
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
node-microsvc-lib
Advanced tools
npm install node-microsvc-lib --save
Creating a microservice app:
app.ts
"use strict";
import {Microservice, ConsoleLogger} from "node-microsvc-lib";
// factories/modules
import {RequestLogger} from "./factories/request_logger";
import {HealthCheck} from "./factories/health_check";
import {TestRestCtrl} from "./factories/rest_service";
// configs
import configs = require("./config/config");
const logger = new ConsoleLogger();
// create microservice appv
const app = new Microservice(configs, logger);
app.register_dependency("logger", logger);
app.register_factory("request_logger", RequestLogger);
app.register_factory("test_rest_ctrl", TestRestCtrl);
app.register_factory("health_check", HealthCheck);
process.on("uncaughtException", (err:Error)=>{
logger.fatal(err);
});
app.init().catch((err) => {
return logger.error(err);
}).then(()=> {
logger.info("APP STARTED");
});
The Microservice instance expects a ServiceConfigs instance.
This ServiceConfigs instance requires the base dir __dirname
, an instance of AppBaseConfigs and an (optional) instance of IConfigsProvider.
Three sets of configuration values exist:
This is the object that the Microservice requires to source all its runtime configurations.
Optional instance that fetches all config values from an external service such as consul or hashicorp vault.
The order of loading:
In summary, env vars always win (if defined).
src/config/config.ts (main config object)
src/config/param.ts (default params definition)
config/config.ts
"use strict";
import {ServiceConfigs, AppBaseConfigs} from "node-microsvc-lib";
let app_base_confs = new AppBaseConfigs();
app_base_confs.env = process.env.APP_ENV || 'dev_local';
app_base_confs.solution_name = "my_solution";
app_base_confs.app_name = "my_app";
app_base_confs.app_version = "0.0.1";
app_base_confs.app_api_prefix = "";
app_base_confs.app_api_version = "1";
export = new ServiceConfigs(__dirname, app_base_confs, null);
config/params.ts
"use strict";
import {ParamTypes, ServiceParams} from "node-microsvc-lib";
let params = new ServiceParams();
params.add_param(
"test_param",
ParamTypes.STRING,
"default_val",
"test param to be overridden by env_var"
);
params.add_feature_flag(
"RUN_EXPRESS_APP",
true,
"start the express application"
);
params.add_secret(
"secret1",
null, // secrets should be loaded from an IServiceProvider or a non-github-tracked per env override file
"db password example"
);
export = params;
config/overrides.stage.ts (optional file see step 2 above - where "stage" comes from APP_ENV)
"use strict";
import {ServiceParams} from "node-microsvc-lib";
module.exports = function(configs:ServiceConfigs){
// override params, feature_flags or secrets values'
configs.override_param_value("kafka_conn_string", "stage:9092");
};
NVM - Node Version Manager - https://github.com/creationix/nvm
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.35.3/install.sh | bash
After NVM is installed, go to the proect directory and execute this to download and install the correct node version:
nvm install -s
FAQs
NodeJS microservice framework library
The npm package node-microsvc-lib receives a total of 59 weekly downloads. As such, node-microsvc-lib popularity was classified as not popular.
We found that node-microsvc-lib demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.