3 ms·

I think it helps to inform the developer about possible issues, but I think in most cases depending on the software this is plainly not relevant and can be igno

I think it helps to inform the developer about possible issues, but I think in most cases depending on the software this is plainly not relevant and can be ignored. I wouldn't classify it has high severity. Also, It might just not be trivial to develop a regex library that cannot be DDOSed or the mechanism that was declared a vulnerability. Might be nice to be able to tag libraries that should be ignored in audits. Perhaps there is such a function, not really a NPM expert. But if your projects has too many of these "high severity" problems, you probably stop doing them. Still, I think the availability of such audits from the package manager is quite neat. As an embedded dev I think these are certainly luxury problems.

krageon 5y ago
If it's too hard for you to develop a library hardened against DoS attacks which are pretty trivial to perform perhaps it's a good thing that npm audit flags your library as containing bugs.
- junon 5y ago
  A bit pretentious to imply you're better than everyone else at writing regular expressions, so much so that you'd never write one that had exponential time/space complexity on large inputs. Or do you just not understand what regex DoS vulnerabilities are? Either way, you come across very foul and condescending in this comment.
  - krageon 5y ago
    You're attacking a strawman, not me.