Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
koa2-router
Advanced tools
An express-liked router component for koa2
You can follow the instructions below to setup a router component in koa@2 environment.
npm install koa2-router
const Router = require('koa2-router');
const router = new Router(opts);
const app = new Koa();
app.use(router);
const router2 = new Router();
router2.use(...);
router.use('/users', router2);
router2.get('/:userId', ctx => ctx.body = `hello user ${ctx.params.userId}`);
const router3 = Router();
router3.params('userName', (ctx, next, userName, key) => (ctx[key] = userName, next()))
.get('/:userName', async ctx => ctx.body = await ctx.db.getStaffFromName(ctx.userName));
router.use('/staff', router3);
const route = router3.route('/:id');
route
.get(async ctx => ctx.body = await ctx.db.getStaffFromId(ctx.params.id));
route
.all(async (ctx, next) => {
if (ctx.authenticate.userId === ctx.params.id) return next();
else throw 'route'; // exit this route without any exception
})
.put(async ctx => ctx.body = await ctx.db.updateStaff(ctx.params.id, ctx.request.body))
.del(async ctx => ctx.body = await ctx.db.deleteStaff(ctx.params.id));
route3.use('/admin', (ctx, next) => {
if (ctx.authenticate.userRoles.includes('admin')) return next();
else throw 'router'; // exit this router3 without any exception
})
.post('/posts', async ctx => ctx.body = await ctx.db.createPost(ctx.request.body, ctx.authenticate.userId));
router.use('/api', router3, router3.allowMethods(opts))
opts
the allowMethods options
opts.throw
[boolean] default false, set to true to throw errors
opts.methodNotAllowed
[function(ctx, methods)] set if throw a custom 405 error
opts.notImplemented
[function(ctx)] set if throw a custom 501 error
In this module, router is a specific function instance which can be constructed via router = new Router(opts)
or router = Router(opts)
, and can be directly used as a Koa.Middleware
function - app.use(router)
.
We create a router model called Express Liked Router Model. The router constructed via this mechanism, implements everything that express.Router
also dose, like Router.use()
, Router[method|all]()
Router.params()
Router.route()
.
But there is an issue about that mode, how nested router stacks proceed for an asynchronized middleware system.
Nested routers are supported, but not behaves like in a single stack: enter -> enter -> enter <-> leave <- leave <- leave. Considering the entering and leaving order of the stack is relevant to the way they are mounted, we consulted and borrowed the algo from a Golang open source project gobwas/glob: within that a new Group
midleware is introduced, and it can make a branching stack. So we borrowed this design and setup new rules in nested routers in order to constraint excuting stack orders:
.use()
in which path can just be /
or *
, insert middlewares
to the original stackin
Router.use(middlewares)
,middlewares
are inserted into the parent's middlewares, thus when the last one invokesnext()
, it will continueenter
the next one of the parent router, until all things done, then it willleave
from the bottom to the top of the parent router's stack
[method]
.all
.route
or .use(path)
makes a branching stack of route nested in the parent stackin this situation, middlewares are handled via a mounted path or route if the one is matched both in path & route, calling
next
in the last middlewares of the nested router willleave
the mounted router stack from bottom to the top first, and then if nothing is responded before that, it enters the next middleware of the parent stack
Let's see an example
var router = new Router('A')
var nested = new Router('B')
router.use(async (ctx, next) => {
console.log('enter parent')
await next()
console.log('leave parent')
})
// use `.use so nested mw is bundled together with the parent`
router.use('/stuff', nested)
router.use(async (ctx, next) => {
console.log('prepare')
await next()
console.log('post')
})
router.use(ctx => {
console.log('output body')
ctx.body = 'success'
})
nested.use(async (ctx, next) => {
console.log('enter nested')
await next()
console.log('leave nested')
})
GET /stuff and watch the console
> enter parent
> enter nested
> leave nested
> prepare
> output body
> post
> leave parent
> HTTP/1.1 200 OK
> success
The order of entering/leaving differs between router and nested router. Because we make a branching stack nested in the router by mounting it to a path /stuff
, and it will leave the branching stack before go over the next. It is just like the Group
in the project gobwas/glob powered by golang
You should clone thie repository down to your file system, and execute
npm run test
FAQs
A express-liked router component for koa2
The npm package koa2-router receives a total of 11 weekly downloads. As such, koa2-router popularity was classified as not popular.
We found that koa2-router demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.