
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
A format for settings.
In many ways, it's JSON with the CoffeeScript treatment.
Also, it's a subset of YAML. YAML parsers parse Dotset.
The following file example.set
:
# Comments. They're actually useful.
name: "Dotset: The Settings File Format"
version: 1.0
That simple?: yes
Can I nest?:
- You can nest lists…
- and: obviously
objects: too!
… would correspond to this JSON:
{
"name": "Dotset: The Settings File Format",
"version": 1.0,
"That simple?": true,
"Can I nest?": [
"You can nest lists…",
{
"and": "obviously",
"objects": "too!"
}
]
}
Each file is UTF-8 encoded.
Primitives:
dictionary
array
string
number
boolean (yes
or no
)
null (null
)
string: either rawString or the following.
Also, Strings can escape newlines. Multiline strings for you.
dictionary:
keyValue (newline keyValue)*
newline: ASCII character 0x0A
(or 0x0D
, but don't use it).
keyValue of indentation indent
:
string : (whitespace)+ primitive OR string : (whitespace)+ newline indent primitive
rawString:
(any unicode character but -
and "
and digit)
(any sequence of unicode character but (:
(whitespace)+))*
but not yes
, no
, null
indent: sequence of ASCII characters 0x20
. Nothing else.
non-empty array of indentation indent
:
-
(whitespace)+ primitive (newline indent -
(whitespace)+ primitive)*
empty array:
[]
whitespace:
(Unicode points 0x9 OR 0x20 OR 0xA0 OR 0x2000 - 0x200D OR 0x202F OR 0x205F OR 0x2060 OR 0x3000 OR 0xFEFF)+
Because I hate to see projects use .ini
files. It is ugly and poorly specified
(if at all).
Because I hate to see projects use .xml
files. It is even uglier and supports
namespaces.
Because YAML is overly complex to parse.
Because JSON is just fine, but people find it too raw and hard to edit.
Having just one possibility for invisible characters / encoding makes it easier to not screw things up. The last thing anyone wants to screw up is the config file.
FAQs
The Dotset File Format. One format to make your settings fine!
The npm package dotset receives a total of 0 weekly downloads. As such, dotset popularity was classified as not popular.
We found that dotset demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.