Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
async-expect
Advanced tools
Expectation function taken from expect.
This is not for writing test but to use it when writing asynchronus code with the help of async-await
. (see below for example use-case)
Using npm:
$ npm install --save expect
Then, use as you would anything else:
const expect = require("async-expect")
When using async-await it becomes hard to catch errors. We have to wrap each await
call to try-catch
block to specifically handle that error. Wrapping multiple await
calls in one try-catch
block will create problem which await
call thrown this error.
Example:
try{
let user = await User.find(ctx.body.username);
let like = await Post.addLike(user.username);
let somthingelse = await forSomethingelse();
}catch(err){
// no way to get find which call returned that error.
// if those are third party lib function then you'll have rely
// on regex to find error type and etc
console.log(err) // nothing you can do at this point.
}
try{
// let user = await User.find(ctx.body.username);
var user = await User.find(ctx.body.username);
}catch(err){
app.redirect("/err", "invalid user")
}
try{
// problem1 - user isnt accessible here. let block scoped
// have to user var
// let like = await Post.addLike(user.username);
var like = await Post.addLike(user.username);
}catch(err){
app.redirect("/err", "invalid user")
}
// problem2 - readablity issue
const expect = require("async-expect");
try{
let user = await User.find(ctx.body.username);
expect(user.username).toExists("Username is invalid", "INVALID-USER")
let like = await Post.addLike(user.username);
expect(like.status).toBe(true,
"User doesn't have permission to see", "PERM-DENIED")
let somthingelse = await forSomethingelse();
expect(somethingelse).toBe(Object, "something else is wrong", "SOMETHING-ERROR", somethingelse)
}catch(err){
switch(err.name){
case: "INVALID-USER":
app.redirect("/register", "Please register to continue");
break;
case: "PERM-DENIED":
app.redirect("/user", "You dont have enough permission");
break;
case: "SOMETHING-ERROR":
let somethingelse = err.extra
doSomething(somethingelse);
break;
}
}
Currently it contains 7 assertive function which is more than enough to be useful in conjunction with async-await.
Note: [error-message, error-name, error-extra] parameters are optional.
expect(object).toExist([error-message, error-name, error-extra])
Asserts the given object
is truthy.
expect('something truthy').toExist()
expect(object).toNotExist([error-message, error-name, error-extra])
Asserts the given object
is falsy.
expect(null).toNotExist()
expect(object).toBe(value, [error-message, error-name, error-extra])
Asserts that object
is equal to value
using ==
.
try {
let role = await User.getRole();
expect(role).toBe("admin", "Only admin user is allowed", "NotAdminError");
}catch(err){
if(err.name == "NotAdminError"){
app.redirect("/user", {message: "You're not allowed to perform this operation"});
}
}
expect(object).toNotBe(value, [error-message, error-name, error-extra])
Asserts that object
is not equal to value
using !=
.
expect(object).toBeA(constructor, [error-message, error-name, error-extra])
expect(object).toBeAn(constructor, [error-message, error-name, error-extra])
Asserts the given object
is an instanceof constructor
.
expect(new User).toBeA(User)
expect(new Asset).toBeAn(Asset)
expect(object).toBeA(string, [error-message, error-name, error-extra])
expect(object).toBeAn(string, [error-message, error-name, error-extra])
Asserts the typeof
the given object
is string
.
expect(2).toBeA('number')
expect(object).toNotBeA(constructor, [error-message, error-name, error-extra])
expect(object).toNotBeAn(constructor, [error-message, error-name, error-extra])
Asserts the given object
is not an instanceof constructor
.
expect(new Asset).toNotBeA(User)
expect(new User).toNotBeAn(Asset)
expect(object).toNotBeA(string, [error-message, error-name, error-extra])
expect(object).toNotBeAn(string, [error-message, error-name, error-extra])
Asserts the typeof
the given object
is not string
.
expect('a string').toNotBeA('number')
expect(2).toNotBeAn('object')
FAQs
Efficient error handling in async-await.
We found that async-expect demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.