CVE-2020-26289: Uncontrolled Resource Consumption (CWE-400)
value: date-and-time is an npm package for manipulating date and time. In date-and-time before version 0.14.2, there a regular expression involved in parsing which can be exploited to to cause a denial of service. This is fixed in version 0.14.2.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 7.5
Published: 2020-12-28T19:15Z
Repository: https://github.com/knowledgecode/date-and-time
Language: JavaScript
Files changed: date-and-time.js, date-and-time.min.js
Commit date: 2020-12-24 21:05:20 +0900
Commit message: Fixed regular expression denial of service (ReDoS) vulnerability

Diff: diff --git a/date-and-time.js b/date-and-time.js
index 03a1b8f..f2f0e0e 100644
--- a/date-and-time.js
+++ b/date-and-time.js
@@ -134,11 +134,11 @@
      * compiling a format string
      * @param {string} formatString - a format string
      * @returns {Array.<string>} a compiled object
      */
     date.compile = function (formatString) {
-        var re = /\[([^\[\]]*|\[[^\[\]]*\])*\]|([A-Za-z])\2+|\.{3}|./g, keys, pattern = [formatString];
+        var re = /\[([^\[\]]|\[[^\[\]]*])*]|([A-Za-z])\2+|\.{3}|./g, keys, pattern = [formatString];
 
         while ((keys = re.exec(formatString))) {
             pattern[pattern.length] = keys[0];
         }
         return pattern;
diff --git a/date-and-time.min.js b/date-and-time.min.js
index e6ce9c5..2f3a258 100644
--- a/date-and-time.min.js
+++ b/date-and-time.min.js
@@ -5,12 +5,12 @@
 a.getFullYear()},MMMM:function(a){return this.res.MMMM[a.getMonth()]},MMM:function(a){return this.res.MMM[a.getMonth()]},MM:function(a){return("0"+(a.getMonth()+1)).slice(-2)},M:function(a){return""+(a.getMonth()+1)},DD:function(a){return("0"+a.getDate()).slice(-2)},D:function(a){return""+a.getDate()},HH:function(a){return("0"+a.getHours()).slice(-2)},H:function(a){return""+a.getHours()},A:function(a){return this.res.A[11<a.getHours()|0]},hh:function(a){return("0"+(a.getHours()%12||12)).slice(-2)},
 h:function(a){return""+(a.getHours()%12||12)},mm:function(a){return("0"+a.getMinutes()).slice(-2)},m:function(a){return""+a.getMinutes()},ss:function(a){return("0"+a.getSeconds()).slice(-2)},s:function(a){return""+a.getSeconds()},SSS:function(a){return("00"+a.getMilliseconds()).slice(-3)},SS:function(a){return("0"+(a.getMilliseconds()/10|0)).slice(-2)},S:function(a){return""+(a.getMilliseconds()/100|0)},dddd:function(a){return this.res.dddd[a.getDay()]},ddd:function(a){return this.res.ddd[a.getDay()]},
 dd:function(a){return this.res.dd[a.getDay()]},Z:function(a){return a.utc?"+0000":/[\+-]\d{4}/.exec(a.toTimeString())[0]},post:function(a){return a}},x={YYYY:function(a){return this.exec(/^\d{4}/,a)},Y:function(a){return this.exec(/^\d{1,4}/,a)},MMMM:function(a){a=this.find(this.res.MMMM,a);a.value++;return a},MMM:function(a){a=this.find(this.res.MMM,a);a.value++;return a},MM:function(a){return this.exec(/^\d\d/,a)},M:function(a){return this.exec(/^\d\d?/,a)},DD:function(a){return this.exec(/^\d\d/,
