
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
babel-plugin-better-import
Advanced tools
Babel plugin to transform import() into its Universal counterpart
Makes import()
widely useable. Automagically. Part of the Edge Platform.
Ideally suited for combining Webpack 4s new Mini CSS Extract Plugin with James Gillmores excellent Universal React Component.
npm install babel-plugin-better-import
.babelrc:
{
"plugins": ["better-import"]
}
Here you can see what the plugin does - as tested by our test suite:
import universal from 'react-universal-component'
const UniversalComponent = universal(import('./Foo.js'))
<UniversalComponent />
↓ ↓ ↓ ↓ ↓ ↓
import universal from 'react-universal-component'
import betterImport from 'babel-plugin-better-import/betterImport.js'
import path from 'path'
const UniversalComponent = universal(betterImport({
chunkName: () => 'Foo',
path: () => path.join(__dirname, './Foo.js'),
resolve: () => require.resolveWeak('./Foo.js'),
load: () => import( /* webpackChunkName: 'Foo' */ './Foo.js')
}))
<UniversalComponent />
And if you're using dynamic imports:
import universal from 'react-universal-component'
const UniversalComponent = universal(props => import(`./${props.page}`))
<UniversalComponent page='Foo' />
↓ ↓ ↓ ↓ ↓ ↓
import universal from 'react-universal-component'
import betterImport from 'babel-plugin-better-import/betterImport.js'
import path from 'path'
const UniversalComponent = universal(props => betterImport({
chunkName: props => props.page,
path: props => path.join(__dirname, `./${props.page}`),
resolve: props => require.resolveWeak(`./${props.page}`),
load: props => import( /* webpackChunkName: '[request]' */ `./${props.page}`)
}));
<UniversalComponent page='Foo' />
It names all your chunks using magic comments 🔮 behind the scenes and is derived from the imported file. This works with both static and dynamic import paths, as you can see above.
Otherwise, what it's doing is providing all the different types of requires/paths/imports/etc needed by tools like react-universal-component to universally render your component.
The targeted use-case for all this is dynamic imports where you can pass a page
prop to the resulting component, thereby allowing you to create one <UniversalComponent page={page} />
for a large number of your components. This is a major upgrade to the previous way of having to make a hash of a million async components in a wrapping component. You no longer have to think about Universal Components as anything different than your other components that use simple HoCs.
Copyright 2018
Sebastian Software GmbH
Copyright 2017-2018
James Gillmore
FAQs
Babel plugin to transform import() into its Universal counterpart
The npm package babel-plugin-better-import receives a total of 0 weekly downloads. As such, babel-plugin-better-import popularity was classified as not popular.
We found that babel-plugin-better-import demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.