Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@shopify/react-shortcuts
Advanced tools
Declaratively and efficiently match shortcut combinations in your React application
@shopify/react-shortcuts
Declarative and performant library for matching shortcut combinations in React applications.
yarn add @shopify/react-shortcuts
The library exposes three main parts, <ShortcutProvider />
, <Shortcut />
and ShortcutManager
.
Wrapping your application in a <ShortcutProvider />
allows you to use <Shortcut />
components anywhere in your application, internally sharing a single ShortcutManager
instance to minimize listeners and collisions.
// App.ts
import React from 'react';
import {ShortcutProvider} from '@shopify/react-shortcuts';
export default function App() {
<ShortcutProvider>{/* the rest of your app */}</ShortcutProvider>;
}
Shortcut is used to register a new keyboard shortcut to ShortcutManager
. It can be triggered globally or only when a node is focused.
Note: a <Shortcut />
must have a <ShortcutProvider />
somewhere above it in the tree.
export interface Props {
/*
keys that, when pressed sequentially, will trigger `onMatch`
*/
ordered: Key[];
/*
modifier keys that need to be kept pressed along with `keys` to trigger `onMatch`
*/
held?: HeldKey;
/*
a callback that will trigger when the key combination is pressed
*/
onMatch(matched: {ordered: Key[]; held?: ModifierKey[]}): void;
/*
a node that, when supplied, will be used to only fire `onMatch` when it is focused
*/
node?: HTMLElement | null;
/*
a boolean that lets you temporarily disable the shortcut
*/
ignoreInput?: boolean;
/*
a boolean that lets you opt out of swallowing the key event and let it propagate
*/
allowDefault?: boolean;
/*
an array of DefaultIgnoredTag allowing you to flag which default ignored tags you want to bypass (textarea, input, select)
*/
acceptedDefaultIgnoredTags?: DefaultIgnoredTag[];
}
// MyComponent.tsx
import React from 'react';
import {Shortcut} from '@shopify/react-shortcuts';
export default function MyComponent() {
return (
<div>
{/* some app markup here */}
<Shortcut ordered={['f', 'o', 'o']} onMatch={() => console.log('foo')} />
</div>
);
}
// MyComponent.tsx
import React from 'react';
import {Shortcut} from '@shopify/react-shortcuts';
export default function MyComponent() {
return (
<div>
{/* some app markup here */}
<Shortcut
held={['Control', 'Shift']}
ordered={['B']}
onMatch={() => console.log('bar!')}
/>
</div>
);
}
You may also want to provide alternate groupings of held
modifier keys. For example, “undo/redo” key combos are slightly different on Windows vs Mac OS. The below example will register onMatch
if either Control + z
or Meta + z
is pressed simultaneously.
// MyComponent.tsx
import React from 'react';
import {Shortcut} from '@shopify/react-shortcuts';
export default function MyComponent() {
return (
<div>
{/* some app markup here */}
<Shortcut
held={[['Control'], ['Meta']]}
ordered={['z']}
onMatch={() => console.log('undo!')}
/>
</div>
);
}
Some Gotchas
Meta
refers to the “Command” key on Mac keyboards.Fn
and FnLock
keys are not supported because they don't produce events, as mentioned in the specProvide a node in the form of a ref
. <Shortcut />
will automatically subscribe to the ShortcutManager
once the node is available.
// MyComponent.tsx
import React from 'react';
import {Shortcut} from '@shopify/react-shortcuts';
class MyComponent extends React.Component {
state = {};
render() {
const {fooNode} = this.state;
return (
<div>
<button ref={(node) => this.setState({fooNode: node})} />
<Shortcut
node={fooNode}
ordered={['f', 'o', 'o']}
onMatch={() => console.log('foo')}
/>
</div>
);
}
}
<Shortcut />
invokes a hook, useShortcut()
, under the hood. This hook is also available for use from this package. It will also register a new keyboard shortcut to the ShortcutManager
and the API is very similar.
function useShortcut(
// All inputs are the same as the above definitions for the props to <Shortcut />
ordered: Key[],
onMatch: (matched: {ordered: Key[]; held?: HeldKey}) => void,
options: {
held?: HeldKey;
node?: HTMLElement | null;
ignoreInput?: boolean;
allowDefault?: boolean;
} = {},
);
The below example illustrates the same basic functionality as the <Shortcut />
example above. However, it uses the useShortcut()
hook and the component has been removed.
// MyComponent.tsx
import React from 'react';
import {useShortcut} from '@shopify/react-shortcuts';
export default function MyComponent() {
useShortcut(['f', 'o', 'o'], () => console.log('foo'));
return <div>{/* some app markup here */}</div>;
}
ShortcutManager
is created by ShortcutProvider
and handles the logic for calling the appropriate shortcut callbacks and avoiding conflicts. You should never need to use it directly in application code, though you may want access to it in tests.
Given a component implementing a <Shortcut />
// MyComponent.tsx
export default function MyComponent() {
return (
<div>
{/* some app markup here */}
<Shortcut ordered={['f', 'o', 'o']} onMatch={() => console.log('foo')} />
</div>
);
}
you might want to add a ShortcutManager
to it's context in an @shopify/react-testing
test to prevent errors
// MyComponent.test.tsx
import React from 'react';
import {mount} from '@shopify/react-testing';
import {ShortcutManager, Shortcut} from '@shopify/react-shortcuts';
import MyComponent from './MyComponent';
describe('my-component', () => {
it('renders a shortcut for f,o,o', () => {
const component = mount(<MyComponent />, {
context: {shortcutManager: new ShortcutManager()},
});
const shortcut = component.find(Shortcut);
expect(shortcut.prop('ordered')).toEqual(['f', 'o', 'o']);
});
});
FAQs
Declaratively and efficiently match shortcut combinations in your React application
We found that @shopify/react-shortcuts demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 24 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.