
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
harfbuzzjs
Advanced tools
Providing HarfBuzz shaping library for client/server side JavaScript projects.
See the demo here.
./build.sh
Download the pack from releases tab of the project, or just download the demo page (the demo source is in gh-pages branch).
hb = require("hbjs.js")
WebAssembly.instantiateStreaming(fetch("hb.wasm")).then(function (result) {
fetch('myfont.ttf').then(function (data) {
return data.arrayBuffer();
}).then(function (fontdata) {
var blob = hb.createBlob(fontdata); // Load the font data into something Harfbuzz can use
var face = hb.createFace(blob, 0); // Select the first font in the file (there's normally only one!)
var font = hb.createFont(face); // Create a Harfbuzz font object from the face
var buffer = hb.createBuffer(); // Make a buffer to hold some text
buffer.addText('abc'); // Fill it with some stuff
buffer.guessSegmentProperties(); // Set script, language and direction
hb.shape(font, buffer); // Shape the text, determining glyph IDs and positions
var output = buffer.json();
// Enumerate the glyphs
var xCursor = 0;
var yCursor = 0;
for (glyph of output) {
var glyphId = glyph.g;
var xAdvance = glyph.ax;
var xDisplacement = glyph.dx;
var yDisplacement = glyph.dy;
var svgPath = font.glyphToPath(glyphId);
// You need to supply this bit
drawAGlyph(svgPath, xCursor + xDisplacement, yDisplacement);
xCursor += xAdvance;
}
// Release memory
buffer.destroy();
font.destroy();
face.destroy();
blob.destroy();
})
})
More examples:
npx pad.js
http://127.0.0.1/examples/hbjs.example.html
or http://127.0.0.1/examples/nohbjs.html
(cd examples && node hbjs.example.node.js)
We provide a tiny wrapper (hbjs.js
) around the main functionality of harfbuzz, but it's also easy to use other parts. (See example/nohbjs.js
as an example. However, you may need a custom build to expose additional functionality.)
Can be added with npm i harfbuzzjs
or yarn add harfbuzzjs
, see the examples for
how to use it.
harfbuzzjs uses a stripped-down version of Harfbuzz generated by compiling Harfbuzz with -DHB_TINY
. This may mean that some functions you need are not available. Look at src/hb-config.hh
in the Harfbuzz source directory to see what has been removed. For example, HB_TINY
defines HB_LEAN
which (amongst other things) defines HB_NO_OT_GLYPH_NAMES
. If, for example, you really need to get at the glyph names:
#undef HB_NO_OT_GLYPH_NAMES
to config-override.h
.hbjs.symbols
; in this case _hb_ot_get_glyph_name
.char *
parameter name
and marshalling it to a JavaScript string with heapu8.subarray
. The best way to do this is to look at hbjs.js
for functions which use similar signatures.If you have extended harfbuzzjs in ways that you think others will also benefit from, please raise a pull request. If there are parts of Harfbuzz that you need but the instructions above don't work, describe what you are trying to do in an issue.
See harfbuzz port inside emscripten
and emscripten-ports/HarfBuzz, basically all you need is to use
-s USE_HARFBUZZ=1
in your build.
Optionally you can install binaryen
and use wasm-opt
like:
wasm-opt -Oz hb.wasm -o hb.wasm
binaryen
also provides wasm-dis
which can be used for,
wasm-dis hb.wasm | grep export
wasm-dis hb.wasm | grep import
with that you can check if the built wasm file only exports things you need and doesn't need to import anything, as usual with wasm files built here.
FAQs
Minimal version of HarfBuzz for JavaScript use
The npm package harfbuzzjs receives a total of 13,202 weekly downloads. As such, harfbuzzjs popularity was classified as popular.
We found that harfbuzzjs demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.