
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
A simple javascript dependency inject processor, work great with Promise.
simple injection:
var injecting = require('injecting');
var app = injecting();
app.register('name', 'jack');
app.register('person', function(name) {
this.name = name;
});
app.invoke(function(person) {
console.log(person.name); // jack
});
recursive injection:
var injecting = require('injecting');
var app = injecting();
app.register('place', 'pacific');
app.register('cat', function() {
this.name = "white cat";
});
app.register('person', function(cat) {
this.name = "robot";
this.pet = cat;
});
app.register('story', function(place, person){
return {
place: place,
person: person.name,
pet: person.pet.name
};
});
app.invoke(function(story){
console.log(story);
/* should be
{
place: 'pacific',
person: 'robot',
pet: 'white cat'
};
*/
});
var injecting = require('injecting');
var app = injecting();
function sleep(ms) {
return new Promise(function(resolve) {
setTimeout(function () {
resolve('');
}, ms);
});
}
// function that return a promise
app.register('name', function() {
return sleep(1000).then(() =>'jack');
});
// generator as async function and inject `name`
app.register('person', function* (name) {
yield sleep(1000);
return {name: name, age: 10};
});
app
.get('person')
.then(function(person) {
console.log(person); // should be {name: 'jack', age: 10}
});
The code shows above does not robust enough when our source code is minified. For example:
app.register('person', 'jack');
app.invoke(function(person) {
console.log(person);
});
// will be minified as
app.invoke(function(a) {
console.log(a);
});
// it will lead to app crush in such case since `a` is not registered.
There are several method to avoid minification problem. Look at the code below:
// invoke a function with predefined injections
app.invoke(['person', 'job', function(p, j) {
console.log(p, j);
});
// register a dep with predefined injections
app.register('person', ['name', 'age', function (n, a) {
return {name: n, age: a};
});
Please refer to the test cases for more examples.
register a constant as dependency.
register a service as dependency. notice you have to pass a function for it. injecting
will call the constructor and return the instance the first time you inject. It will return the same instance for later use.
register the argument as dependency. automatically register as constant if the second argument is object|string|number, and register as service if the second argument is function.
invoke a function and automatically inject for its arguments. Expect to return a promise.
get a particular injection in promise form.
MIT
FAQs
a simple javascript dependency injection module
We found that injecting demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.