
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
correlation-id
Advanced tools
Correlation id maintains a consistent id across asynchronous calls in node.js applications; this is especially useful for logging purposes.
For example within an API, each incoming request can be assigned an id that will be available in all function calls made processing that request, so we can see which requests caused errors.
100% test coverage, no prod dependencies.
yarn:
yarn add correlation-id
npm:
npm i correlation-id --save
From v5 onwards this library requires node >=14. For older node versions use v3.x or v4.x.
As demonstrated by this example, all calls to getId()
within the same withId()
block will return the same id. The id can be supplied, otherwise a v4 uuid will be generated.
const correlator = require("correlation-id");
function printCurrentId(name) {
console.log("%s id: %s", name, correlator.getId());
}
correlator.withId(() => {
setTimeout(() => {
printCurrentId("withId block 1, call 1");
});
setTimeout(() => {
printCurrentId("withId block 1, call 2");
}, 1000);
});
correlator.withId("my-custom-id", () => {
setTimeout(() => {
printCurrentId("withId block 2, call 1");
}, 500);
});
// Output:
// withId block 1, call 1 id: 5816e2d3-6b90-43be-8738-f6e1b2654f39
// withId block 2, call 1 id: my-custom-id
// withId block 1, call 2 id: 5816e2d3-6b90-43be-8738-f6e1b2654f39
withId([id,] work)
Executes function work
within a correlation scope and returns any result returned from work
. Within work and any other function executions (sync or async) calls to getId()
will return the same id. The id for the context may be set explicitly with the optional id
parameter, otherwise it will be a v4 uuid. Calls to withId()
may be nested.
correlator.withId(() => {
console.log(correlator.getId()); // Writes a uuid to stdout
});
correlator.withId("my-custom-id", () => {
console.log(correlator.getId()); // Writes 'my-custom-id' to stdout
});
bindId([id,] work)
Returns function work
bound with a correlation scope. When work
is executed all calls to getId()
will return the same id. The id for the context may be set explicitly with the optional id
parameter, otherwise it will be a v4 uuid. Arguments passed to the bound function will be applied to work
.
const boundFunction = correlator.bindId((p1) => {
console.log("p1 is", p1);
console.log(correlator.getId());
});
boundFunction("foo"); // Writes 'p1 is foo' and then a uuid to stdout
const boundFunction2 = correlator.bindId("my-custom-id", (p1) => {
console.log("p1 is", p1);
console.log(correlator.getId());
});
boundFunction2("foo"); // Writes 'p1 is foo' and then 'my-custom-id' to stdout
getId()
Returns the id for the current correlation scope (created via withId
or bindId
). If called outside of a correlation scope returns undefined
.
correlator.getId(); // Returns the current id or undefined
setId(id)
Sets the id for the current correlation scope (created via withId
or bindId
). If called outside of a correlation scope throws an error.
correlator.setId("my-correlation-id");
Type defs are included.
MIT
FAQs
Correlation id for node.js
The npm package correlation-id receives a total of 41,358 weekly downloads. As such, correlation-id popularity was classified as popular.
We found that correlation-id demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.