
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
node-cloudfs-drive
Advanced tools
Library implementing Promises to make working with Google drive more like working with a local fs (paths, folders, files, and standard operations.) Other cloud services to come as I have time or others contribute. Please see the CONTRIBUTE.md file.
This project wouldn't exist if not for https://github.com/mhdawson/google-drive-wrapper. I did fork initially, but so much changed so quickly that I decided a PR made no sense and this was to live on as its own project. Thanks to Michael Dawson for giving me a kick-off point with this.
Please see CONTRIBUTING.md
The Google Drive constructor requires:
Caching is provided by node-cache and reduces API calls substancially for getMetaForFilename as well as making things almost instant compared to external API calls, much as a reverse proxy between this and the API would. See options in code below if you'd like to tweak the cache timeout values.
Throttling is provided by promise-ratelimit. This helps cope with bursty jobs at the expense of latency, but is required to deal with API limits. Keep in mind that running multiple instances of this module (clustering) will multiple the rate of hits on the API.
npm install node-cloudfs-drive --save
let { google } = require('googleapis'),
ncfsOptions = {
throttle: 2000,
cacheTTL: 60 * 60 * 24,
cacheCheckperiod: 60 * 60,
pageSize: 20,
backoff: {
retries: 3,
factor: 3
}
}; // These are the present defaults
//I suggest using someone elses's token generator until mine is at least 1.0.0, but it does work for testing
require('oauth-token-generator-google')( googleAuthCredentialsPath ).then( auth => {
let drive = require('node-cloudfs-drive').Drive( auth, google, ncfsOptions );
// drive will expose this projects helper methods as well as the actual the googleapis drive object
drive.mkdir( testFolderA )
.then( folder => {
// Your Google Drive folder object
})
.catch(err => {
console.error(err);
});
})
.catch(err => {
console.error(err);
});
Overview: https://developers.google.com/identity/protocols/OAuth2
After 3 attempts with node.js and Googel APIs, I decided to learn oauth a bit more and ended up writing my own library to manage the tokens for me. A big part of this was just my ignorance and lack of explanations that worked for me (turns out that the Google API version used in various samples/projects was a big factor here). Given my experience and the tutorials out there which can provide more detail, I won't get into a lot of detail but I do want to summarize what I've learned in recent history. Following other tutorials on the web, you will want to generate a client_secret.json file which Google will provide for you to download from the Google Developer console https://developers.google.com/identity/protocols/OAuth2. If you use the same oauth library this projects test suite does, you will place that client_secret.json file in a folder called private at the root of this/your project, and you reference that file when you instantiate the oauth client. The library will attempt to use this client_secret.json file to retrieve tokens from Google which will then be saved next to the .json file with the same name, but .token extension and used in future constructor calls and to renew tokens. This library will not only help you create that token, but will look for it and attempt to use it when it is available. This library takes a novel approach to retrieving the initial token by prompting you in a node/webkit development console with a URL to visit and asking you to bring the code from that URL back to the console, then assign it to an object before resuming the debugger (directions are provided on the console in this mode). To that end, you can use the commands npm run dev
or npm test:dev
to run this library and connect with the console so that you can provide the code needed to retrieve a token. This manual process only needs to be done to retrieve the initial token so it is more of a utility in that respect. Once you have the token you can use that file in other projects by moving it (can't use it in many places at typically). More discussion about tokens is out of the scope of this document.
FAQs
Wrapper to simplify interaction with google drive apis
The npm package node-cloudfs-drive receives a total of 4 weekly downloads. As such, node-cloudfs-drive popularity was classified as not popular.
We found that node-cloudfs-drive demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.