
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
j-queue-sdk-web
Advanced tools
A TypeScript package to check WebSocket connection status and control web access with a popup
A TypeScript package for managing WebSocket connections and controlling web access by displaying a customizable full-screen popup when users are in a queue. It integrates with a WebSocket server to handle queue status updates and navigation restrictions.
Install the package via npm:
npm install j-queue-sdk-web
Ensure you have the Socket.IO client included in your project:
npm install socket.io-client
For browser environments, include the Socket.IO client script:
<script src="https://cdn.socket.io/4.7.5/socket.io.min.js"></script>
import ConnectionJQueueSdkWeb from 'j-queue-sdk-web';
const connection = ConnectionJQueueSdkWeb.init({
url: 'wss://queue-server.example.com',
option: { storageKey: 'jqueue_uuid' }, // UUID will be stored with this key
socketConfig: {
transports: ['websocket'],
reconnectionAttempts: 3,
reconnectionDelay: 1000,
query: {
app_id: 'XXXXX',
service_name: 'NEWS',
ip_address: 'IP_ADDRESS_CLIENT',
},
},
popupConfig: {
language: 'en', // or 'ko' for Korean
textColor: '#276bff', // Text color for the popup
loaderGradientStart: '#276bff', // Starting color of the loader gradient
loaderGradientEnd: 'rgba(39,107,255,0.05)', // Ending color of the loader gradient
},
pollInterval: 2000,
});
// Disconnect when done
connection.disconnect();
Or, in a browser environment:
<script src="https://cdn.socket.io/4.7.5/socket.io.min.js"></script>
<script src="https://unpkg.com/j-queue-sdk-web@<version>/dist/j-queue-sdk-web.js"></script>
<script>
try {
// Handle default export
const JQueueSdk = window.ConnectionJQueueSdkWeb.default || window.ConnectionJQueueSdkWeb;
const connection = JQueueSdk.init({
url: 'wss://queue-server.example.com', // Use wss:// for WebSocket
option: { storageKey: 'queue_token' },
popupConfig: {
language: 'en', // 'en' or 'ko'
textColor: '#276bff',
loaderGradientStart: '#276bff',
loaderGradientEnd: 'rgba(39,107,255,0.05)',
},
socketConfig: {
transports: ['websocket'],
reconnectionAttempts: 3,
reconnectionDelay: 1000,
query: {
app_id: 'XXXXX',
service_name: 'NEWS',
ip_address: 'IP_ADDRESS_CLIENT', // Replace with actual IP
},
},
customEvents: {
disconnect: (data, utils) => {
const queue_token = sessionStorage.getItem('queue_token') || '';
if (queue_token) {
const beaconData = JSON.stringify({
uuid: queue_token,
app_id: 'XXXXX',
service_name: 'NEWS',
});
const blob = new Blob([beaconData], { type: 'application/json' });
navigator.sendBeacon('https://example.com/log-disconnect', blob);
}
},
'online-queue:status': (data, utils) => {
console.log('Queue status:', data);
},
},
});
// Clean up on page unload
window.addEventListener('beforeunload', () => {
connection.disconnect();
});
} catch (error) {
console.error('Error initializing j-queue-sdk-web:', error);
}
</script>
socket.io-client@4.7.5
before j-queue-sdk-web
.ConnectionJQueueSdkWeb
as ConnectionJQueueSdkWeb.default
. The code handles both cases.onerror
on the script tag and try-catch to handle errors.navigator.sendBeacon
URL (https://example.com/log-disconnect
) to your actual endpoint.To use j-queue-sdk-web
in a React application, initialize the WebSocket connection in a component using the useEffect
hook to manage the connection lifecycle. Below is an example:
npm install j-queue-sdk-web socket.io-client
import { useEffect, useState } from 'react';
import ConnectionJQueueSdkWeb from 'j-queue-sdk-web';
const WebSocketComponent = () => {
useEffect(() => {
const connection = ConnectionJQueueSdkWeb.init({
url: 'wss://queue-server.example.com',
option: { storageKey: 'jqueue_uuid' }, // UUID will be stored with this key
socketConfig: {
transports: ['websocket'],
reconnectionAttempts: 3,
reconnectionDelay: 1000,
query: {
app_id: 'XXXXX',
service_name: 'NEWS',
