CVE-2020-26289 (JavaScript, published 2020-12-28T19:15Z)
Description: value: date-and-time is an npm package for manipulating date and time. In date-and-time before version 0.14.2, there a regular expression involved in parsing which can be exploited to to cause a denial of service. This is fixed in version 0.14.2.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/knowledgecode/date-and-time
Files changed:
date-and-time.js
date-and-time.min.js
Commit message: Fixed regular expression denial of service (ReDoS) vulnerability


Vulnerable code:
        var re = /\[([^\[\]]*|\[[^\[\]]*\])*\]|([A-Za-z])\2+|\.{3}|./g, keys, pattern = [formatString];
c,b){var e=function(h,f,l){var p=function(n){n&&(this.res=n)};p.prototype=h;p.prototype.constructor=p;h=new p(l);for(var k in f||{})l=f[k],h[k]=l.slice?l.slice():l;return h},g={res:e(c.res,b.res)};g.formatter=e(c.formatter,b.formatter,g.res);g.parser=e(c.parser,b.parser,g.res);t[a]=g};d.compile=function(a){for(var c=/\[([^\[\]]*|\[[^\[\]]*\])*\]|([A-Za-z])\2+|\.{3}|./g,b,e=[a];b=c.exec(a);)e[e.length]=b[0];return e};d.format=function(a,c,b){c="string"===typeof c?d.compile(c):c;a=d.addMinutes(a,b?
a.getTimezoneOffset():0);var e=t[m].formatter,g="";a.utc=b||!1;b=1;for(var h=c.length,f;b<h;b++)f=c[b],g+=e[f]?e.post(e[f](a,c[0])):f.replace(/\[(.*)]/,"$1");return g};d.preparse=function(a,c){var b="string"===typeof c?d.compile(c):c,e={Y:1970,M:1,D:1,H:0,A:0,h:0,m:0,s:0,S:0,Z:0,_index:0,_length:0,_match:0},g=/\[(.*)]/,h=t[m].parser,f=0;a=h.pre(a);for(var l=1,p=b.length,k,n;l<p;l++)if(k=b[l],h[k]){n=h[k](a.slice(f),b[0]);if(!n.length)break;f+=n.length;e[k.charAt(0)]=n.value;e._match++}else if(k===
a.charAt(f)||" "===k)f++;else if(g.test(k)&&!a.slice(f).indexOf(g.exec(k)[1]))f+=k.length-2;else{"..."===k&&(f=a.length);break}e.H=e.H||h.h12(e.h,e.A);e._index=f;e._length=a.length;return e};d.isValid=function(a,c){var b="string"===typeof a?d.preparse(a,c):a,e=[31,28+d.isLeapYear(b.Y)|0,31,30,31,30,31,31,30,31,30,31][b.M-1];return!(1>b._index||1>b._length||b._index-b._length||1>b._match||1>b.Y||9999<b.Y||1>b.M||12<b.M||1>b.D||b.D>e||0>b.H||23<b.H||0>b.m||59<b.m||0>b.s||59<b.s||0>b.S||999<b.S||-720>
b.Z||840<b.Z)};d.parse=function(a,c,b){a=d.preparse(a,c);return d.isValid(a)?(a.M-=100>a.Y?22801:1,b||a.Z?new Date(Date.UTC(a.Y,a.M,a.D,a.H,a.m+a.Z,a.s,a.S)):new Date(a.Y,a.M,a.D,a.H,a.m,a.s,a.S)):new Date(NaN)};d.transform=function(a,c,b,e){return d.format(d.parse(a,c),b,e)};d.addYears=function(a,c){return d.addMonths(a,12*c)};d.addMonths=function(a,c){var b=new Date(a.getTime());b.setMonth(b.getMonth()+c);return b};d.addDays=function(a,c){var b=new Date(a.getTime());b.setDate(b.getDate()+c);return b};
d.addHours=function(a,c){return d.addMinutes(a,60*c)};d.addMinutes=function(a,c){return d.addSeconds(a,60*c)};d.addSeconds=function(a,c){return d.addMilliseconds(a,1E3*c)};d.addMilliseconds=function(a,c){return new Date(a.getTime()+c)};d.subtract=function(a,c){var b=a.getTime()-c.getTime();return{toMilliseconds:function(){return b},toSeconds:function(){return b/1E3},toMinutes:function(){return b/6E4},toHours:function(){return b/36E5},toDays:function(){return b/864E5}}};d.isLeapYear=function(a){return!(a%
4)&&!!(a%100)||!(a%400)};d.isSameDay=function(a,c){return a.toDateString()===c.toDateString()};d.locale=function(a,c){c?u(a,{res:v,formatter:w,parser:x},c):"function"===typeof a?m=a(d):a&&(q&&!q.date&&console.warn("This method of changing the locale is deprecated. See documentation for details."),m=a);return m};d.extend=function(a){var c=a.extender||{},b;for(b in c)d[b]||(d[b]=c[b]);(a.formatter||a.parser||a.res)&&u(m,t[m],a)};d.plugin=function(a,c){"function"===typeof a?d.extend(r[a(d)]):(r[a]=r[a]||