 a)},D:function(a){return this.exec(/^\d\d?/,a)},HH:function(a){return this.exec(/^\d\d/,a)},H:function(a){return this.exec(/^\d\d?/,a)},A:function(a){return this.find(this.res.A,a)},hh:function(a){return this.exec(/^\d\d/,a)},h:function(a){return this.exec(/^\d\d?/,a)},mm:function(a){return this.exec(/^\d\d/,a)},m:function(a){return this.exec(/^\d\d?/,a)},ss:function(a){return this.exec(/^\d\d/,a)},s:function(a){return this.exec(/^\d\d?/,a)},SSS:function(a){return this.exec(/^\d{1,3}/,a)},SS:function(a){a=
 this.exec(/^\d\d?/,a);a.value*=10;return a},S:function(a){a=this.exec(/^\d/,a);a.value*=100;return a},Z:function(a){a=this.exec(/^[\+-]\d{2}[0-5]\d/,a);a.value=-60*(a.value/100|0)-a.value%100;return a},h12:function(a,c){return(12===a?0:a)+12*c},exec:function(a,c){var b=(a.exec(c)||[""])[0];return{value:b|0,length:b.length}},find:function(a,c){for(var b=-1,e=0,g=0,h=a.length,f;g<h;g++)f=a[g],!c.indexOf(f)&&f.length>e&&(b=g,e=f.length);return{value:b,length:e}},pre:function(a){return a}},u=function(a,
-c,b){var e=function(h,f,l){var p=function(n){n&&(this.res=n)};p.prototype=h;p.prototype.constructor=p;h=new p(l);for(var k in f||{})l=f[k],h[k]=l.slice?l.slice():l;return h},g={res:e(c.res,b.res)};g.formatter=e(c.formatter,b.formatter,g.res);g.parser=e(c.parser,b.parser,g.res);t[a]=g};d.compile=function(a){for(var c=/\[([^\[\]]*|\[[^\[\]]*\])*\]|([A-Za-z])\2+|\.{3}|./g,b,e=[a];b=c.exec(a);)e[e.length]=b[0];return e};d.format=function(a,c,b){c="string"===typeof c?d.compile(c):c;a=d.addMinutes(a,b?
-a.getTimezoneOffset():0);var e=t[m].formatter,g="";a.utc=b||!1;b=1;for(var h=c.length,f;b<h;b++)f=c[b],g+=e[f]?e.post(e[f](a,c[0])):f.replace(/\[(.*)]/,"$1");return g};d.preparse=function(a,c){var b="string"===typeof c?d.compile(c):c,e={Y:1970,M:1,D:1,H:0,A:0,h:0,m:0,s:0,S:0,Z:0,_index:0,_length:0,_match:0},g=/\[(.*)]/,h=t[m].parser,f=0;a=h.pre(a);for(var l=1,p=b.length,k,n;l<p;l++)if(k=b[l],h[k]){n=h[k](a.slice(f),b[0]);if(!n.length)break;f+=n.length;e[k.charAt(0)]=n.value;e._match++}else if(k===
-a.charAt(f)||" "===k)f++;else if(g.test(k)&&!a.slice(f).indexOf(g.exec(k)[1]))f+=k.length-2;else{"..."===k&&(f=a.length);break}e.H=e.H||h.h12(e.h,e.A);e._index=f;e._length=a.length;return e};d.isValid=function(a,c){var b="string"===typeof a?d.preparse(a,c):a,e=[31,28+d.isLeapYear(b.Y)|0,31,30,31,30,31,31,30,31,30,31][b.M-1];return!(1>b._index||1>b._length||b._index-b._length||1>b._match||1>b.Y||9999<b.Y||1>b.M||12<b.M||1>b.D||b.D>e||0>b.H||23<b.H||0>b.m||59<b.m||0>b.s||59<b.s||0>b.S||999<b.S||-720>
