Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
await-busboy-latest
Advanced tools
busboy multipart parser with async/await
and koa/co yield
support.
forked from https://github.com/cojs/busboy and updated to support async/await
const Koa = require('koa')
const app = new Koa()
const parse = require('await-busboy')
app.use(async (ctx, next) => {
// the body isn't multipart, we can't parse it
if (!ctx.request.is('multipart/*')) return await next
const parts = parse(ctx)
try {
let part
while ((part = await parts)) {
if (part.length) {
// arrays are await-busboy fields
console.log({ key: part[0], value: part[1] })
} else {
// otherwise, it's a stream
part.pipe(someOtherStream)
}
}
} catch (err) {
return ctx.throw(err)
}
ctx.body = 'await-busboy is done parsing the form!'
});
app.listen(3000);
Note that parts will be delievered in the order they are defined in the form. Put your CSRF token first in the form and your larger files last.
If you want await-busboy
to automatically handle the fields,
set the autoFields: true
option.
Now all the parts will be streams and a field object and array will automatically be populated.
const Koa = require('koa')
const app = new Koa()
const parse = require('await-busboy')
app.use(async (ctx, next) => {
const parts = parse(ctx, {
autoFields: true
})
try {
let part
while ((part = await parts)) {
// it's a stream
part.pipe(fs.createWriteStream('some file.txt'))
}
} catch (err) {
return ctx.throw(err)
}
ctx.body = 'and we are done parsing the form!'
// .field holds all the fields in key/value form
console.log(parts.field._csrf)
// .fields holds all the fields in [key, value] form
console.log(parts.fields[0])
})
Use options.checkField
hook function(name, val, fieldnameTruncated, valTruncated)
can handle fields check.
const parse = require('await-busboy')
app.use(async (ctx, next) => {
const parts = parse(ctx, {
checkField: (name, value) => {
if (name === '_csrf' && !checkCSRF(ctx, value)) {
const err = new Error('invalid csrf token')
err.status = 400
return err
}
}
})
let part
while ((part = await parts)) {
// ...
}
})
Use options.checkFile
hook function(fieldname, file, filename, encoding, mimetype)
can handle filename check.
const parse = require('await-busboy')
const path = require('path')
app.use(async (ctx, next) {
const parts = parse(ctx, {
// only allow upload `.jpg` files
checkFile: function (fieldname, file, filename) {
if (path.extname(filename) !== '.jpg') {
const err = new Error('invalid jpg image')
err.status = 400
return err
}
}
})
let part
while ((part = await parts)) {
// ...
}
})
This module is backward compatible with koa, co and yield
syntax.
const Koa = require('koa')
const app = new Koa()
const parse = require('await-busboy')
app.use(function* (ctx, next) {
// the body isn't multipart, we can't parse it
if (!ctx.request.is('multipart/*')) return yield next
const parts = parse(ctx)
try {
let part
while ((part = yield parts)) {
if (part.length) {
// arrays are await-busboy fields
console.log({ key: part[0], value: part[1] })
} else {
// otherwise, it's a stream
part.pipe(someOtherStream)
}
}
} catch (err) {
return ctx.throw(err)
}
ctx.body = 'await-busboy is done parsing the form!'
});
const parse = require('await-busboy')
const parts = parse(stream, {
autoFields: true
})
options
are passed to busboy.
The only additional option is autoFields
.
Note: If busboy events partsLimit
, filesLimit
, fieldsLimit
is emitted, will throw an error.
await the next part.
If autoFields: true
, this will always be a file stream.
Otherwise, it will be a field as an array.
Readable Stream
fieldname
filename
transferEncoding
or encoding
mimeType
or mime
Field[]
fieldname
value
valueTruncated
- Boolean
fieldnameTruncated
- BooleanIf falsey, then the parser is done.
If autoFields: true
, this object will be populated with key/value pairs.
If autoFields: true
, this array will be populated with all fields.
npm test
runs tests + code coverage + lintnpm run lint
runs lint onlynpm run lint-fix
runs lint and attempts to fix syntax issuesnpm run test-cov
runs tests + test coveragenpm run open-cov
opens test coverage results in your browsernpm run test-only
runs tests onlyFAQs
An awaitable busboy multipart parser with latest busboy
We found that await-busboy-latest demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.