Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/carnageous/go-canvas
go-canvas is a pure go+webassembly Library for efficiently drawing on a html5 canvas
element within the browser from go without requiring calls back to JS to utilise canvas drawing functions.
The library provides the following features:
requestAnimationFrame
callback from the browser.go-canvas takes an alternate approach to the current common methods for using canvas, allowing all drawing primitives to be done totally with go code, without calling JS.
In a standard WASM application for canvas, the go code must create a function that responds to requestAnimationFrame
callbacks and renders the frame within that call. It interacts with the canvas drawing primitives via the syscall/js functions and context switches. i.e.
laserCtx.Call("beginPath")
laserCtx.Call("arc", gs.laserX, gs.laserY, gs.laserSize, 0, math.Pi*2, false)
laserCtx.Call("fill")
laserCtx.Call("closePath")
Downsides of this approach (for me at least), are messy JS calls which can't easily be checked at compile time, forcing a full redraw every frame, even if nothing changed on that canvas, or changes being much slower than the requested frame rate.
go-canvas allows all drawing to be done natively using Go by creating an entirely separate image buffer which is drawn to using a 2D drawing library. I'm currently using one from https://github.com/llgcode/draw2d which provides most of the standard canvas primitives and more. This shadow Image buffer can be updated at whatever rate the developer deems appropriate, which may very well be slower than the browsers animation rate.
This shadow Image buffer is then copied over to the browser canvas buffer during each requestAnimationFrame
callback, at whatever rate the browser requests. The handling of the callback and copy is done automatically within the library.
Secondly, this also allows the option of drawing to the image buffer, outside of the requestAnimationFrame
callback if required. After some testing it appears that it is still best to do the drawing within the requestAnimationFrame
callback.
go-canvas provides several options to control all this, and take care of the browser/dom interactions
requestAnimationFrame
callback does nothing, just returns immediately, saving CPU cycles. (No point to copy buffers and redraw if nothing has changed) This allows the drawing to be adaptive to the rate of data changes.requestAnimationFrame
callback to only do redraws or image buffer copies to this max rate. Note it MAY be slower depending on the Render time, and the requirements of the browser doing other work. When a tab is hidden, the browser regularly reduces and may even stop call to the animation callback. No critical timing should be done in the render/draw routings.requestAnimationFrame
call.Drawing therefore, is pure go. i.e.
func Render(gc *draw2dimg.GraphicContext) bool {
// {some movement code removed for clarity, see the demo code for full function}
// draws red 🔴 laser
gc.SetFillColor(color.RGBA{0xff, 0x00, 0x00, 0xff})
gc.SetStrokeColor(color.RGBA{0xff, 0x00, 0x00, 0xff})
gc.BeginPath()
gc.ArcTo(gs.laserX, gs.laserY, gs.laserSize, gs.laserSize, 0, math.Pi*2)
gc.FillStroke()
gc.Close()
return true // Yes, we drew something, copy it over to the browser
If you do want to render outside the animation loop, a simple way to cause the code to draw the frame on schedule, independent from the browsers callbacks, is to use time.Tick
. An example is in the demo app below.
If however your image is only updated from user input or some network activity, then it would be straightforward to fire the redraw only when required from these inputs. This can be controlled within the Render function, by just returning FALSE at the start. Nothing is draw, nor copied (saving CPU time) and the previous frames data remains.
There is currently a likely race condition for long draw functions, where the Turns out this is not an issue, due to the single threaded nature. Eventually if drawing is in a separate thread, this will have to be handled.requestAnimationFrame
may get a partially completed image buffer. This is more likely the longer the user render operation takes. Currently think how best to handle this, ideally without locks.
A simple demo can be found in: ./demo directory. This is a shameless rewrite of the 'Moving red Laser' demo by Martin Olsansky https://medium.freecodecamp.org/webassembly-with-golang-is-fun-b243c0e34f02
Compile with GOOS=js GOARCH=wasm go build -o main.wasm
Includes a Caddy configuration file to support WASM, so will serve by just running 'caddy' in the demo directory and opening browser to http://localhost:8080
Live Demo available at: https://markfarnan.github.io/go-canvas
This library was written after a weekend of investigation and posted on request for the folks on #webassembly on Gophers Slack. Right now it is very v0.001, user beware!
I intend to extend it further, time permitting, into fully fledged support package for all things go-canvas-wasm related, using this image frame method.
Several of the ideas I'm considering are:
Others ? Feedback, suggestions etc. welcome. I can be found on Gophers Slack, #Webassembly channel.
Mark Farnan, May 2019
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.