Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
chromedriver-html5-dragdrop
Advanced tools
If you're using the HTML5 drag and drop implementation in you web app and want to test its behaviour with Selenium and Chromedriver, you're out of luck due to this bug:
Chromedriver can handle clickAndHold
, move
and release
, but has a bug in this. There is a event.button
attribute in every Javascript MouseEvent
object. This is set to -1
if nothing is clicked
and something between 0
(main mouse button) and 4
if a button is clicked.
Now chromedriver sets this on clickAndHold
but does not take it over into the move
so when moving the event.button
is -1
again.
Using Selenium's JS API,
possibly wrapped by something like Nemo,
simply include dragdrop-chromedriver.js
in your test runner or -suite, like this:
require('chromedriver-html5-dragdrop')(yourInstantiatedWebdriver/* , waitMillisBetweenSteps */);
When using Nemo, yourInstantiatedWebdriver
is usually nemo.driver
.
You can set waitMillisBetweenSteps
for debugging or watching what's happening.
Now, use dragAndDrop
just like in Selenium's example.
Refer here
for the dragAndDrop
method's API.
Because for security reasons synthetic drag events do not have a usable dataTransfer
property,
all dataTransfer
accesses in the tested code must be made conditional, for example like this:
if (event.dataTransfer) { event.dataTransfer.dropEffect = 'move'; }
Because of this, but also due to limits of the original dragAndDrop
API, you won't be able to test dragging files into the browser window.
Basically it monkey patches webdriver.ActionSequence
, overriding its dragAndDrop
function
with one that remains fully API compatible to the original one,
but internally triggers the dragstart
, drag
, dragover
, drop
and dragend
events in the browser context.
There are some checks to prevent this approach from performing drag and drop operations a real user wouldn't be able to perform.
FAQs
Chromedriver HTML5 drag and drop fix
The npm package chromedriver-html5-dragdrop receives a total of 7 weekly downloads. As such, chromedriver-html5-dragdrop popularity was classified as not popular.
We found that chromedriver-html5-dragdrop demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.