
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
run-callback
Advanced tools
Run async or sync callbacks, such as gulp tasks.
var run = require('run-callback')
var thunkify = run.thunkify
Run callback
with args
,
and return a promise to fetch the results,
which is always an Array
.
Type: Function
callback
can be made asynchronous if it does one of the following:
run(function () {
return new Promise(function (resolve) {
process.nextTick(function () {
resolve('done')
})
})
})
.then(function (res) {
// 'done'
console.log(res[0])
})
var Readable = require('stream').Readable
var src = ['beep', '\n', 'boop']
run(function () {
var stream = createStream(src)
stream.pipe(process.stdout)
return stream
})
.then(function () {
console.log('\n')
// `[]`
console.log(src)
})
function createStream(source) {
var rs = Readable()
rs._read = function () {
if (source.length) {
this.push(source.pop())
} else {
this.push(null)
}
}
return rs
}
run(function (a, b, next) {
process.nextTick(function () {
next(null, a + b, a - b)
})
}, 2, 1)
.then(function (res) {
// `[3, 1]`
console.log(res)
})
Return a new function to run fn
later with a list of arguments.
var task = run.thunkify(function (a, b, next) {
process.nextTick(function () {
next(null, a + b, a - b)
})
})
task(2, 1).then(function (res) {
// `[3, 1]`
console.log(res)
})
var runner = Runner(opts)
Create a custom Runner
instance to run callbacks.
By default, callbacks returning a stream is thought to be in progress before the stream ends.
However, if opts.stream
is false
,
callbacks returning a stream wil be treated as synchronous.
If opts.promise
is false
,
callbacks returning a promise will be treated as synchronous.
If opts.async
is false
,
callbacks can only be made asynchronous
by returning a promise (when opts.promise
is true
),
or returning a stream (when opts.stream
is true
).
var Stream = require('stream')
var Readable = Stream.Readable
var Writable = Stream.Writable
;(function handleStream() {
var runner = require('..').Runner({ stream: true })
var outputs = []
var rs = createReadable([1, 2])
return runner.thunkify(function () {
setTimeout(function() {
var ws = createWritable(outputs)
rs.pipe(ws)
}, 0)
return rs
})().then(function (res) {
// []
console.log(res)
})
})()
.then(function doNotHandleStream() {
var runner = require('..').Runner({ stream: false })
var outputs = []
var rs = createReadable([1, 2])
runner.thunkify(function () {
setTimeout(function() {
var ws = createWritable(outputs)
rs.pipe(ws)
}, 0)
return rs
})().then(function (res) {
// true
console.log(res[0] === rs)
})
})
function createReadable(input) {
var stream = Readable({ objectMode: true })
var i = 0
stream._read = function () {
if (i < input.length) {
this.push(input[i++])
} else {
this.push(null)
}
}
return stream
}
function createWritable(output) {
var stream = Writable({ objectMode: true })
var i = 0
stream._write = function (data, _, next) {
output.push(data)
next()
}
return stream
}
FAQs
Run async & sync callbacks
The npm package run-callback receives a total of 57 weekly downloads. As such, run-callback popularity was classified as not popular.
We found that run-callback demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.