
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Easy configurable gradient picker, with no dependencies.
You can download the file from here (CSS), via npm i grapick
or directly from the /dist
folder of this repo
<link rel="stylesheet" href="path/to/grapick.min.css">
<script src="path/to/grapick.min.js"></script>
<div id="gp"></div>
<script type="text/javascript">
const gp = new Grapick({el: '#gp'});
// Handlers are color stops
gp.addHandler(0, 'red');
gp.addHandler(100, 'blue');
// Do stuff on change of the gradient
gp.on('change', complete => {
document.body.style.background = gp.getSafeValue();
})
</script>
pfx
- Class prefix (string)el
- Element on which the picker will be attached (HTMLElement or query string)colorEl
- Element to use for the custom color picker, eg. ''min
- Minimum handler position, default: 0 (integer)max
- Maximum handler position, default: 100 (integer)direction
- Any supported gradient direction: '90deg' (default), 'top', 'bottom', 'right', '135deg', etc.type
- Gradient type, available options: 'linear' (default) | 'radial' | 'repeating-linear' | 'repeating-radial'height
- Gradient input height, default: '30px'width
- Gradient input width, default: '100%'emptyColor
- Default empty color (when you click on an empty color picker area)onValuePos
- Format handler position value, default (to avoid floats): val => parseInt(val)Grapick is color picker independent and uses the browser's native one, by default, just to make it more accessible, but you can easily switch it with one of your choices (recommended as not all browsers support properly input[type=color]
).
In the example below we use spectrum color picker just as the proof of concept
<script src="//code.jquery.com/jquery-3.2.1.min.js"></script>
<script src="//cdnjs.cloudflare.com/ajax/libs/spectrum/1.8.0/spectrum.min.js"></script>
<link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/spectrum/1.8.0/spectrum.min.css">
<div id="gp"></div>
<script type="text/javascript">
const gp = new Grapick({
el: '#gp',
colorEl: '<input id="colorpicker"/>' // I'll use this for the custom color picker
});
gp.setColorPicker(handler => {
const el = handler.getEl().querySelector('#colorpicker');
const $el = $(el);
$el.spectrum({
color: handler.getColor(),
showAlpha: true,
change(color) {
handler.setColor(color.toRgbString());
},
move(color) {
handler.setColor(color.toRgbString(), 0);
}
});
// return a function in order to destroy the custom color picker
return () => {
$el.spectrum('destroy');
}
});
</script>
Available events
change
- Gradient is changedhandler:drag:start
- Started dragging the handlerhandler:drag
- Dragging the handlerhandler:drag:end
- Stopped dragging the handlerhandler:select
- Handler selectedhandler:deselect
- Handler deselectedhandler:add
- New handler addedhandler:remove
- Handler removedhandler:color:change
- The color of the handler is changedhandler:position:change
- The position of the handler is changedClone the repository and enter inside the folder
$ git clone https://github.com/artf/grapick.git
$ cd grapick
Install it
$ npm i
Start the dev server
$ npm start
Run tests
$ npm test
Run and watch tests
$ npm run test:dev
MIT
FAQs
Easy configurable gradient picker, with no dependencies
The npm package grapick receives a total of 6,505 weekly downloads. As such, grapick popularity was classified as popular.
We found that grapick demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.