
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
csr-controller
Advanced tools
This is library for creating client side type-safe database controllers. Integrates out of box with typescript, ORM, Next.JS.
Install package with npm i csr-controller
To create your first controller use:
type User = {
name: string,
age: number
} & CRUDBase;
type UpdateUserType = User & CRUDBase;
const UserController = createController<User, CRUDBase, UpdateUserType>({
$url: 'user',
})(crudTemplate)();
First, we can skip generics and just call createController()
, but for type safety it is recommended way. Every Controller
needs three generics:
User
CRUDBase
It is made as: { id: string | null }
Calling the function, we must specify $url
- it's the api path. We can also specify $base
. It is default to "custom"
.
In our case, using UserController
any action would fetch relativeServerPath:port/api/custom/user
Next, we must provide template. Here we provide crudTemplate
. It is preferred when using web server as it makes direct fetch calls to api and can be shared between projects. In the feature there will be electronTemplate
that makes IPC calls.
To add controller behaviour such as making database calls/fetching external api use:
const routes = controllerRegistry().register(UserController, {
index: async () => {
const users = await db.getUsers(); // Make call to database to fetch all users
return users;
},
read: async data => {
const user = await db.getUser({ id: data.id }); // Make call to database to fetch single user by id
return user;
}
}).handle();
To use our routes with Next, create page in api/[base]/[...nextcontroller]
. Remember, base
defaults to "custom"
.
import { withNextRoute } from "csr-controller/apiRoutes/next"
import { controllerRegistry } from "csr-controller/registry"
const routes = controllerRegistry().register(...).handle();
export default withNextRoute(routes, middlewareFoo, middlewareBar);
This API page will handle every request from registered controllers.
// Get all users
const users = await UserController.index();
// Update user
const updatedUser = await UserController.update({ id: 1, /* Pass rest data here */ })
It is recommended to use useSWR
hook when developing with React based frameworks like Next.JS
[1.5.6] - 2023-03-24
FAQs
DB Controller for client side rendering
The npm package csr-controller receives a total of 0 weekly downloads. As such, csr-controller popularity was classified as not popular.
We found that csr-controller demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.