
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
promise-wtf
Advanced tools
Lightweight Promise implementation with the "finally" method
Native Promise in ECMAScript 2015 came without "finally" while this method is really useful in many cases.
For an instance, let's start with the following script:
var Article = require('../models/Article');
export var home = (req, res) => {
let query = req.query || {};
let skip = query.skip || 0;
let limit = query.limit || 10;
let data = {
error: 0,
entries: []
};
I don't think that's good to write something like this:
return Article.list(skip, limit).then((result) => {
data.entries = result;
res.render('landing', data);
}).catch((err) => {
data.error = err;
res.render('landing', data);
});
};
However, it's better to have "finally" there:
return Article.list(skip, limit).then((result) => {
data.entries = result;
}).catch((err) => {
data.error = err;
}).finally(() => {
res.render('landing', data);
});
};
Unfortunately, "finally" is only available in some libraries such as Bluebird, or Q+, those are quite heavy to load for client side usage. What I need is just a basic prototype, a simple polyfill with "finally" implemented.
This variant inherits the native Promise object's prototype if any. Otherwise, it provides Promise constructor and 3 static methods:
In addition, there is also Promise.series method that works as same as async.series but follows Promise style, for example:
var Promise = require('promise-wtf');
Promise.series([
(next) => {
setTimeout(next, 300);
},
(next) => {
setTimeout(next, 100);
},
(next) => {
setTimeout(next, 500);
},
(next) => {
setTimeout(next, 2000);
},
(next) => {
setTimeout(next, 1000);
}
]).then(() => {
console.log('Promise.series: then');
}).catch((err) => {
console.log('Promise.series: catch');
console.log(err);
}).finally(() => {
console.log('Promise.series: finally');
});
Node.js
npm install promise-wtf
CDN
Also supports ES6 Module, CommonJS, AMD and UMD style.
git clone https://github.com/ndaidong/promise-wtf.git
cd promise-wtf
npm install
npm test
// run Promises/A+ Compliance Test Suite
npm run aplus
The MIT License (MIT)
FAQs
Lightweight Promise implementation with the 'finally' method
The npm package promise-wtf receives a total of 1,239 weekly downloads. As such, promise-wtf popularity was classified as popular.
We found that promise-wtf demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.