fix: eliminate ReDoS

This change fixes the regular expression denial of service
vulnerability.

This also fixes some incorrect tests that concealed a bug.

Fixes: gulpjs#32
Refs: https://app.snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905

index.js

@@ -6,7 +6,7 @@ var isWin32 = require('os').platform() === 'win32';
 
 var slash = '/';
 var backslash = /\\/g;
-var enclosure = /[\{\[].*[\/]*.*[\}\]]$/;
+var enclosure = /[\{\[].*\/.*[\}\]]$/;
 var globby = /(^|[^\\])([\{\[]|\([^\)]+$)/;
 var escaped = /\\([\!\*\?\|\[\]\(\)\{\}])/g;
 

test/index.test.js

@@ -73,10 +73,10 @@ describe('glob-parent', function() {
     assert.equal(gp('path/\\*\\(a\\|b\\)/subdir/foo.*'), 'path/*(a|b)/subdir');
     assert.equal(gp('path/\\[foo bar\\]/subdir/foo.*'), 'path/[foo bar]/subdir');
     assert.equal(gp('path/\\[bar]/'), 'path/[bar]');
-    assert.equal(gp('path/\\[bar]'), 'path/[bar]');
+    assert.equal(gp('path/\\[bar]'), 'path');
     assert.equal(gp('[bar]'), '.');
     assert.equal(gp('[bar]/'), '.');
-    assert.equal(gp('./\\[bar]'), './[bar]');
+    assert.equal(gp('./\\[bar]'), '.');
     assert.equal(gp('\\[bar]/'), '[bar]');
     assert.equal(gp('\\!dir/*'), '!dir');
     assert.equal(gp('[bar\\]/'), '.');
@@ -91,9 +91,9 @@ describe('glob-parent', function() {
       assert.equal(gp('foo-\\(bar\\).md'), 'foo-');
     } else {
       assert.equal(gp('foo-\\(bar\\).md'), '.');
-      assert.equal(gp('\\[bar]'), '[bar]');
+      assert.equal(gp('\\[bar]'), '.');
       assert.equal(gp('[bar\\]'), '.');
-      assert.equal(gp('\\{foo,bar\\}'), '{foo,bar}');
+      assert.equal(gp('\\{foo,bar\\}'), '.');
       assert.equal(gp('{foo,bar\\}'), '.');
     }
 
@@ -209,6 +209,13 @@ describe('glob2base test patterns', function() {
 
     done();
   });
+
+  it('should not be susceptible to SNYK-JS-GLOBPARENT-1016905', function(done) {
+    // This will time out if susceptible.
+    gp('{' + '/'.repeat(5000));
+
+    done();
+  });
 });
 
 if (isWin32) {