c,!c&&r[a]&&(d.extend(r[a]),q&&!q.date&&console.warn("This method of applying plugins is deprecated. See documentation for details.")))};d.locale(m,{});"object"===typeof module&&"object"===typeof module.exports?module.exports=d:"function"===typeof define&&define.amd?define([],function(){return d}):q.date=d})(this);

Fixed code:
        var re = /\[([^\[\]]|\[[^\[\]]*])*]|([A-Za-z])\2+|\.{3}|./g, keys, pattern = [formatString];
c,b){var e=function(h,f,l){var p=function(n){n&&(this.res=n)};p.prototype=h;p.prototype.constructor=p;h=new p(l);for(var k in f||{})l=f[k],h[k]=l.slice?l.slice():l;return h},g={res:e(c.res,b.res)};g.formatter=e(c.formatter,b.formatter,g.res);g.parser=e(c.parser,b.parser,g.res);t[a]=g};d.compile=function(a){for(var c=/\[([^\[\]]|\[[^\[\]]*])*]|([A-Za-z])\2+|\.{3}|./g,b,e=[a];b=c.exec(a);)e[e.length]=b[0];return e};d.format=function(a,c,b){c="string"===typeof c?d.compile(c):c;a=d.addMinutes(a,b?a.getTimezoneOffset():
0);var e=t[m].formatter,g="";a.utc=b||!1;b=1;for(var h=c.length,f;b<h;b++)f=c[b],g+=e[f]?e.post(e[f](a,c[0])):f.replace(/\[(.*)]/,"$1");return g};d.preparse=function(a,c){var b="string"===typeof c?d.compile(c):c,e={Y:1970,M:1,D:1,H:0,A:0,h:0,m:0,s:0,S:0,Z:0,_index:0,_length:0,_match:0},g=/\[(.*)]/,h=t[m].parser,f=0;a=h.pre(a);for(var l=1,p=b.length,k,n;l<p;l++)if(k=b[l],h[k]){n=h[k](a.slice(f),b[0]);if(!n.length)break;f+=n.length;e[k.charAt(0)]=n.value;e._match++}else if(k===a.charAt(f)||" "===k)f++;
else if(g.test(k)&&!a.slice(f).indexOf(g.exec(k)[1]))f+=k.length-2;else{"..."===k&&(f=a.length);break}e.H=e.H||h.h12(e.h,e.A);e._index=f;e._length=a.length;return e};d.isValid=function(a,c){var b="string"===typeof a?d.preparse(a,c):a,e=[31,28+d.isLeapYear(b.Y)|0,31,30,31,30,31,31,30,31,30,31][b.M-1];return!(1>b._index||1>b._length||b._index-b._length||1>b._match||1>b.Y||9999<b.Y||1>b.M||12<b.M||1>b.D||b.D>e||0>b.H||23<b.H||0>b.m||59<b.m||0>b.s||59<b.s||0>b.S||999<b.S||-720>b.Z||840<b.Z)};d.parse=
function(a,c,b){a=d.preparse(a,c);return d.isValid(a)?(a.M-=100>a.Y?22801:1,b||a.Z?new Date(Date.UTC(a.Y,a.M,a.D,a.H,a.m+a.Z,a.s,a.S)):new Date(a.Y,a.M,a.D,a.H,a.m,a.s,a.S)):new Date(NaN)};d.transform=function(a,c,b,e){return d.format(d.parse(a,c),b,e)};d.addYears=function(a,c){return d.addMonths(a,12*c)};d.addMonths=function(a,c){var b=new Date(a.getTime());b.setMonth(b.getMonth()+c);return b};d.addDays=function(a,c){var b=new Date(a.getTime());b.setDate(b.getDate()+c);return b};d.addHours=function(a,
c){return d.addMinutes(a,60*c)};d.addMinutes=function(a,c){return d.addSeconds(a,60*c)};d.addSeconds=function(a,c){return d.addMilliseconds(a,1E3*c)};d.addMilliseconds=function(a,c){return new Date(a.getTime()+c)};d.subtract=function(a,c){var b=a.getTime()-c.getTime();return{toMilliseconds:function(){return b},toSeconds:function(){return b/1E3},toMinutes:function(){return b/6E4},toHours:function(){return b/36E5},toDays:function(){return b/864E5}}};d.isLeapYear=function(a){return!(a%4)&&!!(a%100)||
!(a%400)};d.isSameDay=function(a,c){return a.toDateString()===c.toDateString()};d.locale=function(a,c){c?u(a,{res:v,formatter:w,parser:x},c):"function"===typeof a?m=a(d):a&&(q&&!q.date&&console.warn("This method of changing the locale is deprecated. See documentation for details."),m=a);return m};d.extend=function(a){var c=a.extender||{},b;for(b in c)d[b]||(d[b]=c[b]);(a.formatter||a.parser||a.res)&&u(m,t[m],a)};d.plugin=function(a,c){"function"===typeof a?d.extend(r[a(d)]):(r[a]=r[a]||c,!c&&r[a]&&
(d.extend(r[a]),q&&!q.date&&console.warn("This method of applying plugins is deprecated. See documentation for details.")))};d.locale(m,{});"object"===typeof module&&"object"===typeof module.exports?module.exports=d:"function"===typeof define&&define.amd?define([],function(){return d}):q.date=d})(this);