
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
floating-button-plugin
Advanced tools
一个可拖拽的浮动按钮插件,支持自定义样式、点击跳转和位置记忆功能。
npm install floating-button-plugin
import FloatingButton from 'floating-button-plugin';
const button = new FloatingButton({
text: '联系我们',
link: 'https://example.com/contact'
});
const button = new FloatingButton({
// 必填参数
text: '联系我们', // 按钮文字
link: 'https://example.com/contact', // 点击跳转链接
// 可选参数
icon: '/images/icon.png', // 按钮图标,不传则不显示图标
position: 'bottom|right', // 初始位置,默认右下角
offset: 20, // 距离边缘的距离(像素),默认 20
visible: true, // 是否显示,默认 true
debug: false, // 是否开启调试模式,默认 false
// 自定义样式
style: {
backgroundColor: '#42b983',
color: '#ffffff',
fontSize: '14px',
padding: '12px 24px',
borderRadius: '4px',
boxShadow: '0 2px 12px rgba(0,0,0,0.1)'
}
});
position 参数支持四个值:
'top|left'
: 左上角'top|right'
: 右上角'bottom|left'
: 左下角'bottom|right'
: 右下角(默认)// 示例:放置在左上角,距离边缘 30px
const button = new FloatingButton({
text: '联系我们',
link: 'https://example.com',
position: 'top|left',
offset: 30
});
// 初始化时隐藏
const button = new FloatingButton({
text: '联系我们',
link: 'https://example.com',
visible: false
});
// 显示按钮
button.show();
// 隐藏按钮
button.hide();
// 切换显示状态
button.setVisible(true); // 显示
button.setVisible(false); // 隐藏
<script>
import FloatingButton from 'floating-button-plugin';
export default {
mounted() {
this.button = new FloatingButton({
text: '联系我们',
link: 'https://example.com/contact'
});
},
beforeDestroy() {
// 组件销毁时记得清理按钮
if (this.button) {
this.button.destroy();
}
}
}
</script>
开启调试模式可以在控制台查看详细的日志信息:
const button = new FloatingButton({
text: '联系我们',
link: 'https://example.com',
debug: true // 开启调试模式
});
localStorage.removeItem('floatingButtonPosition')
destroy()
方法清理按钮MIT
FAQs
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.