
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
react-one-tab-enforcer
Advanced tools
Prevent users from opening your react app in multiple tabs
Sometimes your application should make it difficult for users to open your app in multiple tabs. With two tabs you could get your app in one state in one tab, which would not be reflected in the other one. Then making some actions in the first one could result in corrupted state on a backend. Obviously, you should prevent any data corruption in your backend, but if your application requires this extra safety-check, go ahead and use it. :-)
What this package do is - it marks the first tab with the application as the "valid" one for 15 seconds. Then every 10 seconds it updates this information for another 15 seconds.
If you cleanly close the browser/tab, it clears that information, so you can reopen the app in the new tab right away. If the close is not clean (think: desktop with a sudden power loss), after 15 seconds you are good again.
If your app is opened in a different tab within those 15 seconds, it will display a different component with an error message.
npm install --save react-one-tab-enforcer
export default App
to
import { withOneTabEnforcer } from "react-one-tab-enforcer"
(..)
export default withOneTabEnforcer()(App)
This will work, and display a default "Sorry! You can only have this application opened in one tab" message in place of the App component.
!IMPORTANT! To make sure we won't collide with other apps that use the same package, we should set a unique app name as an option:
export default withOneTabEnforcer({appName: "my-unique-app-name"})(App)
Those are the arguments (and their defaults) you can pass as a second argument to the withOneTabEnforcer
appName = "default-app-name", // This one you know already - has to be unique!
OnlyOneTabComponent = DefaultOnlyOneTabComponent, // Component showed in place of the requested one.
localStorageTimeout = 15 * 1000, // (15 seconds) In case that the component will not succeeded clearing the localStorage on closing (desktop PC and a sudden power loss), this is the maximum time your user will have to wait to open your app again in the same browser on the same computer.
localStorageResetInterval = 10 * 1000, // (10 seconds) this is how often the above timeout is reset
For example, if you want to use a custom component that shows up when the user tries to open your app in a new tab, do:
const DifferentWarningComponent = () => <div>NO WAY!</div>
export default withOneTabEnforcer({appName: "my-unique-app-name", OnlyOneTabComponent: DifferentWarningComponent})(App)
This package is closely based on a code from this jsfiddle by timkellypa . and this jquery demo. It was packaged for seemless react usage with a bit of a tweaking and made configurable. Unfortunatelly, the code from timkellypa didn't work correctly with chrome "duplicate" functionality.
Tests.. This was needed "for yesterday", so I took a few shortcuts (including reusing a smart code from timkellypa and the demo above!) and verified manually! Sorry folks. I do have an idea how to test this, and if time allows, I will. Otherwise, I'm happy to take PRs! :-) CircleCI is all setup for a test-driven workflow.
FAQs
Prevent users from opening your react app in multiple tabs
The npm package react-one-tab-enforcer receives a total of 818 weekly downloads. As such, react-one-tab-enforcer popularity was classified as not popular.
We found that react-one-tab-enforcer demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.