Remove parsejson NPM package

[mattgrande]

Prevents a potential ReDoS. See here: https://nodesecurity.io/advisories/528

I couldn't find any benefits to using parsejson; It seems to just call JSON.parse if it exists, and it exists in every node version, and every browser released since 2008.

Should I run the make and include it in this PR, or is that done by a build server or something along those lines?

The kind of change this PR does introduce

• a bug fix
• a new feature
• an update to the documentation
• a code change that improves performance
• other

Current behaviour

Potential ReDoS for large strings due to parsejson package.

New behaviour

Removes parsejson in favour of native parsing.

Other information (e.g. related issues)

Reported here: #579

[mattgrande]

Thanks @kaarelkk. Should I run the make and include it in this PR, or is that done by a build server or something along those lines?

[justingreenberg]

@nuclearace @darrachequesne any shot at getting this merged and release a patch ASAP? the advisory #528 was released last Thu at 12:16 AM EST... as both NSP and Snyk are failing, i assume this is causing logjam in many CI/CD pipelines

vulnerable dependency path:

socket.io@2.0.3 > socket.io-client@2.0.3 > engine.io-client@3.1.1 > parsejson@0.0.3

the socket.io-client dependency on engine.io-client version is declared with tilde (~3.1.1) so a patch to engine.io-client should propagate up chain and resolve issue

[darrachequesne]

Thanks!