Description

Detects when an application accepts any MIME type ('*/*') in HTTP Accept headers, which could allow content sniffing attacks. Accepting arbitrary MIME types can lead to security issues where malicious content is interpreted differently than intended.

Detection Strategy

• Identifies HTTP request configurations or header handling code in TypeScript files

• Checks if Accept headers are configured to accept '*/*' or other wildcard MIME types

• Looks for header validation logic that allows any content type to pass through

• Reports a vulnerability when wildcard MIME type acceptance is detected in request handling code

Vulnerable code example

// Demonstrating vulnerable HTTP header configurations
const axios = require('axios');

// Create headers with unsafe Accept header
const unsafeHeaders = {
  Accept: "*/*"  // Vulnerable: Accepts any content type, could allow malicious responses
};
...

✅ Secure code example

const axios = require('axios');

// Create headers with specific Accept type
const safeHeaders = {
  Accept: "application/json"  // Safe: Explicitly accepts only JSON responses
};

// Configure axios with safe defaults ...