trim-safe 1.0.1 → 1.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/package.json +25 -3
- package/.github/workflows/test.yml +0 -20
- package/SECURITY.md +0 -22
package/README.md
CHANGED
|
@@ -6,7 +6,7 @@ Safe, drop-in replacement for the abandoned [`trim`](https://www.npmjs.com/packa
|
|
|
6
6
|
|
|
7
7
|
The `trim` package (1M+ weekly downloads) has been effectively abandoned since 2013. Its canonical GitHub repo is dormant, the patch fork was archived in 2023, and the original source was never updated with the CVE fix.
|
|
8
8
|
|
|
9
|
-
The package contains **CVE-2020-7753** — a ReDoS vulnerability in the regex `/^\s*|\s*$/g`. An attacker can craft an input string that causes catastrophic regex backtracking, consuming all CPU and hanging your process.
|
|
9
|
+
The package contains **CVE-2020-7753** / **GHSA-cmr6-74hv-c9fg** — a ReDoS vulnerability (CVSS 7.5 HIGH) in the regex `/^\s*|\s*$/g`. An attacker can craft an input string that causes catastrophic regex backtracking, consuming all CPU and hanging your process.
|
|
10
10
|
|
|
11
11
|
`trim-safe` fixes the vulnerability using a loop-based approach with no regex backtracking. Same API, zero security debt.
|
|
12
12
|
|
package/package.json
CHANGED
|
@@ -1,25 +1,47 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "trim-safe",
|
|
3
|
-
"version": "1.0.
|
|
3
|
+
"version": "1.0.2",
|
|
4
4
|
"description": "Safe, drop-in replacement for the abandoned trim package. Fixed ReDoS vulnerability (CVE-2020-7753).",
|
|
5
5
|
"main": "index.js",
|
|
6
|
+
"types": "index.d.ts",
|
|
7
|
+
"files": [
|
|
8
|
+
"index.js",
|
|
9
|
+
"index.d.ts",
|
|
10
|
+
"README.md",
|
|
11
|
+
"test.js",
|
|
12
|
+
"scripts"
|
|
13
|
+
],
|
|
6
14
|
"scripts": {
|
|
7
15
|
"test": "node test.js",
|
|
8
|
-
"postinstall": "node scripts/migrate-check.js"
|
|
16
|
+
"postinstall": "node scripts/migrate-check.js",
|
|
17
|
+
"prepare": "npm run test",
|
|
18
|
+
"prepublishOnly": "npm run test"
|
|
9
19
|
},
|
|
10
20
|
"keywords": [
|
|
21
|
+
"trim-safe",
|
|
11
22
|
"trim",
|
|
12
23
|
"string",
|
|
13
24
|
"whitespace",
|
|
14
25
|
"safe",
|
|
15
26
|
"regex",
|
|
16
|
-
"redos"
|
|
27
|
+
"redos",
|
|
28
|
+
"cve",
|
|
29
|
+
"security",
|
|
30
|
+
"javascript",
|
|
31
|
+
"typescript",
|
|
32
|
+
"nodejs",
|
|
33
|
+
"utility"
|
|
17
34
|
],
|
|
35
|
+
"author": "Jay Suryawanshi",
|
|
18
36
|
"license": "MIT",
|
|
19
37
|
"repository": {
|
|
20
38
|
"type": "git",
|
|
21
39
|
"url": "git+https://github.com/Jay-Suryawansh7/trim-safe.git"
|
|
22
40
|
},
|
|
41
|
+
"bugs": {
|
|
42
|
+
"url": "https://github.com/Jay-Suryawansh7/trim-safe/issues"
|
|
43
|
+
},
|
|
44
|
+
"homepage": "https://github.com/Jay-Suryawansh7/trim-safe#readme",
|
|
23
45
|
"engines": {
|
|
24
46
|
"node": ">=0.10.0"
|
|
25
47
|
}
|
|
@@ -1,20 +0,0 @@
|
|
|
1
|
-
name: Test
|
|
2
|
-
|
|
3
|
-
on:
|
|
4
|
-
push:
|
|
5
|
-
branches: [main]
|
|
6
|
-
pull_request:
|
|
7
|
-
branches: [main]
|
|
8
|
-
|
|
9
|
-
jobs:
|
|
10
|
-
test:
|
|
11
|
-
runs-on: ubuntu-latest
|
|
12
|
-
strategy:
|
|
13
|
-
matrix:
|
|
14
|
-
node-version: [18, 20, 22]
|
|
15
|
-
steps:
|
|
16
|
-
- uses: actions/checkout@v4
|
|
17
|
-
- uses: actions/setup-node@v4
|
|
18
|
-
with:
|
|
19
|
-
node-version: ${{ matrix.node-version }}
|
|
20
|
-
- run: npm test
|
package/SECURITY.md
DELETED
|
@@ -1,22 +0,0 @@
|
|
|
1
|
-
# Security Policy
|
|
2
|
-
|
|
3
|
-
## Supported Versions
|
|
4
|
-
|
|
5
|
-
| Version | Supported |
|
|
6
|
-
| ------- | ------------------ |
|
|
7
|
-
| 1.x | :white_check_mark: |
|
|
8
|
-
|
|
9
|
-
## Reporting a Vulnerability
|
|
10
|
-
|
|
11
|
-
If you discover a security vulnerability in `trim-safe`, please report it via:
|
|
12
|
-
|
|
13
|
-
1. **GitHub Issues** (preferred for non-critical issues)
|
|
14
|
-
2. **Email** — open an issue first and we'll respond within 48 hours
|
|
15
|
-
|
|
16
|
-
Please do not disclose security vulnerabilities publicly until a fix is available.
|
|
17
|
-
|
|
18
|
-
## Security Model
|
|
19
|
-
|
|
20
|
-
`trim-safe` intentionally contains **no external dependencies** — only stdlib JavaScript. The attack surface is zero network calls, zero file reads, and no dynamic code execution.
|
|
21
|
-
|
|
22
|
-
The package has no `postinstall`, `preinstall`, `prepare`, or any other lifecycle hooks.
|