
Research
Security News
Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
post-robot
Advanced tools
Post-messaging on the client side using a simple server/client pattern.
Use this if you want to communicate between two different windows (or popups, or iframes) using window.postMessage
,
but you don't like the fire-and-forget nature of window.postMessage
(which doesn't tell you if your message got through, if there was an error, and isn't fully supported in even the latest versions of IE for window to window communication).
With this module, you can set up a listener in one window, have it wait for a post message, and then have it reply with data, all while gracefully handling any errors that crop up.
This also allows cross-domain post messages between two different windows (not just popups) in IE9+.
postRobot.on('getCart', function(data, callback) {
return callback({
foo: 'bar'
});
});
postRobot.send(window, 'getCart', function(err, data) {
console.log(data);
});
postRobot.once('init', function(source, data, callback) {
...
});
postRobot.on('init', { window: window.parent }, function(source, data, callback) {
...
});
postRobot.send(window, 'getCart', { timeout: 5000 }, function(err, data) {
console.log(data);
});
postRobot.sendToParent('getCart', function(err, data) {
console.log(data);
});
All of the above can be done with promises rather than callbacks
postRobot.on('getCart', function(source, data) {
return getFoo(data).then(function(bar) {
return {
bar: bar
};
});
});
postRobot.once('getCart').then(function(data) {
...
}).catch(function(err) {
...
});
postRobot.send(window, 'getCart').then(function(data) {
...
}).catch(function(err) {
...
});
postRobot.on('getCart', async function(source, data) {
return {
bar: await bar
};
});
try {
let data = await postRobot.once('getCart');
} catch (err) {
...
}
try {
let data = await postRobot.send(window, 'getCart');
} catch (err) {
...
}
Post robot lets you send across functions in your data payload, fairly seamlessly.
For example:
// Window 1:
postRobot.on('getFoo', function(source, data) {
return {
bar: function() {
console.log('foobar!');
}
};
});
// Window 2:
postRobot.send(myWindow, 'getFoo').then(function(source, data) {
data.bar();
});
The function data.bar()
will be called on the original window.
Because this uses post-messaging behind the scenes and is therefore always async, data.bar()
will always return a promise, and must be .then
'd or await
ed.
In order to use post-robot in IE9+ between two different windows on different domains (like a parent window and a popup) you will need to set up an invisible bridge in an iframe on your parent page:
+---------------------+
| Parent xx.com |
| | +--------------+
| +---------------+ | | Popup yy.com |
| | Bridge yy.com | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | +--------------+
| +---------------+ |
| |
+---------------------+
Supporting IE9+ in your app is pretty simple:
a. Create a bridge path, for example http://yy.com/bridge.html
, and include post-robot:
<script src="http://xx.com/js/post-robot.js"></script>
b. In the parent page, xx.com
, include the following javascript:
<script>
postRobot.openBridge('http://yy.com/bridge.html');
</script>
Now Parent xx.com
and Popup yy.com
can communicate freely using post-robot in IE.
This can even be done in reverse -- for example, Popup yy.com
can include Bridge xx.com
if that suits your use cases better.
24 September 2016
83064db
677726c
25d7bbc
38cc826
9eedeb8
5f499db
FAQs
Simple postMessage based server.
The npm package post-robot receives a total of 49,701 weekly downloads. As such, post-robot popularity was classified as popular.
We found that post-robot demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.
Security News
Newly introduced telemetry in devenv 1.4 sparked a backlash over privacy concerns, leading to the removal of its AI-powered feature after strong community pushback.