
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
child-process-exec-argv
Advanced tools
child-process-exec-argv
eases debugging of child process.
##Motivation Debugging nodejs forked or clusterd child process can sometimes be difficult. For example in visual studio code it almost comes out of the box. You will find you need to change the argsv of your child process - code modifications. It's not recommended for most projects to be framilier with the required code modification.
This is when this module comes in handy, it will do the dirty code modifications for you. Including assigning random ports to child process, while validating that these are free.
##Simple usage The following usage should be enough to most projects.
const childProcessExecArgv = require('child-process-exec-argv');
const subprocess = require('child_process').fork('subprocess.js' , [] , {
execArgv : await childProcessExecArgv.getExecArgv()
});
If you must have sync result you can use the sync methods, just know that the async method will validate that the random port is valid, while sync method cannot.
const childProcessExecArgv = require('child-process-exec-argv');
const subprocess = require('child_process').fork('subprocess.js' , [] , {
execArgv : childProcessExecArgv.syncGetExecArgv()
});
##Advanced usage This module come with some customization to enable usage to varity of integrations.
When requiring the main
module you will recive a singlton for your convince , you can also you create a custome instance for better encapsulation/customization.
By default this module will identify the current process is being debugged and will request debugging on the child process. You can overide this behavior by:
child-debugger=disabled
.childProcessExecArgv.childDebuggble = false
childProcessExecArgv
.###Create a custome childProcessExecArgv
const {ChildProcessExecArgv} = require('child-process-exec-argv');
const childProcessExecArgv = new ChildProcessExecArgv();
//For example disable debugging only for this process
childProcessExecArgv.childDebuggble = false;
const subprocess = require('child_process').fork('subprocess.js' , [] , {
execArgv : await childProcessExecArgv.getExecArgv()
});
##How to debug forked process in visual studio code Altough visual studio code comes with a built in support for identifying child process and attaching to them, in some cases it will not manage the ports correctly.
The following changes will help you gainning child process debugging.
Add to your current process in launch.json
the following paramter:
"autoAttachChildProcesses": true
Take exec argv for this module and forward it to the fork function
const childProcessExecArgv = require('child-process-exec-argv');
const subprocess = require('child_process').fork('subprocess.js' , [] , {
execArgv : await childProcessExecArgv.getExecArgv()
});
Happy debugging!
##Debug with WebStorm Webstorm is doing a great job with debugging child processes, altough possible to use both we didn't find a reason to use this module while using webstorm.
FAQs
Better handling child process exec argv
The npm package child-process-exec-argv receives a total of 3 weekly downloads. As such, child-process-exec-argv popularity was classified as not popular.
We found that child-process-exec-argv demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.