
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Work in progress!
m4 is a pure Javascript implementation of an m4 macro language processor. You can use it with Node.js or in the browser, via browserify. It is exposed as a transformation Stream. As such, you can easily pipe from any input and to any output.
A command-line version is also provided, usable as a drop-in replacement for a native version (such as GNU M4).
npm install m4
If installed locally, the binary is available as node_module/.bin/m4
. You
can directly refer to m4
in
npm-scripts.
echo "define(\`beep', \`boop')dnl\nbeep\n" | m4
#=> boop
// example.js
'use strict';
var M4 = require('m4');
var input = new M4();
input.pipe(M4()).pipe(process.stdout);
input.write("define(`beep', `boop')dnl\nbeep\n");
input.end();
Then, in a shell:
node example.js
#=> boop
Inherit stream.Transform. As such this is a duplex stream you can pipe, write and read.
opts
Object Options:
nestingLimit
Number Maximum nested macro calls. Beware, this
does not prevent endless rescanning loops.Signal a non-recuperable error. The stream will not produce further output in the case of an error.
Signal a warning. The steam continues to produce output normally, but there may be some unwanted behavior.
name
String Identifier.fn
Fonction Called with (name, [arg1, arg2 ... ])
, must return the
macro expansion result as a string. name
is the macro defined name itself.str
String Macro content, just like you were defining the macro in M4.Define a M4 macro as a Javascript function.
index
Number Diversion index.Change how the output is processed. If the index is zero, output is directly emitted by the stream. If the index is a positive integer, the output is stored in an internal buffer — a "diversion" — instead.
diversions
Number Diversion indices.Output the content of the specified diversions. They are emptied. If no diversion is specified, all of them are undiverted, in numerical order.
Put the stream into a special mode where all the tokens are ignored until the next newline.
left
String Characters delimiting the beginning of a string.right
String Characters delimiting the end of a string.Delimiters can be of any length.
FAQs
M4 macro processor in pure Javascript
The npm package m4 receives a total of 3 weekly downloads. As such, m4 popularity was classified as not popular.
We found that m4 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.