Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
js-file-downloader
Advanced tools
JS File Downloader is a simple no dependency library you will be able to download file from browser and show downloading status.
JS File Downloader supports all browsers that are [ES5-compliant] (http://kangax.github.io/compat-table/es5/) (IE8 and below are not supported).
With a package manager (recommended):
npm install js-file-downloader --save
import JsFileDownloader from 'js-file-downloader';
const fileUrl = 'http://...';
new JsFileDownloader({
url: fileUrl
})
.then(function () {
// Called when download ended
})
.catch(function (error) {
// Called when an error occurred
});
Download this library from https://github.com/AleeeKoi/js-file-downloader/releases
<script src="/path/to/js-file-downloader.min.js"></script>
<script>
// Then somewhere in your code
new jsFileDownloader({ url: 'https://cdn.apedesign.net/github/logo.png' })
.then(function () {
// Called when download ended
})
.catch(function (error) {
// Called when an error occurred
});
</script>
A function to call every time a process event is called. Function receive an Event Object as input.
function process (event) {
if (!event.lengthComputable) return; // guard
var downloadingPercentage = Math.floor(event.loaded / event.total * 100);
// what to do ...
};
new JsFileDownloader({
url: '...',
process: process
})
A function to call when a 'loadstart' event is triggered.
function onloadstart () {
// what to do ...
}
new JsFileDownloader({
url: '...',
onloadstart
})
If you need to customize request header data you can pass an array of objects like following example:
new JsFileDownloader({
url: '...',
headers: [
{ name: 'Authorization', value: 'Bearer ABC123...' }
]
})
Setting this String you can force output file name
Integer value (default 40000) defining how much ms attend before stop download action.
Boolean value (default true) to enable/disable automatically starting the download. When the value is true
the constructor returns a Promise
, however when it's set to false, the constructor doesn't return anything and the download can be started by calling the start()
method on the object.
Example with autoStart
set to true
new JsFileDownloader({
url: '...',
autoStart: true
})
Example with autoStart
set to false
const download = new JsFileDownloader({
url: '...',
autoStart: false
});
download.start()
.then(function(){
// success
})
.catch(function(error){
// handle errors
});
Boolean value (default false) to force desktop mode even on mobile devices for downloading files.
new JsFileDownloader({
url: '...',
forceDesktopMode: true
})
This is a Boolean that indicates whether or not cross-site Access-Control requests should be made using credentials such as cookies, authorization headers or TLS client certificates. Setting withCredentials has no effect on same-site requests.
new JsFileDownloader({
url: '...',
withCredentials: true
})
The HTTP request method to use, such as "GET", "POST", "PUT", etc. (default "GET") Ignored for non-HTTP(S) URLs.
new JsFileDownloader({
url: '...',
method: 'POST'
})
You could pass a callback to customize final name, the function receive as 1st argument the name automatically extracted.
new JsFileDownloader({
url: '...',
nameCallback: function(name) {
return 'i-am-prefix-' + name;
}
})
Setting this property you can customize the content type in the heade request, default is 'application/x-www-form-urlencoded' If you set this property as false, the library doesn't set it.
new JsFileDownloader({
url: '...',
contentType: 'multipart/form-data; boundary=something' // or false to unset it
})
By setting this property to true (default is false) when error occours the download will fallback to the default behavior opening a new tab.
new JsFileDownloader({
url: '...',
nativeFallbackOnError: true
})
By setting this property you can customize the body content sent with the request. Default value is null
(nothing is sent), Document
or BodyInit
value can be set.
new JsFileDownloader({
url: '...',
body: 'The body as a string'
})
By setting this property the downloader will determine the content type automatically depending on the value.
value | description |
---|---|
"header" | Gets type from content-type response header. |
"signature" | Analyzes the first 4 bytes of the returned file and will check if that signature exists in the predetermined dict (You can override/merge this dict with the customFileSigantures property). |
"full" | Uses both methods from above but prefers "siganture" . |
false | Type is not determined and the default is added, application/octet-stream . |
new JsFileDownloader({
url: '...',
contentTypeDetermination: 'header'
})
By setting this value you can override/merge the predefined signature dict (src/signatures.js
). The key represents the hex code of a file (for more information here) and the value should be in the format of a content type (e.g. application/pdf
). Setting this value has only an affect when contentTypeDetermination
is set to "full"
or "signature"
.
new JsFileDownloader({
url: '...',
contentTypeDetermination: 'full', // must be set to "full" or "signature"
customFileSignatures: {
'FFFB':'audio/mpeg',
'FFF3':'audio/mpeg',
'FFF2':'audio/mpeg',
'494433': 'audio/mpeg'
}
})
Copyright (c) 2019-present, Alessandro Pellizzari
FAQs
Small lib for a cool download experience
The npm package js-file-downloader receives a total of 26,411 weekly downloads. As such, js-file-downloader popularity was classified as popular.
We found that js-file-downloader demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.