
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
angular-server-side-configuration
Advanced tools
Configure an angular application at runtime on the server or in a docker container via environment variables.
The Angular CLI provides build time configuration (via environment.ts). In a Continuous Delivery environment this is sometimes not enough.
Environment variables are used for configuration.
This package provides an Angular CLI builder to search for usages at build time.
A native CLI can be used to insert populated
environment variables into index.html file(s) into the head tag or by replacing <!--CONFIG-->
(Missing environment variables will be represented by null
). This should be done
on the host serving the bundled angular files.
Version 8.x of this package is a complete rewrite with Angular schematics and builders. If you require support for older Angular versions, Version 2.x of this library can be used, as it is Angular version agnostic.
ng add angular-server-side-configuration
or, if you have a previous version of this library installed
ng update angular-server-side-configuration@latest
This will configure the appropriate files.
Alternatively, if you want to configure the files yourself:
npm install --save angular-server-side-configuration
Ensure you have an ngsscbuild
entry in your project architect
section.
To use the builder run ng run your-project-name:ngsscbuild:production
.
You can add additional configurations in angular.json, which can be executed
by replacing production
with your configuration name in the previous command.
The builder will analyze the configured ngsscEnvironmentFile
to detect
used environment variables and generate an ngssc.json in the defined
outputPath
in the referenced browserTarget
.
...
"projects": {
...
"your-project-name": {
...
"architect": {
...
"ngsscbuild": {
"builder": "angular-server-side-configuration:ngsscbuild",
"options": {
"additionalEnvironmentVariables": ["MANUAL_ENTRIES"],
"aotSupport": true, // Set this to true, if you need to use
// environment variables inside AoT contexts
// (e.g. forRoot(...) or forChild(...))
"browserTarget": "your-project-name:build",
"ngsscEnvironmentFile": "src/environments/environment.prod.ts"
},
"configurations": {
"production": {
"browserTarget": "your-project-name:build:production"
}
}
}
...
}
...
}
...
}
...
To run the ngssc build, run the command ng run your-project-name:ngsscbuild:production
.
angular-server-side-configuration supports two variants for using environment variables: process.env.* or NG_ENV.*
Use process.env.NAME in your environment.prod.ts, where NAME is the environment variable that should be used.
import 'angular-server-side-configuration/process';
export const environment = {
production: process.env.PROD !== 'false',
apiAddress: process.env.API_ADDRESS || 'https://example-api.com'
};
Import NG_ENV from angular-server-side-configuration/ng-env
and use NG_ENV.NAME in your environment.prod.ts, where NAME is the
environment variable that should be used.
import { NG_ENV } from 'angular-server-side-configuration/ng-env';
export const environment = {
production: NG_ENV.PROD !== 'false',
apiAddress: NG_ENV.API_ADDRESS || 'https://example-api.com'
};
Add <!--CONFIG-->
to index.html. This will be replaced by the configuration script tag.
This is optional, as the environment variables can be configured to be inserted in the head tag.
It is however the safest option.
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Angular Example</title>
<!--CONFIG-->
<base href="/">
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="icon" type="image/x-icon" href="favicon.ico">
</head>
<body>
<app-root></app-root>
</body>
</html>
This library provides a Node.js and a native implementation for inserting the environment variables into your html.
Either the insert
function from the package (import { insert } from 'angular-server-side-configuration';
)
or the insert
command of the CLI.
For the native CLI, go to Releases
and download the appropriate executable for your server environment.
(See build.sh for
build details of the native CLI. Please open an Issue
if you need an additional environment.)
Thanks to DanielHabenicht for the input and contribution.
Usage: ngssc insert [options] [directory]
Options | Description |
---|---|
-r, --recursive | Recursively searches for ngssc.json files and applies the contained configuration |
--dry | Perform the insert without actually inserting the variables |
Dockerfile
FROM nginx:alpine
ADD https://github.com/kyubisation/angular-server-side-configuration/releases/download/v8.0.0/ngssc_64bit /usr/sbin/ngssc
RUN chmod +x /usr/sbin/ngssc
COPY dist /usr/share/nginx/html
COPY start.sh start.sh
RUN chmod +x ./start.sh
CMD ["./start.sh"]
start.sh
#!/bin/sh
ngssc insert /usr/share/nginx/html
nginx -g 'daemon off;'
The ngssc.json will be generated by the ngsscbuild builder.
{
"variant": "process", // Either "process" or "NG_ENV".
"environmentVariables": [], // Detected environment variables.
"filePattern": "**/index.html" // File pattern in which environment variables should be inserted.
}
Apache License, Version 2.0
FAQs
Configure an angular application on the server
The npm package angular-server-side-configuration receives a total of 1,832 weekly downloads. As such, angular-server-side-configuration popularity was classified as popular.
We found that angular-server-side-configuration demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.