
Security News
Socket Releases Free Certified Patches for Critical vm2 Sandbox Escape
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.
@cfware/history-state
Advanced tools
Browser History API state manager.
import historyState, * as historyFunctions from '@cfware/history-state';
historyState.addEventListener('update', () => {
/* An internal navigation has occurred with history API. */
});
historyState.addEventListener('refuse', () => {
/* An internal navigation has been refused due to dirty state. */
if (window.confirm('Do you really want to leave this page without saving?')) {
/* honor the back/forward/link click requested by the user. */
historyFunctions.bypassDirty();
}
});
This should be used instead of history.state which will contain additional fields
that are internal to @cfware/history-state.
Use historyState.pushState or historyState.replaceState to modify. historyState.state
should be treated as if it is frozen.
Default null
This must be used in place of history.pushState. This function causes an update or
refuse event to be dispatched depending on historyFunctions.isDirty().
This must be used in place of history.replaceState. This replaces the current history
entry.
Unlike historyState.pushState this function does not cause update or refuse to be
dispatched. This function succeeds regardless of dirty status.
This is dispatched when the current location is changed, including upon window onload.
This is dispatched when a location change is refused due to historyState.dirty being
true. This will happen when the user hits back/forward without leaving the SPA or when
an internal link is clicked.
Calling this function after a refuse event will allow navigation that was blocked
by the dirty status.
This can be set true or false to indicate if the current page has unsaved changes.
Default false
Retrieve the current dirty status.
This attaches a click event listener to element which intercepts normal clicks
on any <a> element visible from element. During startup this is run for document
so in most cases you will not need to run historyFunctions.linkInterceptor manually. The
exception is closed shadow roots, for example:
const shadowRoot = this.attachShadow({mode: 'closed'});
this.shadowRoot.innerHTML = '<a href="/link/">link</a>';
/* The `<a>` inside shadowRoot is not visible to document because of
* closed mode, so we have to add an interceptor directly.
*/
historyFunctions.linkInterceptor(shadowRoot);
Any link click that is intercepted results in a call to historyState.pushState.
The listenerOptions argument is passed to element.addEventListener as the second
argument.
This component listens for beforeunload. If historyState.isDirty() is true the unload
will be canceled.
By default this module will intercept clicks on <a> links. Links to pages within
document.baseURI will be treated as part of the SPA. This is disabled per link by
adding the target, download or no-history-state attributes.
The default click listener can be disabled by calling historyFunctions.setDefaultInterceptOptions(false)
before window.onload occurs. Values other than false will be used as the options argument to
the default interceptor.
The link interceptor will not take any action if event.preventDefault() has already
been run by another listener.
This event should be ignored, monitor the update event of historyState instead.
FAQs
Browser History API state manager
We found that @cfware/history-state demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.

Research
Five malicious NuGet packages impersonate Chinese .NET libraries to deploy a stealer targeting browser credentials, crypto wallets, SSH keys, and local files.

Security News
pnpm 11 turns on a 1-day Minimum Release Age and blocks exotic subdeps by default, adding safeguards against fast-moving supply chain attacks.