
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
@superfaceai/ast
Advanced tools
Superface AST definitions for Javascript/Typescript. The types in this repository define the common language that the Superface parser produces and the Superface SDK interprets.
Superface (super-interface) is a higher-order API, an abstraction on top of the modern APIs like GraphQL and REST. Superface is one interface to discover, connect, and query any capabilities available via conventional APIs.
Through its focus on application-level semantics, Superface decouples the clients from servers, enabling fully autonomous evolution. As such it minimizes the code base as well as errors and downtimes while providing unmatched resiliency and redundancy.
Superface allows for switching capability providers without development at a runtime in milliseconds. Furthermore, Superface decentralizes the composition and aggregation, and thus creates an Autonomous Integration Mesh.
Motivation behind Superface is nicely described in this video from APIdays conference.
You can get more information at https://superface.ai and https://superface.ai/docs. Superface AST definitions for Javascript/Typescript. The types in this repository define the common language that the Superface parser produces and the Superface SDK interprets.
Install the ast into one of your projects:
yarn add @superfaceai/ast
import { ProfileDocumentNode } from '@superfaceai/ast';
const { Source, parseProfile } = require('@superfaceai/parser');
const content = `
name = "test"
version = "0.1.0"
usecase Test {}
`;
const source = new Source(content);
const result: ProfileDocumentNode = parseProfile(source);
Superface is not man-in-the-middle so it does not require any access to secrets that are needed to communicate with provider API. Superface CLI only prepares super.json file with authorization fields in form of environment variable. You just set correct variables and communicate directly with provider API.
You can find more information in SDK repository.
If you need any additional support, have any questions or you just want to talk you can do that through our documentation page.
When developing, start with cloning the repository using git clone https://github.com/superfaceai/ast-js.git
(or git clone git@github.com:superfaceai/ast-js.git
if you have repository access).
After cloning, the dependencies must be downloaded using yarn install
or npm install
.
Now the repository is ready for code changes.
The package.json
also contains scripts (runnable by calling yarn <script-name>
or npm run <script-name>
):
test
- run all testslint
- lint the code (use lint:fix
to run autofix)format
- check the code formatting (use format:fix
to autoformat)prepush
- run test
, lint
and format
checks. This should run without errors before you push anything to git.Lastly, to build a local artifact run yarn build
or npm run build
.
Please open an issue first if you want to make larger changes
Feel free to contribute! Please follow the Contribution Guide.
Licenses of node_modules are checked during CI/CD for every commit. Only the following licenses are allowed:
Note: If editing the README, please conform to the standard-readme specification.
The Superface AST is licensed under the MIT. © 2021 Superface
[1.3.2] - 2023-07-19
FAQs
Superface profile and map language ASTs, https://superface.ai
The npm package @superfaceai/ast receives a total of 2,556 weekly downloads. As such, @superfaceai/ast popularity was classified as popular.
We found that @superfaceai/ast demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.