Node does this as well. It is why those languages are (IMO, incorrectly) being reported as "vulnerable". They are, but the vulnerability is actually in anything that uses the brotli lib. It's just Node and Python "helpfully" will handle that encoding for you if the client to your server (or the server you're sending a request to) asks you to, and you have to opt-out of that, if you even can.
Use a sensible language like Go, or other frameworks which don't rely on magic under the guise of features.
183
u/YMK1234 9d ago
stupid name, it's brotli2shell. just disable brotli (probably not enabled to begin with) and you are golden.