
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
ember-window-messenger
Advanced tools
This Ember addon is a lightweight postMessage client/server implementation. It is built on promises so the fetch
and rpc
methods can be used directly in your route model()
hooks.
For changelog see CHANGELOG.md
It supports JSON only messages for now
ember install ember-window-messenger
Add target:origin
map to your config/environment.js
. This effectively defines which targets (windows, frames) is your app communicating with.
APP: {
// Here you can pass flags/options to your application instance
// when it is created
'ember-window-messenger': {
'parent': 'http://localhost:4200',
'target-1': 'http://localhost:4200',
'target-2': 'http://localhost:4200',
'popup': 'http://localhost:4200'
}
}
This list is also used for validation, to check if message comes from an allowed origin.
If you dare, fire up the dummy app in this addon and test it out. Below are the basic examples, see dummy app for more.
// app/service/your-server.js
import Service, { inject as service } from '@ember/service';
export default class YourServerService extends Service {
@service('window-messenger-server');
server;
setup() {
this.server.on('demo-data', this.onDemoDataRequest);
}
teardown() {
this.server.off('demo-data', this.onDemoDataRequest);
}
onDemoDataRequest = (resolve, reject, query) => {
resolve('Some data');
}
}
// app/routes/your-route.js
import Route from '@ember/routing/route';
import { inject as service } from '@ember/service';
export default class YourRoute extends Route {
@service('your-server');
yourServer;
activate() {
super.activate();
this.yourServer.setup();
}
deactivate() {
super.deactivate();
this.yourServer.teardown();
}
}
import Route from '@ember/routing/route';
import { inject as service } from '@ember/service';
export default class YourRoute extends Route {
@service('window-messenger-client')
client;
model() {
return this.client.fetch('demo-data');
}
}
This can be used from parent window to frames/tabs communication.
import Route from '@ember/routing/route';
import { inject as service } from '@ember/service';
export default class YourRoute extends Route {
@service('window-messenger-client')
client;
model() {
return this.client.fetch('popup:demo-data');
}
}
Internally it is the same as fetch
, but provides semantic sugar to your app code.
import Controller from '@ember/controller';
import { inject as service } from '@ember/service';
import { action } from '@ember/object';
export default class YourController extends Controller {
@service('window-messenger-client')
client;
@action
runMe() {
this.client.rpc('start-worker').then((response) => {
// handle response here
});
}
}
If you want to communicate with an iframe or a popup window opened with window.open
, then you have to register your window instance on the client with matching target name from config/environment
map.
// app/components/x-frame.js
import Component from '@glimmer/component';
import { inject as service } from '@ember/service';
export default class XFrameComponent extends Component {
@service('window-messenger-client')
client;
register(frameElement) {
this.client.addTarget(this.args.target, frameElement.contentWindow);
},
unregister() {
this.client.removeTarget(this.args.target);
}
}
<!-- app/components/x-frame.hbs -->
<!-- Install ember-render-modifiers for did-insert/will-destory modifiers -->
<iframe
...attributes
{{did-insert this.register}}
{{will-destory this.unregister}}
></iframe>
<!-- app/templates/your-route.hbs -->
<XFrame src="<url>" @target="target-1"/>
// app/controller/your-controller.js
import Controller from '@ember/controller';
import { inject as service } from '@ember/service';
import { action } from '@ember/object';
import { tracked } from '@glimmer/tracking';
export default class YourController extends Controller {
@service('window-messenger-client')
client;
@tracked
model = null;
@action
openPopup() {
let win = window.open('/some/path', 'Example popup', 'toolbar=no,resizable=no,width=400,height=400');
this.client.addTarget('popup', win);
}
@action
fetchFromPopup() {
this.client.fetch('popup:some-data').then((name) => {
this.model = name;
});
}
}
// app/controller/your-controller.js
import Controller from '@ember/controller';
import { inject as service } from '@ember/service';
import { action } from '@ember/object';
export default class YourController extends Controller {
@service('window-messenger-client')
client;
@action
openPopup() {
if (!this.client.hasTarget('popup')) {
let win = window.open('/some/path', 'Example popup', 'toolbar=no,resizable=no,width=400,height=400');
this.client.addTarget('popup', win);
}
}
}
This project is licensed under the MIT License.
[3.1.0] - 2021-12-01
addon/services/*
converted to TypeScript.FAQs
Simple window postMessage Ember addon
The npm package ember-window-messenger receives a total of 0 weekly downloads. As such, ember-window-messenger popularity was classified as not popular.
We found that ember-window-messenger demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.