Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
In case you didn't know, the HTML5 drag and drop API is a total disaster! This is an attempt to make the API usable by mere mortals.
See https://instant.io.
drag
class to the drop target on hover, for easy styling!npm install drag-drop
This package works in the browser with browserify. If you do not use a bundler, you can use the standalone script directly in a <script>
tag.
const dragDrop = require('drag-drop')
dragDrop('#dropTarget', (files, pos, fileList, directories) => {
console.log('Here are the dropped files', files) // Array of File objects
console.log('Dropped at coordinates', pos.x, pos.y)
console.log('Here is the raw FileList object if you need it:', fileList)
console.log('Here is the list of directories:', directories)
})
Another handy thing this does is add a drag
class to the drop target when the user
is dragging a file over the drop target. Useful for styling the drop target to make
it obvious that this is a drop target!
const dragDrop = require('drag-drop')
// You can pass in a DOM node or a selector string!
dragDrop('#dropTarget', (files, pos, fileList, directories) => {
console.log('Here are the dropped files', files)
console.log('Dropped at coordinates', pos.x, pos.y)
console.log('Here is the raw FileList object if you need it:', fileList)
console.log('Here is the list of directories:', directories)
// `files` is an Array!
files.forEach(file => {
console.log(file.name)
console.log(file.size)
console.log(file.type)
console.log(file.lastModifiedDate)
console.log(file.fullPath) // not real full path due to browser security restrictions
console.log(file.path) // in Electron, this contains the actual full path
// convert the file to a Buffer that we can use!
const reader = new FileReader()
reader.addEventListener('load', e => {
// e.target.result is an ArrayBuffer
const arr = new Uint8Array(e.target.result)
const buffer = new Buffer(arr)
// do something with the buffer!
})
reader.addEventListener('error', err => {
console.error('FileReader error' + err)
})
reader.readAsArrayBuffer(file)
})
})
If you prefer to access file data as Buffers, then just require drag-drop like this:
const dragDrop = require('drag-drop/buffer')
dragDrop('#dropTarget', files => {
files.forEach(file => {
// file is actually a buffer!
console.log(file.readUInt32LE(0))
console.log(file.toJSON())
console.log(file.toString('hex')) // etc...
// but it still has all the normal file properties!
console.log(file.name)
console.log(file.size)
console.log(file.type)
console.log(file.lastModifiedDate)
})
})
If the user highlights text and drags it, we capture that as a separate event. Listen for it like this:
const dragDrop = require('drag-drop')
dragDrop('#dropTarget', {
onDropText: (text, pos) => {
console.log('Here is the dropped text:', text)
console.log('Dropped at coordinates', pos.x, pos.y)
}
})
dragenter
, dragover
and dragleave
eventsInstead of passing just an ondrop
function as the second argument, instead pass an
object with all the events you want to listen for:
const dragDrop = require('drag-drop')
dragDrop('#dropTarget', {
onDrop: (files, pos, fileList, directories) => {
console.log('Here are the dropped files', files)
console.log('Dropped at coordinates', pos.x, pos.y)
console.log('Here is the raw FileList object if you need it:', fileList)
console.log('Here is the list of directories:', directories)
},
onDropText: (text, pos) => {
console.log('Here is the dropped text:', text)
console.log('Dropped at coordinates', pos.x, pos.y)
},
onDragEnter: (event) => {},
onDragOver: (event) => {},
onDragLeave: (event) => {}
})
You can rely on the onDragEnter
and onDragLeave
events to fire only for the
drop target you specified. Events which bubble up from child nodes are ignored
so that you can expect a single onDragEnter
and then a single onDragLeave
event to fire.
Furthermore, neither onDragEnter
, onDragLeave
, nor onDragOver
will fire
for drags which cannot be handled by the registered drop listeners. For example,
if you only listen for onDrop
(files) but not onDropText
(text) and the user
is dragging text over the drop target, then none of the listed events will fire.
To stop listening for drag & drop events and remove the event listeners, just use the
cleanup
function returned by the dragDrop
function.
const dragDrop = require('drag-drop')
const cleanup = dragDrop('#dropTarget', files => {
// ...
})
// ... at some point in the future, stop listening for drag & drop events
cleanup()
To support users pasting files from their clipboard, use the provided
processItems()
function to process the DataTransferItemList
from the
browser's native 'paste'
event.
document.addEventListener('paste', event => {
dragDrop.processItems(event.clipboardData.items, (err, files) => {
// ...
})
})
file://
urlsDon't run your app from file://
. For security reasons, browsers do not allow you to
run your app from file://
. In fact, many of the powerful storage APIs throw errors
if you run the app locally from file://
.
Instead, start a local server and visit your site at http://localhost:port
.
MIT. Copyright (c) Feross Aboukhadijeh.
FAQs
HTML5 drag & drop for humans
The npm package drag-drop receives a total of 53,348 weekly downloads. As such, drag-drop popularity was classified as popular.
We found that drag-drop demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.