
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
cmem_helpers
Advanced tools
This provides a few simple & light helpers for working with C-memory. It should be useful for FFI, native node-modules, and browser/node wasm, and has no dependencies. It should also work for other runtimes like bun, deno, or quickjs.
Use it to pass and work with strings, and structs. It is very light and intended for no-emscripten host-code, or situations where you want to do your own thing, a bit.
I also wrote a couple medium posts about how it works:
You can add it to your project like this:
npm i cmem_helpers
And then import or require it:
import MemoryView from 'cmem_helpers'
// OR
const MemoryView = require('cmem_helpers')
You can also use it on the web:
<script type="module">
import MemoryView from 'https://cdn.jsdelivr.net/npm/cmem_helpers/+esm'
</script>
You can also use an importmap to make your code look the same:
<script type="importmap">
{
"imports": {
"cmem_helpers": "https://cdn.jsdelivr.net/npm/cmem_helpers/+esm"
}
}
</script>
<script type="module">
import MemoryView from 'cmem_helpers'
// YOUR CODE HERE
</script>
Here is an example with WASM, in the browser/nodejs:
import MemoryView from 'cmem_helpers'
// define this to pass functions to WASM
const env = {
demo(namePtr) {
console.log(`Hello ${mem.getString(namePtr)}!`)
}
}
// load your bytes in wasmBytes however you do that
const wasmBytes = '...'
const mod = (await WebAssembly.instantiate(wasmBytes, { env })).instance.exports
// here is how you set it up
const mem = new MemoryView(mod.memory, mod.malloc)
The first param is a buffer associated with the memory, and the second is optional, and it's a way to allocate bytes, and get a pointer. The third is optional, and it's "little-endian". Since wasm uses little-endian, that is the default, but you can overide by setting it to false
. In this example, I exposed a function called malloc
in my wasm, so I can allocate bytes, in the host. You can see an example in the test wasm.
It has all the same stuff as a DataView, for convenience:
console.log(mem.getUint32(ptr))
These are for basic C-style null-terminated UTF-8 strings.
// get a string from a pointer, using /0 termination (standard c-string)
mem.getString(strPtr)
// set a string in memory, with length (remember the last /0 char)
mem.setString(strPtr, 'Hello')
// get a pointer to a new string (if you setup malloc earlier)
const ptr = mem.setString('Hello')
Bytes work the same, but with Uint8Array
// get 100 bytes as a Uint8Array
mem.getBytes(strPtr, 100)
// set a string in memory, with length (remember the last /0 char)
mem.setBytes(new Uint8Array([1,2,3]), ptr)
// get a pointer to a new string (if you setup malloc earlier)
const ptr = mem.setBytes(new Uint8Array([1,2,3]))
This very simple helper uses DataView to interact directly with the memory.
Valid types are:
BigInt64
BigUint64
Float32
Float64
Int16
Int32
Int8
Uint16
Uint32
Uint8
You can define a struct like this:
const Color = mem.struct({
r: 'Uint8',
g: 'Uint8',
b: 'Uint8',
a: 'Uint8'
})
And now you can make Color
objects, with an address, and/or intiial value:
const color = new Color({r: 0, g: 0, b: , a: 255}, address)
If you provided a malloc
function earlier, when you set it up, you can also do this:
const color = new Color()
const color = new Color({r: 0, g: 0, b: , a: 255})
And it will allocate it for you. It will have a couple members: _size
and _address
that you can use in other things, for example to pass the pointer to a function:
mod.useMyColor(color._address)
You can also access the underlying bytes, if you need them:
console.log(color._bytes)
I have a few ideas for the future:
Uint8[100]
FAQs
simple & light helpers for working with C-memory
We found that cmem_helpers demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.