
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
github.com/GoogleChrome/dialog-polyfill
dialog-polyfill.js is a polyfill for <dialog>
and <form method="dialog">
.
Check out some demos!
<dialog>
is an element for a popup box in a web page, including a modal option which will make the rest of the page inert during use.
This could be useful to block a user's interaction until they give you a response, or to confirm an action.
See the HTML spec.
You may optionally install via NPM -
$ npm install dialog-polyfill
There are several ways that to include the dialog polyfill:
dist/dialog-polyfill.js
script directly in your HTML, which exposes a global dialogPolyfill
function.import
(es modules)require
(commonjs/node)// direct import (script module, deno)
import dialogPolyfill from './node_modules/dialog-polyfill/dist/dialog-polyfill.esm.js';
// *OR*
// modern es modules with rollup/webpack bundlers, and node via esm module
import dialogPolyfill from 'dialog-polyfill'
// *OR*
// traditional commonjs/node and browserify bundler
const dialogPolyfill = require('dialog-polyfill')
This polyfill works on modern versions of all major browsers. It also supports IE9 and above. It can work when used inside Shadow DOM, but it's not recommended.
<head>
of your document, and the JS anywhere before referencing dialogPolyfill
.dialogPolyfill.registerDialog()
, passing it one node at a time. This polyfill won't replace native support.<dialog>
elements!<head>
<link rel="stylesheet" type="text/css" href="dist/dialog-polyfill.css" />
</head>
<body>
<dialog>
I'm a dialog!
<form method="dialog">
<input type="submit" value="Close" />
</form>
</dialog>
<script src="dist/dialog-polyfill.js"></script>
<script>
var dialog = document.querySelector('dialog');
dialogPolyfill.registerDialog(dialog);
// Now dialog always acts like a native <dialog>.
dialog.showModal();
</script>
</body>
In native <dialog>
, the backdrop is a pseudo-element.
When using the polyfill, the backdrop will be an adjacent element:
dialog::backdrop { /* native */
background-color: green;
}
dialog + .backdrop { /* polyfill */
background-color: green;
}
In the polyfill, modal dialogs have limitations-
The major limitation of the polyfill is that dialogs should not have parents that create a stacking context.
The easiest way to solve this is to move your <dialog>
element to be a child of <body>
.
If this isn't possible you may still be able to use the dialog. However, you may want to resolve it for two major reasons-
To position a dialog in the center (regardless of user scroll position or stacking context), you can specify the following CSS-
dialog {
position: fixed;
top: 50%;
transform: translate(0, -50%);
}
This is also provided as a helper CSS class in the polyfill CSS, .fixed
.
You can apply by using HTML like <dialog class="fixed">
.
The WAI-ARIA doc suggests returning focus to the previously focused element after a modal dialog is closed.
However, this is not part of the dialog spec itself.
See this snippet to add this, even to the native dialog
.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.