Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Old path-browserify is very slow on long pathnames (should I say ReDoS'able?) #87

Open
futpib opened this issue Dec 9, 2018 · 1 comment

Comments

@futpib
Copy link

futpib commented Dec 9, 2018

Currently used here path-browserify@0.0.0:

time node -e "require('path-browserify').extname(crypto.randomBytes(2 ** 23).toString('base64'))"
real    0m5.619s

Node 11 built-in path module:

time node -e "path.extname(crypto.randomBytes(2 ** 23).toString('base64'))"
real    0m0.133s

Latest path-browserify@1.0.0:

time node -e "require('path-browserify').extname(crypto.randomBytes(2 ** 23).toString('base64'))"
real    0m0.137s

Currently the fact that webpack pulls path-browserify@0.0.0 via this module forces me to install path-browserify@1.0.0 and alias it manually in webpack.config.js like this:

	resolve: {
		alias: {
			path: 'path-browserify',
		},
	},

I hope you can update it to 1.0.0.

EDIT: Turns out there is already a PR for this #79

@goto-bus-stop
Copy link
Contributor

Added a PR that specifically fixes this vulnerability without introducing breaking changes: #89

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants