Security News
The Risks of Misguided Research in Supply Chain Security
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
pubit-as-promised
Advanced tools
Responsible publish/subscribe now enhanced with Q promise goodness! Hide the event publisher, only exposing the event emitter.
Responsible publish/subscribe. Hide the event publisher, only exposing the event emitter. Now with added Q promise goodness!
Most pub/sub frameworks conflate the role of publisher and emitter. This means that if someone gets ahold of your emitter object, they can not only subscribe to events, but also fake out all other subscribers by emitting an artificial event:
// server.js
process.on("exit", cleanupServerStuff);
// thirdParty.js
process.emit("exit");
// uh oh, now the server stuff's been all cleaned up!
With pubit-as-promised, the publisher and emitter are separate, allowing you to keep the publisher private while
exposing emitter functionality. Here's a hypothetical implementation of a process
module using pubit-as-promised,
including the use of the new Q promise return value of publish
:
var pubit = require("pubit-as-promised");
var publish = pubit.makeEmitter(exports);
exports.exit = function (exitCode) {
publish.when("exit", exitCode).done(function () {
window.close();
});
};
An example of a subscriber that returns a promise looks like this:
var process = require("./process");
process.on("exit", function () {
return sendLogsToCloudAsync();
});
This module only exports the emitter interface (on
, off
, and once
); the publish function is kept private.
There's some argument as to what role encapsulation has to play in JavaScript. Some might say, “if you don't want the event to be emitted outside the emitter … don't emit the event outside the emitter.”
But encapsulation isn't about being paranoid. It's about hiding complexity: exposing a solution, without requiring the consumer to grok the gory details of the problem. An emitter by itself is simple and easy to interface with, but when you add knobs for publishing or introspection, you're no longer solving a problem, but instead creating option paralysis and fragility. Someone should be able to understand that an object emits events, without worrying about who could be publishing those events in the first place.
Pubit-as-promised is ポカヨケ.
Sure. Why not? One of the deficiencies in the original pubit was the inability to return a value. It was a true publish only system. With pubit-as-promised you now have the ability for subscribers to asynchronously return values to the publisher. Think of the possibilities. Imagine a system where a publisher send out a lunch order and subscribers could return what they wanted to eat. The order would be places when all subscribers answered (i.e. fulfilled their promise).
Another example (show below) is a voting system. The publisher sends out a list of candidates, then waits for each vote to be fulfilled (again a promise). The publisher then tallies the votes and publishes the winner. The sample code is shown here:
// The publisher.
publish.when("vote", candidates).done(function(votes) {
var winner = tallyVotes(votes);
publish("winner", winner);
});
// Each subscriber.
voter.on("vote", function(candidates) {
var deferred = Q.defer();
voter.once("winner", displayWinner);
function onsubmit(myChoice) {
deferred.resolve(myChoice);
}
setupForm(onSubmit, candidates);
return deferred.promise;
});
npm test
if you'd like.FAQs
Responsible publish/subscribe now enhanced with Q promise goodness! Hide the event publisher, only exposing the event emitter.
The npm package pubit-as-promised receives a total of 1 weekly downloads. As such, pubit-as-promised popularity was classified as not popular.
We found that pubit-as-promised demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.