Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
ember-window-messenger
Advanced tools
This Ember addon is a lightweight postMessage client/server implementation. It is built on promises so the fetch
and rpc
methods can be used directly in your route model()
hooks.
For changelog see CHANGELOG.md
It supports JSON only messages for now
ember install ember-window-messenger
Add target:origin
map to your config/environment.js
. This effectively defines which targets (windows, frames) is your app communicating with.
APP: {
// Here you can pass flags/options to your application instance
// when it is created
'ember-window-messenger': {
'parent': 'http://localhost:4200',
'target-1': 'http://localhost:4200',
'target-2': 'http://localhost:4200',
'popup': 'http://localhost:4200'
}
}
This list is also used for validation, to check if message comes from an allowed origin.
If you dare, fire up the dummy app in this addon and test it out. Below are the basic examples, see dummy app for more.
// app/service/your-server.js
import Service, { inject as service } from '@ember/service';
export default class YourServerService extends Service {
@service('window-messenger-server');
server;
setup() {
this.server.on('demo-data', this.onDemoDataRequest);
}
teardown() {
this.server.off('demo-data', this.onDemoDataRequest);
}
onDemoDataRequest = (resolve, reject, query) => {
resolve('Some data');
}
}
// app/routes/your-route.js
import Route from '@ember/routing/route';
import { inject as service } from '@ember/service';
export default class YourRoute extends Route {
@service('your-server');
yourServer;
activate() {
super.activate();
this.yourServer.setup();
}
deactivate() {
super.deactivate();
this.yourServer.teardown();
}
}
import Route from '@ember/routing/route';
import { inject as service } from '@ember/service';
export default class YourRoute extends Route {
@service('window-messenger-client')
client;
model() {
return this.client.fetch('demo-data');
}
}
This can be used from parent window to frames/tabs communication.
import Route from '@ember/routing/route';
import { inject as service } from '@ember/service';
export default class YourRoute extends Route {
@service('window-messenger-client')
client;
model() {
return this.client.fetch('popup:demo-data');
}
}
Internally it is the same as fetch
, but provides semantic sugar to your app code.
import Controller from '@ember/controller';
import { inject as service } from '@ember/service';
import { action } from '@ember/object';
export default class YourController extends Controller {
@service('window-messenger-client')
client;
@action
runMe() {
this.client.rpc('start-worker').then((response) => {
// handle response here
});
}
}
If you want to communicate with an iframe or a popup window opened with window.open
, then you have to register your window instance on the client with matching target name from config/environment
map.
// app/components/x-frame.js
import Component from '@glimmer/component';
import { inject as service } from '@ember/service';
export default class XFrameComponent extends Component {
@service('window-messenger-client')
client;
register(frameElement) {
this.client.addTarget(this.args.target, frameElement.contentWindow);
},
unregister() {
this.client.removeTarget(this.args.target);
}
}
<!-- app/components/x-frame.hbs -->
<!-- Install ember-render-modifiers for did-insert/will-destory modifiers -->
<iframe
...attributes
{{did-insert this.register}}
{{will-destory this.unregister}}
></iframe>
<!-- app/templates/your-route.hbs -->
<XFrame src="<url>" @target="target-1"/>
// app/controller/your-controller.js
import Controller from '@ember/controller';
import { inject as service } from '@ember/service';
import { action } from '@ember/object';
import { tracked } from '@glimmer/tracking';
export default class YourController extends Controller {
@service('window-messenger-client')
client;
@tracked
model = null;
@action
openPopup() {
let win = window.open('/some/path', 'Example popup', 'toolbar=no,resizable=no,width=400,height=400');
this.client.addTarget('popup', win);
}
@action
fetchFromPopup() {
this.client.fetch('popup:some-data').then((name) => {
this.model = name;
});
}
}
// app/controller/your-controller.js
import Controller from '@ember/controller';
import { inject as service } from '@ember/service';
import { action } from '@ember/object';
export default class YourController extends Controller {
@service('window-messenger-client')
client;
@action
openPopup() {
if (!this.client.hasTarget('popup')) {
let win = window.open('/some/path', 'Example popup', 'toolbar=no,resizable=no,width=400,height=400');
this.client.addTarget('popup', win);
}
}
}
This project is licensed under the MIT License.
[3.3.0] - 2021-12-14
FAQs
Simple window postMessage Ember addon
The npm package ember-window-messenger receives a total of 0 weekly downloads. As such, ember-window-messenger popularity was classified as not popular.
We found that ember-window-messenger demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.