ip_address: 'IP_ADDRESS_CLIENT',
},
},
popupConfig: {
language: 'en', // en | ko,
textColor: '#276bff', // Text color for the popup
loaderGradientStart: '#276bff', // Starting color of the loader gradient
loaderGradientEnd: 'rgba(39,107,255,0.05)', // Ending color of the loader gradient
},
});
return () => {
connection.disconnect();
};
}, []);
return <></>;
};
export default WebSocketComponent;
import WebSocketComponent from './WebSocketComponent';
function App() {
return (
<div>
<h1>My React App</h1>
<WebSocketComponent />
</div>
);
}
export default App;
useEffect
hook ensures the WebSocket connection is initialized on mount and disconnected on unmount, preventing memory leaks.popupConfig
and customEvents
to match your application's UI and requirements.online-queue:status
event with the data format { data: { uuid: string, position: number, status: number } }
.url
(string, required): WebSocket server URL (e.g., wss://queue-server.example.com
).option
(object, optional): Additional configuration options for the SDK.
storageKey
(string): The key used to store the UUID in localStorage
for persisting queue session data (e.g., 'jqueue_uuid'
). This allows the SDK to retrieve the UUID across page reloads or sessions, ensuring continuity in queue tracking.socketConfig
(object, optional): Socket.IO configuration options.
transports
(string[]): Transport methods (default: ['websocket']
).reconnectionAttempts
(number): Number of reconnection attempts (default: 3
).reconnectionDelay
(number): Delay between reconnection attempts in milliseconds (default: 1000
).query
(object): Additional query parameters sent to the server (e.g., { app_id: 'XXXXX', service_name: 'NEWS' }
).popupConfig
(object, optional):
language
('en' | 'ko'): Language for default popup content (default: 'ko'
).style
(string): Custom CSS for the popup.content
(string | (position: number) => string): Custom HTML content for the popup, either as a static string or a function that takes position
and returns HTML.textColor
(string): Color for the popup text (e.g., '#276bff'
). Overrides the default text color.loaderGradientStart
(string): Starting color of the loader gradient (e.g., '#276bff'
). Defines the initial color of the loading animation.loaderGradientEnd
(string): Ending color of the loader gradient (e.g., 'rgba(39,107,255,0.05)'
). Defines the final color of the loading animation.customEvents
(object, optional): Key-value pairs where the key is the event name and the value is a handler function. The handler receives event data
and utilities { createPopup, removePopup, preventNavigation, allowNavigation }
.pollInterval
(number, optional): Interval for polling queue status in milliseconds (default: 2000
).{ data: { uuid: string, position: number, status: number } }
from the server via the online-queue:status
event.status === 2
(ACTIVE), removes the popup and allows navigation.status === 1
(WAITING), displays a customizable full-screen popup with the queue position
and prevents navigation.customEvents
.createPopup
, removePopup
, preventNavigation
, allowNavigation
) for custom event handlers.Compile TypeScript and bundle the package using Webpack:
npm run build
This generates dist/j-queue-sdk-web.js
.
Run tests using Jest in a jsdom environment:
npm test
Tests are located in the tests
directory and cover initialization, event handling, and disconnection logic.
The default popup content uses direct HTML injection (innerHTML
). For production use, consider integrating a library like DOMPurify
to sanitize HTML and prevent XSS attacks.
MIT
FAQs
A TypeScript package to check WebSocket connection status and control web access with a popup
The npm package j-queue-sdk-web receives a total of 1 weekly downloads. As such, j-queue-sdk-web popularity was classified as not popular.
We found that j-queue-sdk-web demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.