The "color" npm package, a utility for color manipulation and conversion with CSS string support, saw a minor version bump from 0.1.0 to 0.1.1 on June 23rd, 2011. While the core functionality and dependencies like "color-string" (0.1.x) and "color-convert" (0.2.x) remained consistent between versions, indicating no breaking API changes, a key difference lies in the release date. Version 0.1.1 was released approximately 13 hours after version 0.1.0.
Both versions, authored by Heather Arthur, offer developers the ability to work with colors in various formats, making it ideal for web development projects requiring dynamic color handling. The consistent dependency structure suggests that both versions operate with the same underlying mechanisms for color string parsing and color space conversions. Development dependencies on "uglify-js" (1.0.x) and "browserify" (>=1.1.0) imply a focus on code minification and browser compatibility. The repository URL points to a GitHub repository where interested developers can find the source code, contribute, and learn more about the internal implementation of the color manipulation and conversion algorithms. While the specific changes between 0.1.0 and 0.1.1 are not explicitly stated, the relatively quick release of the newer version indicates either a bug fix or a minor enhancement.
All the vulnerabilities related to the version 0.1.1 of the package
Regular Expression Denial of Service (ReDOS)
In the npm package color-string, there is a ReDos (Regular Expression Denial of Service) vulnerability regarding an exponential time complexity for
linearly increasing input lengths for hwb() color strings.
Strings reaching more than 5000 characters would see several milliseconds of processing time; strings reaching more than 50,000 characters began seeing 1500ms (1.5s) of processing time.
The cause was due to a the regular expression that parses hwb() strings - specifically, the hue value - where the integer portion of the hue value used a 0-or-more quantifier shortly thereafter followed by a 1-or-more quantifier.
This caused excessive backtracking and a cartesian scan, resulting in exponential time complexity given a linear increase in input length.
