Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: Qix-/color-string
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: 1.5.4
Choose a base ref
...
head repository: Qix-/color-string
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: 1.6.0
Choose a head ref
  • 6 commits
  • 4 files changed
  • 3 contributors

Commits on Mar 5, 2021

  1. fix ReDos in hwb() parser (low-severity)

    Discovered by Yeting Li, c/o Colin Ife via Snyk.io.
    
    A ReDos (Regular Expression Denial of Service) vulnerability
    was responsibly disclosed to me via email by Colin on
    Mar 5 2021 regarding an exponential time complexity for
    linearly increasing input lengths for `hwb()` color strings.
    
    Strings reaching more than 5000 characters would see several
    milliseconds of processing time; strings reaching more than
    50,000 characters began seeing 1500ms (1.5s) of processing time.
    
    The cause was due to a the regular expression that parses
    hwb() strings - specifically, the hue value - where
    the integer portion of the hue value used a 0-or-more quantifier
    shortly thereafter followed by a 1-or-more quantifier.
    
    This caused excessive backtracking and a cartesian scan,
    resulting in exponential time complexity given a linear
    increase in input length.
    
    Thank you Yeting Li and Colin Ife for bringing this to my
    attention in a secure, responsible and professional manner.
    
    A CVE will not be assigned for this vulnerability.
    Qix- committed Mar 5, 2021
    Configuration menu
    Copy the full SHA
    0789e21 View commit details
    Browse the repository at this point in the history
  2. 1.5.5

    Qix- committed Mar 5, 2021
    Configuration menu
    Copy the full SHA
    966ae4d View commit details
    Browse the repository at this point in the history

Commits on Jul 17, 2021

  1. Add tests for space-separated HSL syntax

    htunnicliff authored and Qix- committed Jul 17, 2021
    Configuration menu
    Copy the full SHA
    0264546 View commit details
    Browse the repository at this point in the history
  2. Update HSL regular expression

    htunnicliff authored and Qix- committed Jul 17, 2021
    Configuration menu
    Copy the full SHA
    6f73e20 View commit details
    Browse the repository at this point in the history
  3. Add additional HSL examples to README

    htunnicliff authored and Qix- committed Jul 17, 2021
    Configuration menu
    Copy the full SHA
    2b6f59c View commit details
    Browse the repository at this point in the history
  4. 1.6.0

    Qix- committed Jul 17, 2021
    Configuration menu
    Copy the full SHA
    1a68f9e View commit details
    Browse the repository at this point in the history
Loading