-b.Z||840<b.Z)};d.parse=function(a,c,b){a=d.preparse(a,c);return d.isValid(a)?(a.M-=100>a.Y?22801:1,b||a.Z?new Date(Date.UTC(a.Y,a.M,a.D,a.H,a.m+a.Z,a.s,a.S)):new Date(a.Y,a.M,a.D,a.H,a.m,a.s,a.S)):new Date(NaN)};d.transform=function(a,c,b,e){return d.format(d.parse(a,c),b,e)};d.addYears=function(a,c){return d.addMonths(a,12*c)};d.addMonths=function(a,c){var b=new Date(a.getTime());b.setMonth(b.getMonth()+c);return b};d.addDays=function(a,c){var b=new Date(a.getTime());b.setDate(b.getDate()+c);return b};
-d.addHours=function(a,c){return d.addMinutes(a,60*c)};d.addMinutes=function(a,c){return d.addSeconds(a,60*c)};d.addSeconds=function(a,c){return d.addMilliseconds(a,1E3*c)};d.addMilliseconds=function(a,c){return new Date(a.getTime()+c)};d.subtract=function(a,c){var b=a.getTime()-c.getTime();return{toMilliseconds:function(){return b},toSeconds:function(){return b/1E3},toMinutes:function(){return b/6E4},toHours:function(){return b/36E5},toDays:function(){return b/864E5}}};d.isLeapYear=function(a){return!(a%
-4)&&!!(a%100)||!(a%400)};d.isSameDay=function(a,c){return a.toDateString()===c.toDateString()};d.locale=function(a,c){c?u(a,{res:v,formatter:w,parser:x},c):"function"===typeof a?m=a(d):a&&(q&&!q.date&&console.warn("This method of changing the locale is deprecated. See documentation for details."),m=a);return m};d.extend=function(a){var c=a.extender||{},b;for(b in c)d[b]||(d[b]=c[b]);(a.formatter||a.parser||a.res)&&u(m,t[m],a)};d.plugin=function(a,c){"function"===typeof a?d.extend(r[a(d)]):(r[a]=r[a]||
-c,!c&&r[a]&&(d.extend(r[a]),q&&!q.date&&console.warn("This method of applying plugins is deprecated. See documentation for details.")))};d.locale(m,{});"object"===typeof module&&"object"===typeof module.exports?module.exports=d:"function"===typeof define&&define.amd?define([],function(){return d}):q.date=d})(this);
+c,b){var e=function(h,f,l){var p=function(n){n&&(this.res=n)};p.prototype=h;p.prototype.constructor=p;h=new p(l);for(var k in f||{})l=f[k],h[k]=l.slice?l.slice():l;return h},g={res:e(c.res,b.res)};g.formatter=e(c.formatter,b.formatter,g.res);g.parser=e(c.parser,b.parser,g.res);t[a]=g};d.compile=function(a){for(var c=/\[([^\[\]]|\[[^\[\]]*])*]|([A-Za-z])\2+|\.{3}|./g,b,e=[a];b=c.exec(a);)e[e.length]=b[0];return e};d.format=function(a,c,b){c="string"===typeof c?d.compile(c):c;a=d.addMinutes(a,b?a.getTimezoneOffset():
+0);var e=t[m].formatter,g="";a.utc=b||!1;b=1;for(var h=c.length,f;b<h;b++)f=c[b],g+=e[f]?e.post(e[f](a,c[0])):f.replace(/\[(.*)]/,"$1");return g};d.preparse=function(a,c){var b="string"===typeof c?d.compile(c):c,e={Y:1970,M:1,D:1,H:0,A:0,h:0,m:0,s:0,S:0,Z:0,_index:0,_length:0,_match:0},g=/\[(.*)]/,h=t[m].parser,f=0;a=h.pre(a);for(var l=1,p=b.length,k,n;l<p;l++)if(k=b[l],h[k]){n=h[k](a.slice(f),b[0]);if(!n.length)break;f+=n.length;e[k.charAt(0)]=n.value;e._match++}else if(k===a.charAt(f)||" "===k)f++;
