
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
(C) Rob Righter (@robrighter) 2009 - 2010, Licensed under the MIT-LICENSE Contributions from David Joham
node-xml is an xml parser for node.js written in javascript.
Node-xml provides a SAX2 parser interface that can take a string, file. The parser can take characters from the document in chunks. To send chunks of the document to the parser use 'parseString(xml)'
#SAX Parser#
##new xml.SaxParser()## * Instantiate a new SaxParser * returns: a SaxParser object
##new xml.SaxParser(callback)## * Instantiate a new SaxParser * returns: a SaxParser object * Arguments *callback - a function that accepts the new sax parser as an argument
#Parse#
##parser.parseString(string)##
Parse an in memory string
##parser.parseFile(filename)##
Parse a file
##parser.pause()## pauses parsing of the document
##parser.resume()## resumes parsing of the document
#Callbacks#
##parser.onStartDocument(function() {})##
Called at the start of a document
##parse.onEndDocument(function() {})##
Called at the end of the document parse
##parser.onStartElementNS(function(elem, attrs, prefix, uri, namespaces) {})##
Called on an open element tag
##parser.onEndElementNS(function(elem, prefix, uri) {})##
Called at the close of an element
##parser.onCharacters(function(chars) {})##
Called when a set of content characters is encountered
##parser.onCdata(function(cdata) {})##
Called when a CDATA is encountered
##parser.onComment(function(msg) {})##
Called when a comment is encountered
##parser.onWarning(function(msg) {})##
Called when a warning is encountered
##parser.onError(function(msg) {})##
Called when an error is encountered
var util = require('util');
var xml = require("./lib/node-xml");
var parser = new xml.SaxParser(function(cb) {
cb.onStartDocument(function() {
});
cb.onEndDocument(function() {
});
cb.onStartElementNS(function(elem, attrs, prefix, uri, namespaces) {
util.log("=> Started: " + elem + " uri="+uri +" (Attributes: " + JSON.stringify(attrs) + " )");
});
cb.onEndElementNS(function(elem, prefix, uri) {
util.log("<= End: " + elem + " uri="+uri + "\n");
parser.pause();// pause the parser
setTimeout(function (){parser.resume();}, 200); //resume the parser
});
cb.onCharacters(function(chars) {
//util.log('<CHARS>'+chars+"</CHARS>");
});
cb.onCdata(function(cdata) {
util.log('<CDATA>'+cdata+"</CDATA>");
});
cb.onComment(function(msg) {
util.log('<COMMENT>'+msg+"</COMMENT>");
});
cb.onWarning(function(msg) {
util.log('<WARNING>'+msg+"</WARNING>");
});
cb.onError(function(msg) {
util.log('<ERROR>'+JSON.stringify(msg)+"</ERROR>");
});
});
//example read from chunks
parser.parseString("<html><body>");
parser.parseString("<!-- This is the start");
parser.parseString(" and the end of a comment -->");
parser.parseString("and lots");
parser.parseString("and lots of text&am");
parser.parseString("p;some more.");
parser.parseString("<![CD");
parser.parseString("ATA[ this is");
parser.parseString(" cdata ]]>");
parser.parseString("</body");
parser.parseString("></html>");
//example read from file
parser.parseFile("sample.xml");
FAQs
An xml parser for node.js written in Javascript.
The npm package node-xml receives a total of 4,372 weekly downloads. As such, node-xml popularity was classified as popular.
We found that node-xml demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.