The idea is to identify brotli encoding in the content-encoding header and block that on nginx. This shouldn't reach vulnerable brotli parser in node.
replyI hope my assets are not connecting to malicious servers, otherwise yes, I have a problem.
Asp.Net adds Brotli support if you "UseRequestDecompression" or "UseResponseCompression".
replyDotNet, however, has it's own C# Brotli implementation.
According to Claude when I asked it to audit one of our Python applications, there are scenarios where Brolti can be used only when some Python library detects that the C library is installed on the system. So your Brolti-ness can depend on which machine your code runs on. Ymmv, it didn't look to be a practical possibility in our code so I didn't probe further.
replyThese chat bots always hedge like that. They will never give you a straight answer, it's always "depending on version and build configuration and system configuration".
replyInvestigate yourself. Read the documentation. Grep for brotli in the source. Don't blindly trust a chat bot when it says it "might happen in certain configurations".
Chat bot lol. It did all of those things including scanning the binary. I ran it after doing my own (albeit more limited, but maximal-human) investigation.
replyIs that meant to be a response to what I wrote or did you reply to the wrong comment
reply