Jsdoc version 3.6.3 is a minor update to the popular JavaScript API documentation generator, building upon the foundation of version 3.6.2. Both versions share the same core purpose: creating comprehensive and navigable documentation from JSDoc-style comments in your code. Key dependencies like klaw, mkdirp, taffydb, bluebird, catharsis, requizzle, underscore, markdown-it, js2xmlparser, @babel/parser, markdown-it-anchor, strip-json-comments, and escape-string-regexp remain largely consistent, ensuring a stable and familiar experience for existing users.
However, subtle changes have been introduced. Notably, marked has been updated from version 0.6.2 to 0.7.0, and catharsis was updated from 0.8.10 to 0.8.11, potentially bringing bug fixes, performance improvements, or new features in Markdown parsing and JSDoc tag handling. requizzle also advanced from 0.2.2 to 0.2.3, this could relate to enhanced module resolution capabilities. Besides, within the development dependencies, gulp-eslint also had a bump from 5.0.0 to 6.0.0. Another aspect that changed between the versions is the unpackedSize, that indicates there could be also minor changes to the files, even if the file count remains the same.
Developers considering an upgrade should pay attention to the release notes of marked, catharsis, requizzle and gulp-eslint to understand the precise nature of these updates and their potential impact on their documentation workflows. The update represents a commitment to continuous improvement and refinement, offering developers a robust and up-to-date tool for documenting their JavaScript projects.
All the vulnerabilities related to the version 3.6.3 of the package
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from 'marked';
console.log(marked.parse(`[x]: x
\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](`));
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory:
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression block.def may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from "marked";
marked.parse(`[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x`);
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory:
TaffyDB can allow access to any data items in the DB
TaffyDB allows attackers to forge adding additional properties into user-input processed by taffy which can allow access to any data items in the DB. Taffy sets an internal index for each data item in its DB. However, it is found that the internal index can be forged by adding additional properties into user-input. If index is found in the query, TaffyDB will ignore other query conditions and directly return the indexed data item. Moreover, the internal index is in an easily-guessable format (e.g., T000002R000001). As such, attackers can use this vulnerability to access any data items in the DB. Note: taffy and its successor package taffydb are not maintained.
Arbitrary Code Execution in underscore
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Execution via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
Uncontrolled Resource Consumption in markdown-it
Special patterns with length > 50K chars can slow down parser significantly.
const md = require('markdown-it')();
md.render(`x ${' '.repeat(150000)} x \nx`);
Upgrade to v12.3.2+
No.
Fix + test sample: https://github.com/markdown-it/markdown-it/commit/ffc49ab46b5b751cd2be0aabb146f2ef84986101