Regular Expression Denial of Service in timespan

department-of-veterans-affairs / va.gov-cms

Editor-centered management for Veteran-centered content.

https://prod.cms.va.gov

GNU General Public License v2.0

96 stars 70 forks source link

Regular Expression Denial of Service in timespan #18059

Open edmund-dunn opened 4 months ago

edmund-dunn commented 4 months ago

Description

This is partly a discovery ticket. If you find this is blocked because of version issues, especially with node please annotate that in the Confluence page and here in the ticket.

There is no patch available for this package.

Acceptance Criteria

[ ] Find a replacement package for timespan.
[ ] Identify and refactor whatever uses timespan.

anantais commented 2 months ago

possible solution that I am looking into - https://www.npmjs.com/package/time-span