
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
container-ioc
Advanced tools
is a Dependency Injection / IoC container package for Typescript/ES6+ projects. It manages the dependencies between classes, so that applications stay easy to change and maintain as they grow.
npm install --save container-ioc
import { Container, Inject, Injectable } from 'container-ioc';
let container = new Container();
@Injectable()
class App {}
interface IService {}
@Injectable()
class Service implements IService {
constructor(@Inject('IService') public service: IService) {}
}
let providers = [
{ token: App, useClass: App },
{ token: 'IService', useClass: Service }
];
container.register(providers);
let app = container.resolve(App);
Use alternative syntax for declaring injections shown below and don't use interfaces. See examples/javascript for more.
@Injectable(['IService'])
class Service {
constructor(service) {
this.service = service;
}
}
By default, containers resolve singletons. You can change that by setting provider's attribute LifeTime to LifeTime.PerRequest.
import { Container, Injectable, LifeTime } from 'container-ioc';
const container = new Container();
@Injectable()
class A {}
container.register([
{ token: A, useClass: A, lifeTime: LifeTime.PerRequest }
]);
const instance1 = container.resolve(A);
const instance2 = container.resolve(A);
If a provider wasn't found in a container it will look up in ascendant containers if there are any:
import { Container } from 'container-ioc';
@Injectable()
class A {}
let parentContainer = new Container();
let childContainer = parentContainer.createScope();
parentContainer.register({ token: 'IA', useClass: A });
childContainer.resolve('IA');
/* Without injections */
container.register([
{
token: 'TokenForFactory',
useFactory: () => {
return 'any-value';
}
}
]);
/* With injections */
container.register([
{ token: 'EnvProvider', useClass: EnvProvider },
{
token: 'TokenForFactory',
useFactory: (envProvider) => {
// do something
return 'something';
},
inject: ['EnvProvider']
}
]);
container.register([
{ token: 'IConfig', useValue: {}}
]);
container.register([
App
]);
Is the same as:
container.register([
{ token: App, useClass: App }
]);
Use InjectionToken instances for tokens instead of string/class literals, it saves from using hardcoded string and helps in keeping abstractions intact.
Before:
interface IService {}
@Injectable()
class ConcreteService {}
container.register({ token: 'IService', useClass: ConcreteService });
container.resolve('IService');
After:
interface IService {}
const TService = new InjectionToken<IService>('IService'); // T stands for Token, you can pick another prefix
@Injectable()
class ConcreteService {}
container.register({ token: TService, useClass: ConcreteService });
container.resolve(TService);
Become a contributor to this project. Feel free to submit an issue or a pull request.
see CONTRIBUTION.md for more information.
FAQs
Dependency Injection and Inversion of Control (IoC) container
The npm package container-ioc receives a total of 16 weekly downloads. As such, container-ioc popularity was classified as not popular.
We found that container-ioc demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.