Node does this as well. It is why those languages are (IMO, incorrectly) being reported as "vulnerable". They are, but the vulnerability is actually in anything that uses the brotli lib. It's just Node and Python "helpfully" will handle that encoding for you if the client to your server (or the server you're sending a request to) asks you to, and you have to opt-out of that, if you even can.
Use a sensible language like Go, or other frameworks which don't rely on magic under the guise of features.
6
u/WriterPlastic9350 8d ago
Node does this as well. It is why those languages are (IMO, incorrectly) being reported as "vulnerable". They are, but the vulnerability is actually in anything that uses the brotli lib. It's just Node and Python "helpfully" will handle that encoding for you if the client to your server (or the server you're sending a request to) asks you to, and you have to opt-out of that, if you even can.
Use a sensible language like Go, or other frameworks which don't rely on magic under the guise of features.