Regular Expression Denial of Service

[cleiton-tavares]

As reported by nodesecurity there is a known bug that allows denial of service as attached below

NodeSecurity Report
Affected versions of string are vulnerable to regular expression denial of service when specifically crafted untrusted user input is passed into the underscore or unescapeHTML methods.

Read more - https://nodesecurity.io/advisories/536

[xinghengwang]

Thank you.

The issue is regarding using underscore and unescapeHTML methods of the string.js libary.
jprichardson/string.js#212

The moesif-express library does not use those two methods, but regardless, we will also remove the dependency on "string.js" sometime in the future.