
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
gdrive-sync-js
Advanced tools
Javascript wrapper library for Google Drive API v3.
It authenticate, save, load and list documents from your google drive.
Download the files in the lib folder: login.service.js and drive.service.js. Add them to your app, for instance:
<script src="../lib/login.service.js"></script>
<script src="../lib/drive.service.js"></script>
bower install gdrive-sync-js --save
Then import the library
<script src="../bower_components/lib/login.service.js"></script>
<script src=".../bower_components/lib/drive.service.js"></script>
npm install gdrive-sync-js --save
Then import the library
<script src="../node_modules/gdrive-sync-js/lib/login.service.js"></script>
<script src="../node_modules/gdrive-sync-js/lib/drive.service.js"></script>
After the lib is loaded you can use the new service like this
var SCOPES = 'https://www.googleapis.com/auth/drive.file'
var CLIENT_ID = 'YOUR CLIENT ID';
DISCOVERY_DOCS = ['https://www.googleapis.com/discovery/v1/apis/drive/v3/rest'];
window.loginService = new LoginService(CLIENT_ID, SCOPES, DISCOVERY_DOCS);
SCOPES: scopes to request, as a space-delimited string.
CLIENT_ID: The app's client ID, found and created in the Google Developers Console.
DISCOVERY_DOCS: are the apis that we are going to use. An array of discovery doc URLs or discovery doc JSON objects.
For more info check the Demo
Add your api client_id to demo/fileExplorer/index.html. You can get the client id following the instruction from step1 here https://developers.google.com/drive/v3/web/quickstart/js
Clone, install and run
npm install
npm start // to run the dev server
Then go to http://localhost:4000/demo/fileExplorer
It will ask for signin using a google account, or automatically signin if you already authorized the app.
This demo list the folders and files from your root folder ordered by type and name. If you click in a folder it will open it and also will show in "selected resources" the folder id. If you select a file it will show you the file id.
Add your api client_id to demo/index.html. You can get the client id following the instruction from step1 here https://developers.google.com/drive/v3/web/quickstart/js
Clone, install and run
npm install
npm start // to run the dev server
Then go to http://localhost:4000/demo
The demo uses jQuery but just for hide/show stuff, is not needed.
It will ask for signin using a google account, or automatically signin if you already authorized the app.
Write something and click save, it will create a file in your google drive called gDriveSync.example.txt.
If you change the text and save it again, it will update the file. Have in mind that if you refresh the page the doc id reference will be lost so if you save again it will create a new document.
The document has a mimeType of application/vnd.google-apps.document' this is a google doc, so you can open and edit it from google drive.
login.service.js (parameters: CLIENT_ID, and SCOPES)
drive.service.js
saveFileRaw: It creates a new raw file without mimetype, or update an existing one if the file has an ID (parameter file) If the file object specified the parents parameter (array of folders ids) it will save the file in that specific folder. Useful to save json files. Save it as file.json
loadFileRaw: It loads a file given an ID. (parameter file)
saveFile: It creates a new google document (application/vnd.google-apps.document), or update an existing one if the file has an ID (parameter file) If the file object specified the parents parameter (array of folders ids) it will save the file in that specific folder.
loadFile: It loads a google document as text (plain/text) given an ID. (parameter file)
list: It return the files (id and name) from Google Drive (parameters: resource and callback function). resource= {query_name:'', parents:'', mimeType:'', trashed:false}
A file is just an object like
var file = {id: null, name: 'testName', content:'hello' , parents:['folderId']}
A resource is just an object like
var resource = {query_name:'file_name', parents:'folderId', mimeType:'plain/text' ,trashed:false , orderBy: 'name'}
This is used to pass options to the list method.
More info: https://developers.google.com/drive/v3/reference/files/list
list
method to list files and folders using parameters: query_name (name contains query_name), parents (specific folder to look), mimeType var file = {name: 'filename.txt', parents:['folderId'], content:'hello'};
driveService.saveFile(file, function(savedFile){
console.log('saved file with id:'+savedFile.id)
})
This is not intended to use in a production environment, it just for educational purposes.
The library code is based on this example https://github.com/googledrive/web-quickeditor but using the Google Drive api v3 and plain Javascript.*
FAQs
Save, load and list files with Google Drive API Javascript v3
The npm package gdrive-sync-js receives a total of 2 weekly downloads. As such, gdrive-sync-js popularity was classified as not popular.
We found that gdrive-sync-js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.