Description

Detects potentially unsafe JavaScript MIME type handling where an application accepts any MIME type in HTTP requests without proper validation. This can lead to MIME type confusion attacks and potentially allow malicious content to be interpreted as JavaScript.

Detection Strategy

• Identifies HTTP request handling code where Accept headers are processed

• Checks if the code accepts or processes responses without properly validating the MIME type

• Reports a vulnerability when there's no explicit MIME type verification or when any MIME type is accepted

• Focuses specifically on JavaScript content handling scenarios where MIME type validation is critical

Vulnerable code example

const axios = require('axios');
import { $ } from 'jquery';

async function unsafeRequests() {
  // Unsafe: Accepts any MIME type with "*/*"
  const headers = { Accept: "*/*" };
  
  // Vulnerable: Setting dangerous Accept header globally...

✅ Secure code example

const axios = require('axios');
import { $ } from 'jquery';

async function safeRequests() {
  // Safe: Explicitly specify accepted content types
  const headers = { 
    Accept: 'application/json, text/plain'  // Only accept specific safe MIME types
  };...