Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
LiveDocument
Advanced tools
LiveDocument is an client/server isopmorphic ODM. The goal of LiveDocument is to provide a seamless way to interact with a mongodb database on the client, without duplication of effort writing both a client side and a server side models.
LiveDocument also provides real-time updates out of the box. After you query something from the database, LiveDocument notifies you of any documents that are created, updated, or deleted and match your criteria. If you ask for a single document, any changes made to that document will automatically be pushed to you.
Here is a random assortment of code in coffeescript:
class Task extends LiveDocument
@key "title", { length: [3...24] }
@key "description", { max: 140 }
task = new Task({title: "Work that needs to be done", description: "This is some important work", priority:10})
task.save()
# or
Task.create({title: "Clean carpet", description: "Clean the carpets, they're gross", priority: 4})
task = Task.findOne({title: "This is my title"})
task.on "load", (tasks) ->
console.log(task.get("priority")) # 10
task.on "update", (task) ->
#called when someone updates this task
task.on "delete", (task) ->
#called when someone deletes this task
#this runs any time priority changes
task.get "priority" (val) ->
console.log(val) # 10
task.get "priority" (key, val) ->
console.log(key) # priority
console.log(val) # 10
# this binds tasks get to views set binding
task.get "priority", view.set
# this binds all properties
task.get view.set
task.set "key", value
task.set {key: value, key2: val2}
# mongodb style queries, if it"s supported by mongo, we should support it (not
# true atm!)
tasks = Task.find({priority: {$lt: 10}})
tasks.on "load", (tasks) ->
# called when the tasks have been loaded from the datasource
tasks.on "insert", (tasks) ->
# called when a document is created that matches the criteria
# or an existing document is updated in such a way that it
# now matches the criteria
tasks.on "remove", (tasks) ->
# called when a document is deleted that matches the criteria
# or an document is updated in such a way that it no longer
# matches the criteria
You can find the API here: xcoderzach.github.com/liveDocument
Since we don't want a malicious user to be able to query every post on our social network. Which would essentially be a DoS attack, since it would grab EVERY post and authorize them ALL. That's where allowScope comes in handy.
The allowScope method won't allow any queries which don't have they keys defined in allowScope.
class Post extends LiveDocument
@requireScope = true
@allowScope { ownerId: }
To run the tests you need an instance of mongo running on the default port. Then just run the following.
mocha test/*.coffee
Model validation happens on both the client and the server when possible. Input is validated on the client first if possible, to provide a responsive user experience. The model is then validated again on the server, in order to catch people bypassing client side validation, as well as doing validations that can only happen on the server, such as checking if an email address is taken.
####Error Messages
Validations do not give you error messages. They do not allow you to set error messages. Error messages belong in the view.
All of the declarative LiveDocument class methods, return this, allowing you to chain them together.
Ideas, feature requests, bug reports, etc are very welcome.
####TODO Before it's releaseable
Licensed under MIT (see LICENSE file)
FAQs
A Realtime Isomorphic ODM for MongoDB
We found that LiveDocument demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.