Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
@line/liff-inspector
Advanced tools
LIFF Inspector 🔬 The universal DevTools for LIFF (WebView) browser
LIFF Inspector is the official DevTools for LIFF(LNE Frontend Framework) that is integrated with the latest ChromeDevTools and built on top of the ChromeDevTools Protocol.
LIFF browser | ChromeDevTools |
---|---|
📱 Enable debugging LIFF Browser and WebView with debugging options disabled
🌍 Remote debug
🔬 Support Elements
, Console
and NetWork
tabs of ChromeDevTools
LIFF Inspector consists of two components:
LIFF Inspector Server is a server program that mediates communication between LIFF app and ChromeDevTools. LIFF Inspector Plugin is a LIFF Plugin. LIFF Plugin is available in LIFF SDK v2.19.0 or later.
$ npx @line/liff-inspector
Debugger listening on ws://{IP Address}:9222
$ npm install @line/liff-inspector
import liff from '@line/liff';
import LIFFInspectorPlugin from '@line/liff-inspector';
liff.use(new LIFFInspectorPlugin());
Before the actual liff.init
process, LIFF Inspector Plugin will try to connect LIFF Inspector Server.
Debugging with LIFF Inspector is available immediately after liff.init
call.
liff.init({ liffId: 'liff-xxxx' }).then(() => {
// LIFF Inspector has been enabled
});
By default, LIFF Inspector Server starts a local server on ws://localhost:9222
, and your LIFF App is served over HTTPS (https://liff.line.me/xxx-yyy
). LIFF Inspector Plugin will try to connect to ws://localhost:9222
from https://liff.line.me/xxx-yyy
but this will fail due to mixed content.
To eliminate mixed content, you need to serve LIFF Inspector Server over HTTPS (wss://
). We have two recommended ways:
$ ngrok http 9222
$ node -e "const res=$(curl -s -sS http://127.0.0.1:4040/api/tunnels); const url=new URL(res.tunnels[0].public_url); console.log('wss://'+url.host);"
wss://xxxx-xxx-xxx.ngrok # Copy this url
Once LIFF Inspector Server runs over HTTPS, you need to specify its origin to LIFF Inspector Plugin.
Use URL Search Parameter: ?li.origin=
Add ?li.origin=
query to the Endpoint URL of your LIFF App in LINE Developers Console.
Use origin
config of LIFF Inspector Plugin
// Default origin: ws://localhost:9222
liff.use(new LIFFInspectorPlugin({ origin: 'wss://xxx-xx-xx-xx.ngrok.io' }));
LIFF Inspector Plugin attempts to connect to given origin in the order li.origin
(1), origin
config (2).
(Pseudo code)
const originFromURL = new URLSearchParams(search).get('li.origin');
const originFromConfig = config.origin;
const defaultOrigin = 'ws://localhost:9222';
connect(originFromURL ?? originFromConfig ?? defaultOrigin);
See https://github.com/cola119/liff-inspector-example
Contributions Welcome!
console.log
console.warn
console.error
console.info
fetch()
XMLHttpRequest
sendBeacon()
See CONTRIBUTING.md
FAQs
LIFF Inspector 🔬 The universal DevTools for LIFF (WebView) browser
The npm package @line/liff-inspector receives a total of 1,780 weekly downloads. As such, @line/liff-inspector popularity was classified as popular.
We found that @line/liff-inspector demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.