+else if(g.test(k)&&!a.slice(f).indexOf(g.exec(k)[1]))f+=k.length-2;else{"..."===k&&(f=a.length);break}e.H=e.H||h.h12(e.h,e.A);e._index=f;e._length=a.length;return e};d.isValid=function(a,c){var b="string"===typeof a?d.preparse(a,c):a,e=[31,28+d.isLeapYear(b.Y)|0,31,30,31,30,31,31,30,31,30,31][b.M-1];return!(1>b._index||1>b._length||b._index-b._length||1>b._match||1>b.Y||9999<b.Y||1>b.M||12<b.M||1>b.D||b.D>e||0>b.H||23<b.H||0>b.m||59<b.m||0>b.s||59<b.s||0>b.S||999<b.S||-720>b.Z||840<b.Z)};d.parse=
+function(a,c,b){a=d.preparse(a,c);return d.isValid(a)?(a.M-=100>a.Y?22801:1,b||a.Z?new Date(Date.UTC(a.Y,a.M,a.D,a.H,a.m+a.Z,a.s,a.S)):new Date(a.Y,a.M,a.D,a.H,a.m,a.s,a.S)):new Date(NaN)};d.transform=function(a,c,b,e){return d.format(d.parse(a,c),b,e)};d.addYears=function(a,c){return d.addMonths(a,12*c)};d.addMonths=function(a,c){var b=new Date(a.getTime());b.setMonth(b.getMonth()+c);return b};d.addDays=function(a,c){var b=new Date(a.getTime());b.setDate(b.getDate()+c);return b};d.addHours=function(a,
+c){return d.addMinutes(a,60*c)};d.addMinutes=function(a,c){return d.addSeconds(a,60*c)};d.addSeconds=function(a,c){return d.addMilliseconds(a,1E3*c)};d.addMilliseconds=function(a,c){return new Date(a.getTime()+c)};d.subtract=function(a,c){var b=a.getTime()-c.getTime();return{toMilliseconds:function(){return b},toSeconds:function(){return b/1E3},toMinutes:function(){return b/6E4},toHours:function(){return b/36E5},toDays:function(){return b/864E5}}};d.isLeapYear=function(a){return!(a%4)&&!!(a%100)||
+!(a%400)};d.isSameDay=function(a,c){return a.toDateString()===c.toDateString()};d.locale=function(a,c){c?u(a,{res:v,formatter:w,parser:x},c):"function"===typeof a?m=a(d):a&&(q&&!q.date&&console.warn("This method of changing the locale is deprecated. See documentation for details."),m=a);return m};d.extend=function(a){var c=a.extender||{},b;for(b in c)d[b]||(d[b]=c[b]);(a.formatter||a.parser||a.res)&&u(m,t[m],a)};d.plugin=function(a,c){"function"===typeof a?d.extend(r[a(d)]):(r[a]=r[a]||c,!c&&r[a]&&
+(d.extend(r[a]),q&&!q.date&&console.warn("This method of applying plugins is deprecated. See documentation for details.")))};d.locale(m,{});"object"===typeof module&&"object"===typeof module.exports?module.exports=d:"function"===typeof define&&define.amd?define([],function(){return d}):q.date=d})(this);

Vulnerable code:         var re = /\[([^\[\]]*|\[[^\[\]]*\])*\]|([A-Za-z])\2+|\.{3}|./g, keys, pattern = [formatString];
c,b){var e=function(h,f,l){var p=function(n){n&&(this.res=n)};p.prototype=h;p.prototype.constructor=p;h=new p(l);for(var k in f||{})l=f[k],h[k]=l.slice?l.slice():l;return h},g={res:e(c.res,b.res)};g.formatter=e(c.formatter,b.formatter,g.res);g.parser=e(c.parser,b.parser,g.res);t[a]=g};d.compile=function(a){for(var c=/\[([^\[\]]*|\[[^\[\]]*\])*\]|([A-Za-z])\2+|\.{3}|./g,b,e=[a];b=c.exec(a);)e[e.length]=b[0];return e};d.format=function(a,c,b){c="string"===typeof c?d.compile(c):c;a=d.addMinutes(a,b?
