
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
github.com/posteris/custom-validate
Project dedicated to stadardize some patterns like erros and validations that can be utils and shared by many others projects.
The next sessions was dedicated to show how to use each features.
The validation model receives a model (struct) that contains the validation tag, in case of some validation fail the return will be a ValidationError array, other else nil.
import commom "github.com/posteris/commons/validation"
//define struct model
type User struct {
Name string `validate:"required,min=3,max=256"`
Surname string `validate:"required,min=3,max=256"`
Email string `validate:"omitempty,email"`
}
//create a model based on struct
userModel := User{
Surname: "da Silva"
Email: "dasilva@gmail.com"
}
err := commom.ValidateModel(userModel)
in this package you can use the follow two errors:
The default error generate an interface containing just one field Message.
import commom "github.com/posteris/commons/errors"
err := commom.CreateDefaultError("some error message")
The validationError is formed by the fields Field: and Message: and can be created as showed below.
import commom "github.com/posteris/commons/errors"
err := commom.CreateValidationError("field-name", "some error message")
The Query parameter module has a set of functions to help us to parse query parameters. These functions are listed below:
The IsAsyncRequest allow us to ask if the request should be solved by sync or async way. It's simple to use and can be explained below
async := IsAsyncRequest(fiberCtx)
This lib use Sonarcloud to help understend the code quality and security.
In conjunction with Sonarcloud, this lib uses Horusec which blocks CI/CD in any vulnerability incidence
Thinking in the software quality, the benchmark regression was created. It's can be viewed at the link bellow.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.