
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
be-based is a package that contains a client-side web component decorator, a trans-render transformer [TODO], and a HTMLRewriter class [TODO].
be-based is a package that allows a DOM document fragment filled with relative URL paths, to be adjusted based on a base URL. This is quite critical when streaming HTML from a third-party element to a DOM node contained within the Live DOM tree. be-based plays a critical role in combination with be-written.
<div be-based="https://www.supremecourt.gov/about/">
<a href="biographies.aspx#SOConnor">O'Connor, Sandra Day</a>
<div>
is shorthand for:
<div be-based='{
"base": "https://www.supremecourt.gov/about/",
"forAll": ["href", "src", "xlink:href"]
}'>
<a href="biographies.aspx#SOConnor">O'Connor, Sandra Day</a>
</div>
be-based rewrites the attribute within:
<div is-based="https://www.supremecourt.gov/about/">
<a href="https://www.supremecourt.gov/about/biographies.aspx#SOConnor">O'Connor, Sandra Day</a>
</div>
be-based is one of a growing family of be-hive/be-enhanced web component based custom attributes / behaviors / decorators / directives.
By referencing behivior.js, elements with attribute be-based will be discovered and transformed.
If using stream-orator to stream HTML to a target element, be-based can be used to watch all new elements, and apply all the rules as they are discovered.
This seems to work quite well with Chromium based browsers running on windows (rewriting image url's before the browser tries the original, invalid url), but isn't so effective with Firefox.
Update: Well, on Chromium based browsers, it doesn't seem so reliable either, at least depending on when I try.
W3C willing.
FAQs
be-based is a package that contains a client-side web component decorator, a trans-render transformer [TODO], and a HTMLRewriter class [TODO].
We found that be-based demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.