Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
A customizable and fool proof javascript function for object deep cloning
omniclone(source, config);
Example:
const obj = { foo: { bar: 'baz' } };
const obj2 = omniclone(obj);
obj2; // { foo: { bar: 'baz' } };
obj == obj2; // false
$ npm install --save omniclone
const omniclone = require('omniclone');
import omniclone from 'omniclone';
[[Prototype]]
object between source and the resulting object (customizable behavior)invokeConstructors
flagis setted)If you need to invoke the objects constructors for each object prop set the invokeConstructors
flag to true
:
const res = omniclone(source, {
invokeConstructors: true
});
This option will correctly set up the new object, because constructors are invoked to create it. The resulting object and each of its object property therefore will have the [[Prototype]]
and the constructor
props correctly setted up, corresponding to the source object and its object properties for everyone.
class Test {
constructor() {
console.log('constructor invoked');
}
};
const t = new Test(); // 'constructor invoked'
t.foo = new Test(); // 'constructor invoked'
t; // Test { t: Test {} }
const res = omniclone(t, {
invokeConstructors: true
}); // 'constructor invoked' 'constructor invoked'
res; // Test { t: Test {} }
res instanceof Test; // true
res.foo instanceof Test; // true
It is actually a default enabled setting, but you can disable it (loosing the ability to properly copy arrays).
If the invokeConstructors
flag is setted to false
, a plain new object will be created for each object prop and for the resulting object as well. So the constructor
prop will be set to the Object
function, and the [[Prototype]]
prop will be Object.prototype
.
Unless you use the setPrototype
flag.
If the invokeConstructors
flag is setted to false
we could anyway share the [[Prototype]]
object between the source object and the resulting object thanks to the setPrototype
flag, without calling the constructors.
This means that the constructor
prop will be shared as well because it is related to the [[Prototype]]
prop.
This flag affects all the object properties as weel, like the previous flag.
If the invokeConstructors
flag is setted to true
, the setPrototype
flag will be is ignored.
const res = omniclone(source, {
invokeConstructors: false,
setPrototype: true
});
The resulting object therefore will have the [[Prototype]]
and the constructor
props correctly setted up, but the constructors are not invoked.
class Test {
constructor() {
console.log('constructor invoked');
}
};
const t = new Test(); // 'constructor invoked'
t.foo = new Test(); // 'constructor invoked'
t; // Test { t: Test {} }
const res = omniclone(t, {
invokeConstructors: false,
setPrototype: true
});
res; // Test { t: Test {} }
res instanceof Test; // true
res.foo instanceof Test; // true
Enable it to deep copy also non enumerables properties.
Disable it to ignore them.
const res = omniclone(source, {
copyNonEnumerables: true
});
Enable it to deep copy also symbol properties.
Disable it to ignore them.
Symbols are shallow copied;
const res = omniclone(source, {
copySymbols: true
});
Enable it to copy also getters and setters.
Disable it to ignore them.
const res = omniclone(source, {
copyGettersSetters: true
});
Odds are that to properly copy gets&setts you have also to enable the copyNonEnumerables
flag.
Enable it to allow circular references.
Disable it to throw an error if one is met.
const res = omniclone(source, {
allowCircularReferences: true
});
The default config is the following:
omniclone(source, {
invokeConstructors : true,
setPrototype : false,
copyNonEnumerables : false,
copySymbols : false,
copyGettersSetters : false,
allowCircularReferences: false,
});
To understand it, let's compare the function omniclone
with the well-know JSON.parse(JSON.stringify(source))
:
const obj = { foo: 'bar'};
const source = {
a: obj,
b: obj,
};
JSON.stringify(source); // '{"a":{"foo":"bar"},"b":{"foo":"bar"}}'
When you will use JSON.parse()
, an {"foo":"bar"}
object will be created for the a
prop and a {"foo":"bar"}
distinct object will be created for the b
prop. But this is not the initial situation where source.a == source.b; // true
.
super
is statically bound to a class heirarchy, remember itError
objects cannot be properly copied because of js limitationsProxy
nor is possible to access the handler object. Because of transparent virtualization, omniclone
will copy each properties, the constructor
and the [[Prototype]]
directly from the proxed object.FAQs
deep cloning function for js objects
The npm package omniclone receives a total of 82 weekly downloads. As such, omniclone popularity was classified as not popular.
We found that omniclone demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.