
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
express-json-refiner
Advanced tools
Express JSON refiner middleware by context's scope of api (admin, member...)
Express JSON refiner middleware by scope api (admin, member...)
Dynamicaly reduce your json response by context's scope of api.
The motivation with this module is to provide a way to filter your json response attributes based on context of your apis.
You may have public/private/admin
... API and want to deal with response json objects and its visible attributes.
API focused on 'user' is giving json results (or array) like:
{
field1: '',
field2: '',
field3: '',
field4: ''
}
And for some reasons depending on context whether it is a public
API or member
API you may just want to expose :
{
field1: '',
field3: ''
}
So, idea is to provide your rules by this way, I give more details below:
var o = {
model: {field1: '', field2: '', field3: '', field4: ''},
fields: {
public: ['field1', 'field3'],
member: ['field1', 'field3'],
admin: ['field1', 'field2', 'field3', 'field4']
}
};
In context of Express:
var refiner = require('express-json-refiner');
var load = require('express-load');
var app = express();
app.configure(function() {
...
app.use(refiner.digest);
...
});
// NOTE here I use the best loader for me to load all api scope rules 'express-load'
// This requirement is mandatory to make all working ;)
// See test/ directory example
load('test/model').then('test/access').into(app);
// where 'test/model' contains Mongoose model (schema) or arbitrary model
// where 'test/access' contains your json refiner rules, which attributes to keep for each context.
// result is injection of `model` namespace into `app` variable.
// result is injection of `access` namespace into `app` variable.
var opts = {
debug: false,
rules: app.access
};
// Init refiner with options.
refiner.init(opts, app);
// Example on defining route
app.get('/api1/admin', function(req, res){
var o = {'field1': '1', 'field2': '2', 'field3': '3'};
// NOTE before rendering json output, just give api context for refiner to apply.
req.api = {model: 'api1', scope:'admin'};
// 'api1' is a reference for 'access/api1.js' rule file
// 'admin' is the scope
res.json(o);
// result after refine process:
// {'field1': '1'}
});
FAQs
Express JSON refiner middleware by context's scope of api (admin, member...)
We found that express-json-refiner demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.