Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
express-mung
Advanced tools
Middleware for express responses.
This package allows synchronous and asynchronous transformation of an express response. This is a similar concept to the express middleware for a request but for a response. Note that the middleware is executed in LIFO order. It is implemented by monkey patching (hooking) the res.end
, res.json
, or res.write
methods.
$ npm install express-mung --save
Then in your middleware
var mung = require('express-mung');
module.exports = mung.json(my_transform);
Sample middleware (redact.js) to remove classified information.
'use strict';
const mung = require('express-mung');
/* Remove any classified information from the response. */
function redact(body, req, res) {
if (body.secret) body.secret = '****';
// ...
return body;
}
exports = mung.json(redact);
then add to your app.js
file (before the route handling middleware)
app.use(require('./redact'))
See the mocha tests for some more examples.
Transform the JSON body of the response.
fn(json, req, res)
receives the JSON as an object, the req
and res
. It returns the modified body. If undefined
is returned (i.e. nothing) then the original JSON is assumed to be modified. If null
is returned, then a 204 No Content HTTP status is returned to client.
Asynchronously transform the JSON body of the response.
fn(json, req, res)
receives the JSON as an object, the req
and res
. It returns a promise to a modified body. The promise returns an object.
If it is null
then a 204 No Content is sent to the client.
Transform the HTTP headers of the response.
fn(req, res)
receives the req
and res
. It should modify the header(s) and then return.
Asynchronously transform the HTTP headers of the response.
fn(req, res)
receives the req
and res
. It returns a promise
to modify the header(s).
fn(chunk, encoding, req, res)
receives the string or buffer as chunk
, its encoding
if applicable (null
otherwise), req
and res
. It returns the modified body. If undefined
is returned (i.e. nothing) then the original unmodified chunk is used.
when mung.json*
receives a scalar value then the content-type
is switched text-plain
.
when mung.json*
detects that a response has been sent, it will abort.
sending a response while in mung.headers*
is undefined behaviour and will most likely result in an error.
when mung.write
detects that a response has completed (i.e. if res.end
has been called), it will abort.
calling res.json
or res.send
from mung.write
can lead to unexpected behavior since they end the response internally.
mungError
, when true
the munger function is always invoked. When false
(the default) the munger function is only invoked when the response is not in error.mung
catches any exception (synchronous, asynchronous or Promise reject) and sends an HTTP 500 response with the exception message. This is done by mung.onError(err, req, res)
, feel free to redefine it to your needs.
The MIT license
Copyright © 2015 Richard Schneider (makaretu@gmail.com)
FAQs
Transform an express response (or make until no good)
We found that express-mung demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.