
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
kth-node-express-routing
Advanced tools
Define named routes using express routing syntax. Allows exporting route defs javascript object
This is a wrapper for express route to allow generating named path files for app routes. It is used på KTH node-web projects to pass urls to browser clients.
PageRouter allows us to register page style routes that are registered in the path definition files.
Usage:
const AppRouter = require('kth-node-express-routing').PageRouter
const getPaths = require('kth-node-express-routing').getPaths
const server = require('express')()
const systemRoute = AppRouter()
systemRoute.get('system.monitor', '/_monitor', function (req, res) { ... })
server.use('/', systemRoute.getRouter())
const appRoute = AppRouter()
appRoute.get('app.index', '/', function (req, res) { ... })
server.use('/', appRoute.getRouter())
const paths = getPaths()
/*
paths = {
system: {
monitor: {
uri: '/_monitor',
method: 'get
}
},
app: {
index: {
uri: '/',
method: 'get
}
}
}
*/
ApiRouter allows us to register api endpoints by passing api endpoint definition objects from the paths file. It will set req.scope and add the authByApiKey middleware passed to ApiRouter IF the apiDefObj passed below evaluates apikey.scope_required == true
Usage in your node-api app:
// Middleware to protect enpoints with apiKey
const authByApiKey = passport.authenticate('apikey', { session: false })
const ApiRouter = require('kth-node-express-routing').ApiRouter
const apiRoute = ApiRouter(authByApiKey)
const apiDefObj = {
uri: "/api/node/data/:id/api/node/v1",
method: "GET",
apikey: {
scope_required: true,
scopes: ["read"],
type: "api_key"
}
}
// A middleware adding the access scope requriements (req.scope) and the authByApiKey is automatically
// prepended to the middleware pipeline
apiRoute.register(apiDefObj, function (req, res) { ... })
FAQs
Define named routes using express routing syntax. Allows exporting route defs javascript object
We found that kth-node-express-routing demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 8 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.