https://snyk.io/vuln/npm:ms:20170412 possible fix

[Delagen]

May split to 2 regular matchers

var testScale=/^milliseconds?|msecs?|ms|seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|years?|yrs?|y$/i;
function parse(str) {
  str = String(str);
  if (str.length > 10000) {
    return;
  }
  var match = /^((?:\d+)?\.?\d+)\s*(\w*)$/i.exec(
    str
  );
  if (!match) {
    return;
  }
  if(match[2] && !testScale.test(match[2])){
    return;
  }

with test

describe("CWE-400", function (){
  it('should break if longer than 50ms', function() {
    this.timeout(50);
    ms('1'.repeat(9998) + 'Q');
  });
});

[leo]

Fixed in #89

[Delagen]

for (var i = 0; i < 1000; i++) {
ms("1".repeat(98) + "Q");
}

time: 72.148ms
Split regex implementation time: 8.242ms

[Delagen]

Moreover this may be faster

var scales = {
	"years":        y,
	"year":         y,
	"yrs":          y,
	"yr":           y,
	"y":            y,
	"days":         d,
	"day":          d,
	"d":            d,
	"hours":        h,
	"hour":         h,
	"hrs":          h,
	"hr":           h,
	"h":            h,
	"minutes":      m,
	"minute":       m,
	"mins":         m,
	"min":          m,
	"m":            m,
	"seconds":      s,
	"second":       s,
	"secs":         s,
	"sec":          s,
	"s":            s,
	"milliseconds": 1,
	"millisecond":  1,
	"msecs":        1,
	"msec":         1,
	"ms":           1
};
function parse(str) {
	str = String(str);
	var match = str.split(/\s*?(?=[a-z])/i);
	var n = parseFloat(+match[0]);
	if (isNaN(n)) {
		return;
	}
	var scale = (match.slice(1).join("") || "ms").toLowerCase();
	if (!(scale in scales)) {
		return;
	}
	return n * scales[scale];
}

[Delagen]

I can open Mr, i have 1 more optimization with remove slice, join

[Delagen]

Opened PR #91

[leerob]

Closing as stale 🙏