Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
pimatic-iframe
Advanced tools
This is Pimatic plugin for iframes. You can develop, edit and contribute for this plugin by forking this plugin in github
Add the plugin to the plugin section:
{
"plugin": "iframe"
},
You have to add a iframe Device device into your config.json based on these example schema ready to copy paste. Please have a look at the Trouble Shooting section below if the content isn't displayed or reloaded properly.
{
"class": "iframeDevice",
"id" : "my_iframe",
"name": "My iframe",
"url": "http://www.pimatic.org",
"width": 340,
"unit": "px",
"height": 240,
"border": 1,
"scrolling": "yes",
"scale": 1,
"reload": 0,
"enforceReload": false
},
class : device class
id : should be your unique device id
name : name of your device
url : URL that will be displayed in the iframe
width : Width of iframe
unit: Unit of witdth specification (px, %)
height : Height of iframe
border : Show border around iframe (1 = yes, 0 = no)
scrolling : Show scrollbars in iframe (yes/no)
scale : Scaling factor of iframe content
reload : Reload cycle in seconds for iframe source. 0 = no reload
enforceReload : Add a pseudo URL param to make URL unique. This is to solve browser-caching issues
As part of rules you can use the following action:
Example:
If the iframe content is not displayed the reason maybe one of the following security restrictions:
Pimatic web page has been loaded via https while iframe source is http. This will give you an error message on the web console as shown below. Workaround: Either load pimatic page via http or load iframe src via https (if https is supported by the site).
Mixed Content: The page at 'https://localhost/' was loaded over HTTPS, but requested an insecure
resource 'http://www.pimatic.org'. This request has been blocked; the content must be served over HTTPS.
Sourced web site denies embedding. This is the case with google.com, for example. Workaround: Some sites offer additional resources which can be embedded, for example, this is the case for googlemaps. Otherwise, you can only circumvent the restriction by putting a rewriting http proxy into the communication path.
Refused to display 'https://www.google.de/?gfe_rd=cr&ei=7wgIVuiXCY6r8wfYkLnoDQ&gws_rd=ssl'
in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.
If the iframe content is not properly reloaded or updated this may be due to browser-caching issues:
enforceReload
property to true
. This will add a query
parameter with a timestamp for each reload cycle to make the requested URL unique. As a result the browser will
regard the given URL as a new resource and bypass the cache.0.0.1 : Initial release
0.0.2 : Adding border and scrolling options
0.0.3 : Adding scaling factor
0.0.4 : Adding reload
0.1.0 : Added better browser compatibility and load action provider.
0.1.1 : Fixing missing file issue #4
0.1.2 : Fixing infinity refresh on missing refresh value #6
0.1.3 : Fix for Pimatic 0.9
0.2.0 : enforeReload added. (Thx to @mwittig)
FAQs
Pimatic iframe plugin
We found that pimatic-iframe demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.