a.getTimezoneOffset():0);var e=t[m].formatter,g="";a.utc=b||!1;b=1;for(var h=c.length,f;b<h;b++)f=c[b],g+=e[f]?e.post(e[f](a,c[0])):f.replace(/\[(.*)]/,"$1");return g};d.preparse=function(a,c){var b="string"===typeof c?d.compile(c):c,e={Y:1970,M:1,D:1,H:0,A:0,h:0,m:0,s:0,S:0,Z:0,_index:0,_length:0,_match:0},g=/\[(.*)]/,h=t[m].parser,f=0;a=h.pre(a);for(var l=1,p=b.length,k,n;l<p;l++)if(k=b[l],h[k]){n=h[k](a.slice(f),b[0]);if(!n.length)break;f+=n.length;e[k.charAt(0)]=n.value;e._match++}else if(k===
a.charAt(f)||" "===k)f++;else if(g.test(k)&&!a.slice(f).indexOf(g.exec(k)[1]))f+=k.length-2;else{"..."===k&&(f=a.length);break}e.H=e.H||h.h12(e.h,e.A);e._index=f;e._length=a.length;return e};d.isValid=function(a,c){var b="string"===typeof a?d.preparse(a,c):a,e=[31,28+d.isLeapYear(b.Y)|0,31,30,31,30,31,31,30,31,30,31][b.M-1];return!(1>b._index||1>b._length||b._index-b._length||1>b._match||1>b.Y||9999<b.Y||1>b.M||12<b.M||1>b.D||b.D>e||0>b.H||23<b.H||0>b.m||59<b.m||0>b.s||59<b.s||0>b.S||999<b.S||-720>
b.Z||840<b.Z)};d.parse=function(a,c,b){a=d.preparse(a,c);return d.isValid(a)?(a.M-=100>a.Y?22801:1,b||a.Z?new Date(Date.UTC(a.Y,a.M,a.D,a.H,a.m+a.Z,a.s,a.S)):new Date(a.Y,a.M,a.D,a.H,a.m,a.s,a.S)):new Date(NaN)};d.transform=function(a,c,b,e){return d.format(d.parse(a,c),b,e)};d.addYears=function(a,c){return d.addMonths(a,12*c)};d.addMonths=function(a,c){var b=new Date(a.getTime());b.setMonth(b.getMonth()+c);return b};d.addDays=function(a,c){var b=new Date(a.getTime());b.setDate(b.getDate()+c);return b};
d.addHours=function(a,c){return d.addMinutes(a,60*c)};d.addMinutes=function(a,c){return d.addSeconds(a,60*c)};d.addSeconds=function(a,c){return d.addMilliseconds(a,1E3*c)};d.addMilliseconds=function(a,c){return new Date(a.getTime()+c)};d.subtract=function(a,c){var b=a.getTime()-c.getTime();return{toMilliseconds:function(){return b},toSeconds:function(){return b/1E3},toMinutes:function(){return b/6E4},toHours:function(){return b/36E5},toDays:function(){return b/864E5}}};d.isLeapYear=function(a){return!(a%
4)&&!!(a%100)||!(a%400)};d.isSameDay=function(a,c){return a.toDateString()===c.toDateString()};d.locale=function(a,c){c?u(a,{res:v,formatter:w,parser:x},c):"function"===typeof a?m=a(d):a&&(q&&!q.date&&console.warn("This method of changing the locale is deprecated. See documentation for details."),m=a);return m};d.extend=function(a){var c=a.extender||{},b;for(b in c)d[b]||(d[b]=c[b]);(a.formatter||a.parser||a.res)&&u(m,t[m],a)};d.plugin=function(a,c){"function"===typeof a?d.extend(r[a(d)]):(r[a]=r[a]||
c,!c&&r[a]&&(d.extend(r[a]),q&&!q.date&&console.warn("This method of applying plugins is deprecated. See documentation for details.")))};d.locale(m,{});"object"===typeof module&&"object"===typeof module.exports?module.exports=d:"function"===typeof define&&define.amd?define([],function(){return d}):q.date=d})(this);
Fixed code:         var re = /\[([^\[\]]|\[[^\[\]]*])*]|([A-Za-z])\2+|\.{3}|./g, keys, pattern = [formatString];
