Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
export const includedHeaders = (headers: object, headerList: string[] = []): string[] => {
const result: string[] = [];
const list: string[] = toLowerCaseArray(headerList);
for (const key of Object.keys(headers)) {
const lowercaseKey: string = key.toLowerCase();
if (list.includes(lowercaseKey)) {
result.push(lowercaseKey);
}
}
const shortedResult: string[] = result.sort();
return shortedResult;
};
* The `Server` header is treated differently than the
* other ones because it cannot always be remove. In some
* cases such as Apache the best that the user can do is
* limit it's value to the name of the server (i.e. apache).
*
* See also:
*
* * https://bz.apache.org/bugzilla/show_bug.cgi?id=40026
* * https://httpd.apache.org/docs/current/mod/core.html#servertokens
*/
const serverHeaderValue = normalizeHeaderValue(response.headers, 'server');
const codeLanguage = 'http';
if (!disallowedHeaders.includes('server') &&
!toLowerCaseArray(ignoreHeaders).includes('server') &&
serverHeaderValue &&
serverHeaderContainsTooMuchInformation(serverHeaderValue)
) {
const message = getMessage('headerValueShouldOnlyContain', context.language, response.headers.server);
context.report(
resource,
message,
{
codeLanguage,
codeSnippet: `Server: ${serverHeaderValue}`,
severity: Severity.warning
});
}
if (numberOfHeaders > 0) {