
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
mygithub.libinneed.workers.dev/wealdtech/go-eth2-wallet-store-s3
Amazon S3-based store for the Ethereum 2 wallet.
go-eth2-wallet-store-s3
is a standard Go module which can be installed with:
go get github.com/wealdtech/go-eth2-wallet-store-s3
In normal operation this module should not be used directly. Instead, it should be configured to be used as part of go-eth2-wallet.
The S3 store has the following options:
region
: the Amazon S3 region in which the wallet is to be stored. This can be any valid region string as per the Amazon list, for example ap-northeast-2
or eu-north-1
id
: an ID that is used to differentiate multiple stores created by the same account. If this is not configured an empty ID is usedpassphrase
: a key used to encrypt all data written to the store. If this is not configured data is written to the store unencrypted (although wallet- and account-specific private information may be protected by their own passphrases)bucket
: the name of a bucket in which the store will place wallets. If this is not configured it generates one based on the AWS credentials and IDpath
: a path inside the bucket in which to place wallets. If this is not configured it uses the root directory of the bucketendpoint
: a URL for an S3-compatible service, for example 'https://storage.googleapis.com` for Google Cloud StorageWhen initiating a connection to Amazon S3 the Amazon credentials are required. Details on how to make the credentials available to the store are available at the Amazon S3 documentation
package main
import (
e2wallet "github.com/wealdtech/go-eth2-wallet"
s3 "github.com/wealdtech/go-eth2-wallet-store-s3"
)
func main() {
// Set up and use an encrypted store
store, err := s3.New(s3.WithPassphrase([]byte("my secret")))
if err != nil {
panic(err)
}
e2wallet.UseStore(store)
// Set up and use an encrypted store in the central Canada region
store, err = s3.New(s3.WithPassphrase([]byte("my secret")), s3.WithRegion("ca-central-1"))
if err != nil {
panic(err)
}
e2wallet.UseStore(store)
// Set up and use an encrypted store with a custom ID
store, err = s3.New(s3.WithPassphrase([]byte("my secret")), s3.WithID([]byte("store 2")))
if err != nil {
panic(err)
}
e2wallet.UseStore(store)
// Set up and use a store with a custom bucket and path
store, err = s3.New(s3.WithBucket("my-store"), s3.WithPath("data/keystore"))
if err != nil {
panic(err)
}
e2wallet.UseStore(store)
// Set up and use a store with non-dfeault credentials.
store, err = s3.New(s3.WithCredentialsID("ABCDEF"), s3.WithCredentialsSecret("XXXXXXXXXXXX"))
if err != nil {
panic(err)
}
e2wallet.UseStore(store)
}
Jim McDonald: @mcdee.
Contributions welcome. Please check out the issues.
Apache-2.0 © 2019 Weald Technology Trading Ltd
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.