
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
firewalker
Advanced tools
It's easy to treat firewall rules as plain configuration. It's incredibly easy to manage a couple of rules that look like.
A framework for executing and testing Cloudflare Firewall rules locally.
const firewall = new Firewall();
const rule = firewall.createRule(`
http.host eq "www.example.org"
`);
rule.match(new Request('http://www.example.org')); // -> true
rule.match(new Request('http://www.example.com')); // -> false
See more examples.
And for integration testing see some of the ruleset examples
It's easy to treat firewall rules as plain configuration. It's incredibly easy to manage a couple of rules that look like.
http.host eq "www.example.org"
And end up with a rule that looks more like.
http.host matches "(www|api)\.example\.org"
and not lower(http.request.uri.path) matches "/(auth|login|logut).*"
and (
any(http.request.uri.args.names[*] == "token") or
ip.src in { 93.184.216.34 62.122.170.171 }
)
or cf.threat_score lt 10
Over time, the number of rules and their complexity grows. Manually testing rules like the above is error-prone as humans are known to make mistakes. After a few steps up in complexity, it becomes apparent that firewall rules are code, and need to be treated as code. They need to be stored in a source code repository, managed with a tool like Terraform, and the changes need to be tested on CI.
Here is where Firewalker comes into play allowing you to write unit tests to ensure that a change to the path regex isn't going to block all of the traffic to your site or cancel out the effect of the rule completely. For instance, for the rule above, you can define multiple assertions with jest.
const rule = firewall.createRule(/* */);
expect(rule.match(new Request('http://www.example.org'))).toBeFalsy();
expect(rule.match(new Request('http://www.example.org?token=abc'))).toBeTruthy();
expect(rule.match(new Request('http://www.example.org/login/user?token=abc'))).toBeFalsy();
expect(
rule.match(
new Request('http://www.example.org/login/user?token=abc', {
cf: { 'cf.threat_score': 5 },
}),
),
).toBeTruthy();
// etc
Firewalker builds on top of Cloudflare's wirefilter rule engine and provides API to construct the requests in JS. After all, if the tests for your workers are in JS, why not to use the same syntax for the WAF rules?
Firewalker relies on a binary build wirefilter to run and execute the firewall rules. Therefore, only the platforms which binaries were pre-built will be able to run Firewalker. Currently supported platforms are:
Firewalker uses Yarn as dependency manager, run the command below to install the dependencies.
yarn install
Create your new .ts
test case or modify the firewall.tests.ts
in /test
. To run the test cases, just run yarn run test
command in the root directory.
The Firewalker project is not officially supported by Cloudflare or affiliated with Cloudflare in any way. While Firewalker tries to preserve the semantics of the Cloudflare WAF rule engine, there will always be some differences, so use it at your own risk as general guidance for local testing rather than the ultimate truth.
Contributions are always welcome!
FAQs
It's easy to treat firewall rules as plain configuration. It's incredibly easy to manage a couple of rules that look like.
The npm package firewalker receives a total of 256 weekly downloads. As such, firewalker popularity was classified as not popular.
We found that firewalker demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.