halostatue/mime-types — pull request #75 by chancancode (2014-10-14 21:28:52+00:00)
Title: Use `JSON.parse` to limit exposure

As far as I can tell, there are no pressing reasons for this change (as in, this is
not addressing an immediate security threat). It's just a preventive measure to
reduce unnecessary exposure.

* * *

Using `JSON.load` on untrusted input is considered unsafe. While the MIME type
definition files would presumably come from a trusted source, there doesn't seem
to be a need for the "extra" stuff that `JSON.load` does in here, so switching
over to the safer `JSON.parse` API should help to reduce exposure.