Skip to content
This repository has been archived by the owner on Aug 15, 2024. It is now read-only.

Old path-browserify is very slow on long pathnames (should I say ReDoS'able?) #87

Open
futpib opened this issue Dec 9, 2018 · 1 comment

Comments

@futpib
Copy link

futpib commented Dec 9, 2018

Currently used here [email protected]:

time node -e "require('path-browserify').extname(crypto.randomBytes(2 ** 23).toString('base64'))"
real    0m5.619s

Node 11 built-in path module:

time node -e "path.extname(crypto.randomBytes(2 ** 23).toString('base64'))"
real    0m0.133s

Latest [email protected]:

time node -e "require('path-browserify').extname(crypto.randomBytes(2 ** 23).toString('base64'))"
real    0m0.137s

Currently the fact that webpack pulls [email protected] via this module forces me to install [email protected] and alias it manually in webpack.config.js like this:

	resolve: {
		alias: {
			path: 'path-browserify',
		},
	},

I hope you can update it to 1.0.0.

EDIT: Turns out there is already a PR for this #79

@goto-bus-stop
Copy link
Contributor

Added a PR that specifically fixes this vulnerability without introducing breaking changes: #89

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants