
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
HTML forms on performance-enhancing drugs.
Note: Ajax-form is not tied to Polymer. In fact, it has no dependencies at all, but should work just fine with Polymer or any other custom elements library. If you prefer to use a simple custom elements polyfill, ajax-form is also your best choice.
<form>
?<form>
.The ajax-form
custom element augments a traditional <form>
to provide additional features and solve the problems listed above. See the API documentation page for complete documentation and demos.
npm install ajax-form
Use ajax-form just like you would use a traditional form, with the exception of the required is="ajax-form"
attribute that you must include in your <form>
element markup. Since ajax-form is a web component, you may need to include a web component polyfill, such as webcomponents.js to ensure browsers
that do not implement the WC spec are able to make use of ajax-form. Ajax-form has no hard
dependencies.
A very simple use of ajax-form
looks just like a normal <form>
, with the addition of an is
attribute:
<form is="ajax-form" action="my/form/handler" method="post">
<label>Enter your name: <input type="text" name="full_name"></label>
...
</form>
See the API documentation page for complete documentation and demos.
Are you developing a form field web component? Read the instructions below to ensure your field integrates properly with ajax-form.
Your component will integrate nicely into ajax form provided your custom element
exposes a value
property that contains the current value of the field. If this
is not true, then your custom field must ensure a native HTML form field is part of
the light DOM. In either case, the element with the value
property must also
contain a name
attribute. Your user/integrator will need to include an
appropriate value for this field.
If your custom field exposes a native HTML form field in the light DOM, then there is nothing more to do - ajax-form will respect any validation that your user/integrator adds to the field. The constrain attribute(s) MUST be placed on the native HTML form field.
If your custom field does NOT expose a native HTML form field in the light DOM by default, and you want ajax-form to respect validation constraints, then you will need to include a little code to account for this. Here are the steps to follow:
<input type="text">
field to the light DOM, just before your field.customElementRef
property to the input, with a value equal to your field.setCustomValidity
method present on an HTMLInputElement
.See the setValidationTarget
method in the <file-input>
custom element source code
for an example.
npm install
npm install -g grunt-cli
grunt
Running grunt
without any parameters will test against a few locally installed browsers (see the codebase for details).
Running grunt shell:wctSauce
will run tests against a number of browsers in SauceLabs. Ensure you have your SauceLabs username and key attached to the proper environment variables first.
FAQs
HTML forms on performance-enhancing drugs
The npm package ajax-form receives a total of 0 weekly downloads. As such, ajax-form popularity was classified as not popular.
We found that ajax-form demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.