
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
set-query-string
Advanced tools
Updates/sets the browser's query string in place without adding to browser history.
Updates/sets the browser's query string in-place without adding to browser history (unless you want to, of course).
This module uses HTML5's history.replaceState
to manipulate the query string on the page without refreshing the page.
If not supported in your browser it's just a no-op.
This is just a thin wrapper on top of the awesome and tiny query-string
module.
Sometimes you want to let the user apply filters to data in your Native Web App (a.k.a. Single Page App) and still make those filters deep-linkable. So what do you do?
Serialize your filter description into the URL: awesome-app.com?color=blue&search=hair
Now the user can deep link or bookmark specific filtered views.
In browsers that don't support replaceState
using this simply does nothing so your app still works, users simply can't deep-link your filtered views ¯_(ツ)_/¯.
Because it's nice to just be able to set an object and have it Just Work™ without having to think about installing a query string parser, etc.
Also, this automatically URI encodes/decodes values so you can use spaces and whatnot without having to think about it.
npm install set-query-string
var setQuery = require('set-query-string');
// the browser's URL will be updated
// in place without a page refresh:
// before: `example.com`
setQuery({something: 'else'})
// after: `example.com?something=else`
// by default any other query strings are left in place
// before: `example.com?something=else`
setQuery({other: 'value'})
// after: `example.com?something=else&other=value`
// you can optionally clear other values too
// before: `example.com?something=else`
setQuery({other: 'value'}, {clear: true})
// after: `example.com?other=value`
// by default it uses `history.replaceState` so
// the changed URL doesn't end up being part of the
// "back" button history. If you *do* want to add
// to it, just pass a `pushState: true` option
setQuery({other: 'value'}, {pushState: true})
// setting values to anything falsy other than `0` removes that key
// from the query entirely.
// if there's no keys left, the `?` is removed too
// before: `example.com?other=something`
// these are all the same
setQuery({other: ''})
setQuery({other: undefined})
setQuery({other: null})
// after: `example.com`
// if for some reason you want to encode the string yourself
// go for it, just pass it a string instead of an object
var myQueryString = '?im-special=yup'
// this works too, if you really want it (always replaces the entire query string)
// it ignores leading `?` if you include it, so it's safe to do it either way
setQuery(myQueryString)
// setting query string and adding to history state
setQuery({other: 'value'}, {pushState: true, state: {other: 'value'}})
If you happen to be using something like ampersand-state you can use this module to easily bind a model property to a certain query paramater quite easily:
import State from 'ampersand-state'
import setQuery from 'set-query-string'
export default State.extend({
initialize () {
// bind `query` property to browser URL query
this.on('change:query', (model) => setQuery({query: model.query}))
},
session: {
query: 'string'
}
})
Works well in the apps I use it in. I'd happily take a PR that added some but it's simple enough and don't have the time right now ¯_(ツ)_/¯
If you like this follow @HenrikJoreteg on twitter.
2.1.0
: now inert if required in non browser environment2.0.0
: use smaller, simpler query-string
instead of qs
1.0.0
: initial releaseMIT
FAQs
Updates/sets the browser's query string in place without adding to browser history.
The npm package set-query-string receives a total of 314 weekly downloads. As such, set-query-string popularity was classified as not popular.
We found that set-query-string demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.