
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
This is a CLI parameter parser to get the named and typed value. But any options started with '-' or '--' never be parsed by this package. If such options are needed, At first, use other option parser like 'node-getopt' and then process the rest parameters with this package.
Simply, get method names each elements in process.argv.
simple.js
const args = require("hash-arg").get(
"inputFilePath outputFilePath");
console.log(JSON.stringify(args, null, " "));
Outputs:
$ node test/simple.js input.json output.json
{
"inputFilePath": "input.json",
"outputFilePath": "output.json"
}
The optional second parameter of the get method is normal array.
So, for instance, you can specify a node-getopt
's argv property for it.
with-node-argv.js
getopt = require("node-getopt").create([
['s', '', 'short option'],
['l', 'long', 'long option'],
['S', 'short-with-arg=ARG', 'option with argument']
]).parseSystem();
args = require("hash-arg").get([
"inputFilePath",
{
"name":"outputFilePath",
"default": "out.json"
}
], getopt.argv);
console.log(JSON.stringify(args, null, " "));
Outputs:
$ node test/with-node-getopt.js -S DUMMY input.json -sl output.json
{
"inputFilePath": "input.json",
"outputFilePath": "output.json"
}
prototype
HashArg.get(<argument-def> [, <argv-source-array>]);
This can be specified as a string, an array of string, or an array of definition object.
1) string
The string that contains parameter names separated by space.
"inputFilePath outputFilePath"
If the string contains ';' character, each elements splited by the character declare the type and name.
"string inputFilePath; number countOfFile"
Or, following type specification is also available. It is used in a UML class diagram.
"inputFilePath:string; countOfFile:number"
When the type is not specified,
it is regarded for var
.
2) Array of string
Each element represents the parameter name.
["inputFilePath", "outputFilePath"]
type declaration:
You can specify the type of the value. The available type is 'string' or 'number'.
When the declaration is separated by space, it represents the type and its name.
And, when it is separated by a colon, those are the name and its type.
["string inputFilePath", "number countOfFile"]
And, Following is available too.
["inputFilePath:string", "countOfFile:number"]
specify default value:
You can specify the default value, If the value is not specified.
['inputFilePath:string="foo.txt"', "countOfFile:number=1234"]
A string value must be quoted by double quotation rather than single, or the parsing will fail. This is a specification of JSON.parse.
When the default value is not declared, null will be used.
3) Array of definition object
Following declaration is available.
[
{"name":"inputFilePath"},
{
"name" : "outputFilePath",
"type" : "string" // 'string' or 'number'
"default" : "out.json"
}
]
To specify the type to a named parameter. Following two styles are available.
<type> <name>
" - ( C/C++ style )<name> : <type>
" - ( UML style )The last argument can be set as an array. The rest arguments in the list will be contained to the parameter.
To specify, pair of square brackets could be put after the type name. The brackets must be empty.
Followings are all now available.
["string inputFilePath", "number[] countOfFile"]
["inputFilePath:string", "countOfFile:number[]"]
[
{"name":"inputFilePath"},
{
"name" : "outputFilePath",
"type" : "string[]"
}
]
An array of string to parse as command line parameters.
The process.argv
is used by default, when it is not specified,
MIT
FAQs
CLI parameter parser to get the named and typed value
The npm package hash-arg receives a total of 7,781 weekly downloads. As such, hash-arg popularity was classified as popular.
We found that hash-arg demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.