Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
gas-client
Advanced tools
A client-side utility class that can call server-side Google Apps Script functions
A client-side utility class that uses promises to call server-side Google Apps Script functions. This is a user-friendly wrapper of google.script.run.
It can also optionally be used in local development and is designed to interact with the Google Apps Script Dev Server used in the React / Google Apps Script project.
Install
> npm install gas-client
# or
> yarn add gas-client
import Server from 'gas-client';
const { serverFunctions } = new Server();
// We now have access to all our server functions, which return promises
serverFunctions
.addSheet(sheetTitle)
.then((response) => doSomething(response))
.catch((err) => handleError(err));
To use with Google Apps Script Dev Server, pass in a config object with allowedDevelopmentDomains
indicating the localhost port you are using. This setting will be ignored in production (see below for more details).
import Server from 'gas-client';
const { serverFunctions } = new Server({
allowedDevelopmentDomains: 'https://localhost:3000',
});
serverFunctions
.addSheet(sheetTitle)
.then((response) => doSomething(response))
.catch((err) => handleError(err));
The gas-client
file lets you use promises to call and handle responses from the server, instead of using google.script.run
:
// Google's client-side utility "google.script.run" works like this:
google.script.run
.withSuccessHandler((response) => doSomething(response))
.withFailureHandler((err) => handleError(err))
.addSheet(sheetTitle);
// With this package we can now do this:
import Server from 'gas-client';
const { serverFunctions } = new Server();
// We now have access to all our server functions, which return promises
serverFunctions
.addSheet(sheetTitle)
.then((response) => doSomething(response))
.catch((err) => handleError(err));
// Or we can use async/await syntax:
async () => {
try {
const response = await serverFunctions.addSheet(sheetTitle);
doSomething(response);
} catch (err) {
handleError(err);
}
};
Now we can use familiar Promises in our client-side code and have easy access to all server functions.
The config object takes:
allowedDevelopmentDomains
: A config to specifiy which domains are permitted for communication with Google Apps Script Webpack Dev Server development tool. This is a security setting, and if not specified, will block functionality in development.
allowedDevelopmentDomains
will accept either a space-separated string of allowed subdomains, e.g. 'https://localhost:3000 https://localhost:8080'
(notice no trailing slashes); or a function that takes in the requesting origin and should return true
to allow communication, e.g. (origin) => /localhost:\d+$/.test(origin);
In the normal Google Apps Script production environment, new Server()
will have one available method:
serverFunctions
: an object containing all publicly exposed server functions (see example above).Note that the allowedDevelopmentDomains
configuration will be ignored in production, so the same code can and should be used for development and production.
Development mode for the gas-client
helper class will be run when the google
client API cannot be loaded.
Calling new Server({ allowedDevelopmentDomains })
will create an instance with the following method in development mode:
serverFunctions
: a proxy object, used for development purposes, that mimics calling google.script.run
. It will dispatch a message to the parent iframe (our custom Dev Server), which will call an app that actually interacts with the google.script.run
API. Development mode will also handle the response and resolve or reject based on the response type. See the implementation for details on the event signature.FAQs
A client-side utility class that can call server-side Google Apps Script functions
We found that gas-client demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.