
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
ShareDB is a realtime database backend based on Operational Transformation (OT) of JSON documents. It is the realtime backend for the DerbyJS web application framework.
For questions, discussion and announcements, join the ShareJS mailing list.
Please report any bugs you find to the issue tracker.
var ShareDB = require('sharedb');
var db = require('sharedb-mongo')('localhost:27017/test');
var backend = ShareDB({db: db});
var connection = backend.connect();
// Subscribe to any database query
var query = connection.createSubscribeQuery('users', {accountId: 'acme'});
query.once('ready', function() {
// Initially matching documents
console.log(query.results);
});
query.on('insert', function(docs, index) {
// Documents that now match the query
console.log(docs);
});
query.on('remove', function(docs, index) {
// Documents that no longer match the query
console.log(docs);
});
query.on('move', function(docs, from, to) {
// Documents that were moved in the results order for sorted queries
console.log(docs);
});
// Create and modify documents with synchronously applied operations
var doc = connection.get('users', 'jane');
doc.create({accountId: 'acme', name: 'Jane'});
doc.submitOp({p: ['email'], oi: 'jane@example.com'});
// Create multiple concurrent connections to the same document for
// collaborative editing by multiple clients
var connection2 = backend.connect();
var doc2 = connection2.get('users', 'jane');
// Subscribe to documents directly as well as through queries
doc2.subscribe(function(err) {
// Current document data
console.log(doc2.data);
});
doc2.on('op', function(op, source) {
// Op that changed the document
console.log(op);
// truthy if submitted locally and `false` if from another client
console.log(source);
});
In ShareDB's view of the world, every document has 3 properties:
null
.ShareDB implicitly has a record for every document you can access. New documents have version 0, a null type and no data. To use a document, you must first submit a create operation, which will set the document's type and give it initial data. Then you can submit editing operations on the document (using OT). Finally you can delete the document with a delete operation. By default, ShareDB stores all operations forever - nothing is truly deleted.
See https://github.com/ottypes/json0 for documentation of the supported operations.
FAQs
JSON OT database backend
The npm package k-sync receives a total of 11 weekly downloads. As such, k-sync popularity was classified as not popular.
We found that k-sync demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.