c,b){var e=function(h,f,l){var p=function(n){n&&(this.res=n)};p.prototype=h;p.prototype.constructor=p;h=new p(l);for(var k in f||{})l=f[k],h[k]=l.slice?l.slice():l;return h},g={res:e(c.res,b.res)};g.formatter=e(c.formatter,b.formatter,g.res);g.parser=e(c.parser,b.parser,g.res);t[a]=g};d.compile=function(a){for(var c=/\[([^\[\]]|\[[^\[\]]*])*]|([A-Za-z])\2+|\.{3}|./g,b,e=[a];b=c.exec(a);)e[e.length]=b[0];return e};d.format=function(a,c,b){c="string"===typeof c?d.compile(c):c;a=d.addMinutes(a,b?a.getTimezoneOffset():
0);var e=t[m].formatter,g="";a.utc=b||!1;b=1;for(var h=c.length,f;b<h;b++)f=c[b],g+=e[f]?e.post(e[f](a,c[0])):f.replace(/\[(.*)]/,"$1");return g};d.preparse=function(a,c){var b="string"===typeof c?d.compile(c):c,e={Y:1970,M:1,D:1,H:0,A:0,h:0,m:0,s:0,S:0,Z:0,_index:0,_length:0,_match:0},g=/\[(.*)]/,h=t[m].parser,f=0;a=h.pre(a);for(var l=1,p=b.length,k,n;l<p;l++)if(k=b[l],h[k]){n=h[k](a.slice(f),b[0]);if(!n.length)break;f+=n.length;e[k.charAt(0)]=n.value;e._match++}else if(k===a.charAt(f)||" "===k)f++;
else if(g.test(k)&&!a.slice(f).indexOf(g.exec(k)[1]))f+=k.length-2;else{"..."===k&&(f=a.length);break}e.H=e.H||h.h12(e.h,e.A);e._index=f;e._length=a.length;return e};d.isValid=function(a,c){var b="string"===typeof a?d.preparse(a,c):a,e=[31,28+d.isLeapYear(b.Y)|0,31,30,31,30,31,31,30,31,30,31][b.M-1];return!(1>b._index||1>b._length||b._index-b._length||1>b._match||1>b.Y||9999<b.Y||1>b.M||12<b.M||1>b.D||b.D>e||0>b.H||23<b.H||0>b.m||59<b.m||0>b.s||59<b.s||0>b.S||999<b.S||-720>b.Z||840<b.Z)};d.parse=
function(a,c,b){a=d.preparse(a,c);return d.isValid(a)?(a.M-=100>a.Y?22801:1,b||a.Z?new Date(Date.UTC(a.Y,a.M,a.D,a.H,a.m+a.Z,a.s,a.S)):new Date(a.Y,a.M,a.D,a.H,a.m,a.s,a.S)):new Date(NaN)};d.transform=function(a,c,b,e){return d.format(d.parse(a,c),b,e)};d.addYears=function(a,c){return d.addMonths(a,12*c)};d.addMonths=function(a,c){var b=new Date(a.getTime());b.setMonth(b.getMonth()+c);return b};d.addDays=function(a,c){var b=new Date(a.getTime());b.setDate(b.getDate()+c);return b};d.addHours=function(a,
c){return d.addMinutes(a,60*c)};d.addMinutes=function(a,c){return d.addSeconds(a,60*c)};d.addSeconds=function(a,c){return d.addMilliseconds(a,1E3*c)};d.addMilliseconds=function(a,c){return new Date(a.getTime()+c)};d.subtract=function(a,c){var b=a.getTime()-c.getTime();return{toMilliseconds:function(){return b},toSeconds:function(){return b/1E3},toMinutes:function(){return b/6E4},toHours:function(){return b/36E5},toDays:function(){return b/864E5}}};d.isLeapYear=function(a){return!(a%4)&&!!(a%100)||
!(a%400)};d.isSameDay=function(a,c){return a.toDateString()===c.toDateString()};d.locale=function(a,c){c?u(a,{res:v,formatter:w,parser:x},c):"function"===typeof a?m=a(d):a&&(q&&!q.date&&console.warn("This method of changing the locale is deprecated. See documentation for details."),m=a);return m};d.extend=function(a){var c=a.extender||{},b;for(b in c)d[b]||(d[b]=c[b]);(a.formatter||a.parser||a.res)&&u(m,t[m],a)};d.plugin=function(a,c){"function"===typeof a?d.extend(r[a(d)]):(r[a]=r[a]||c,!c&&r[a]&&
(d.extend(r[a]),q&&!q.date&&console.warn("This method of applying plugins is deprecated. See documentation for details.")))};d.locale(m,{});"object"===typeof module&&"object"===typeof module.exports?module.exports=d:"function"===typeof define&&define.amd?define([],function(){return d}):q.date=d})(this);