eventName: string) => {
const type: TargetType = eventName === 'fetch::end::html' ? 'html' : 'fetch';
const { resource } = fetchEnd;
// This check does not make sense for data URIs.
if (isDataURI(resource)) {
debug(`Check does not apply for data URIs`);
return;
}
const headers = fetchEnd.response.headers;
const { response: { mediaType } } = fetchEnd;
const cacheControlHeaderValue: string = normalizeHeaderValue(headers, 'cache-control', '')!; // won't return null since default value was provided
const parsedDirectives: ParsedDirectives = parseCacheControlHeader(cacheControlHeaderValue);
const validators = [
hasCacheControl,
hasInvalidDirectives,
hasNoneNonRecommendedDirectives,
validateDirectiveCombinations
];
const checkForErrorPages = ({ resource, response }: FetchEnd) => {
// This check does not make sense for data URI.
if (isDataURI(resource)) {
debug(`Check does not apply for data URI: ${resource}`);
return;
}
const statusCode: number = response.statusCode;
const size: number = (response.body.rawContent || []).length;
/*
* This hint doesn't care about individual responses, only
* if, in general, for a certain error response the size
* of the response was over a specific threshold, therefore,
* there is no need to report every error response.
*/
if (((size < 512) && statusCodesWith512Threshold.includes(statusCode)) ||
const validate = ({ element, resource, response }: FetchEnd) => {
// This check does not make sense for data URI.
if (isDataURI(resource)) {
debug(`Check does not apply for data URI: ${resource}`);
return;
}
const headerValue: string | null = normalizeString(response.headers && response.headers['x-content-type-options']);
if (headerValue === null) {
context.report(
resource,
getMessage('shouldInclude', context.language),
{
element,
severity: Severity.error
});
const validate = ({ response, resource }: FetchEnd) => {
// This check does not make sense for data URI.
if (isDataURI(resource)) {
debug(`Check does not apply for data URI: ${resource}`);
return;
}
const headers: string[] = includedHeaders(response.headers, disallowedHeaders);
const numberOfHeaders: number = headers.length;
/*
* If the response contains the `server` header, and
* `server` is not specified by the user as a disallowed
* header or a header to be ignored, check if it provides
* more information than it should.
*
* The `Server` header is treated differently than the
* other ones because it cannot always be remove. In some
const validate = ({ resource, response }: FetchEnd) => {
if (response.statusCode !== 200) {
debug('Check does not apply to status code !== 200');
return;
}
// This check does not make sense for data URIs.
if (isDataURI(resource)) {
debug('Check does not apply for data URIs');
return;
}
const contentTypeHeaderValue = normalizeHeaderValue(response.headers, 'content-type');
const noSniff = normalizeHeaderValue(response.headers, 'x-content-type-options') === 'no-sniff';
const severity = noSniff ? Severity.error : Severity.warning;
const codeSnippet = `Content-Type: ${contentTypeHeaderValue}`;
const codeLanguage = 'http';
// Check if the `Content-Type` header was sent.
if (contentTypeHeaderValue === null) {
context.report(
const validate = ({ element, resource, response }: FetchEnd) => {
// This check does not make sense for data URI.
if (isDataURI(resource)) {
debug(`Check does not apply for data URI: ${resource}`);
return;
}
if (!willBeTreatedAsHTML(response)) {
let headersToValidate = unneededHeaders;
if (exceptionMediaTypes.includes(response.mediaType)) {
headersToValidate = mergeIgnoreIncludeArrays(headersToValidate, exceptionHeaders, []);
}
const headers = includedHeaders(response.headers, headersToValidate);
const numberOfHeaders = headers.length;
if (numberOfHeaders > 0) {
let message: string;
urls.forEach((url) => {
const fullUrl = URL.resolve(resource, url);
if (!isHTTPS(fullUrl) && !isDataURI(fullUrl) && !reportedUrls.has(fullUrl)) {
reportedUrls.add(fullUrl);
context.report(
fullUrl,
getMessage('shouldBeHTTPS', context.language),
{ severity: Severity.error }
);
}
});
};
target = fetchEnd.resource;
validateTarget(fetchEnd);
return;
}
if (!this.targetIsServedOverHTTPS) {
return;
}
const { resource, response } = fetchEnd;
reportInsecureHops(response);
if (!reportedUrls.has(resource) && !isHTTPS(resource) && !isDataURI(resource)) {
reportedUrls.add(resource);
context.report(
resource,
getMessage('shouldBeHTTPS', context.language),
{ severity: Severity.error }
);
}
};