Skip to content

Commit 4a4d1db

Browse files
committed
Fix TypeError when server-side request fails
In addition to the intended SSRF vulnerability, it was possible to crash the server with maliciously chosen query parameters. Closes #225
1 parent b9e2c49 commit 4a4d1db

1 file changed

Lines changed: 4 additions & 2 deletions

File tree

app/routes/research.js

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,15 +13,17 @@ function ResearchHandler(db) {
1313

1414
if (req.query.symbol) {
1515
const url = req.query.url + req.query.symbol;
16-
return needle.get(url, (error, newResponse) => {
16+
return needle.get(url, (error, newResponse, body) => {
1717
if (!error && newResponse.statusCode === 200) {
1818
res.writeHead(200, {
1919
"Content-Type": "text/html"
2020
});
2121
}
2222
res.write("<h1>The following is the stock information you requested.</h1>\n\n");
2323
res.write("\n\n");
24-
res.write(newResponse.body);
24+
if (body) {
25+
res.write(body);
26+
}
2527
return res.end();
2628
});
2729
}

0 commit comments

Comments
 (0)