
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
test-topdev-logger-v1
Advanced tools
JSON logging patcher for Next.js
This is a library to patch the logging functions used by Next.js, to have them output to stdout
as newline-delimited JSON. This allows a Next.js application to log service events in a format that's compatible with log aggregators, without needing a custom Next.js server.
This works by importing Next.js' inbuilt logger via require
, and replacing the logging methods with custom ones. It uses pino
to output JSON formatted logs, preserving Next.js' message and prefix, but adding timestamp, hostname and more. Although the library was mainly developed based on pino
, it also supports winston
as the logger backend. See the Custom Logger section below for more details.
From v2.0.0 onwards, this library also patches the global console
methods, to catch additional logs that Next.js makes directly to console
. While pino
logging remains intact, this may cause issues with other libraries which patch or use console
methods. Use the next-only
preset to opt-out of this patching.
Before:
ready - started server on http://localhost:3000
info - Using external babel configuration from .babelrc
event - compiled successfully
After:
{"level":30,"time":1609160882850,"pid":18493,"hostname":"MyHostname","name":"next.js","msg":"started server on http://localhost:3000","prefix":"ready"}
{"level":30,"time":1609160883607,"pid":18493,"hostname":"MyHostname","name":"next.js","msg":"Using external babel configuration from .babelrc","prefix":"info"}
{"level":30,"time":1609160885675,"pid":18493,"hostname":"MyHostname","name":"next.js","msg":"compiled successfully","prefix":"event"}
First, install this package and pino
. You can do this with whatever Node package manager you're using in your project.
npm install next-logging-patcher pino
# or for Yarn
yarn add next-logging-patcher pino
Then use the Next Instrumentation hook to load this library.
instrumentation.ts|js
file in the root directory of your project (or inside the src folder if using one)
export async function register() {
if (process.env.NEXT_RUNTIME === 'nodejs') {
await require('pino')
await require('next-logging-patcher')
}
}
next.config.js
const nextConfig = {
// [...]
experimental: {
instrumentationHook: true,
},
}
To support opting out of some patches, this library supports "presets". These can be used as above, with /presets/<PRESET_NAME>
appended, for example: await require("next-logging-patcher/presets/next-only")
.
The following presets are supported:
next-logging-patcher/presets/all
- this includes all the patches this library supports. Using the library without a preset specified will use this preset.next-logging-patcher/presets/next-only
- this only includes patches specifically for the Next.js logger object.By default, this library uses an instance of Pino with a modified logMethod
, to give reasonable out-the-box behaviour for JSON logging. If you need logs in a different format, for example to change the message field or transform logged objects, you can provide your own instance of Pino to the library.
This is done by creating a next-logging-patcher.config.js
file in the root of your project. The file should be a CommonJS module, and a function returning your custom Pino instance should be exported in a field called logger
. This function will be called with the library's default Pino configuration, to allow you to extend it's behaviour (or completely replace it).
The instance returned by the function must implement a .child
method, which will be called to create the child loggers for each log method.
For example:
// next-logging-patcher.config.js
const pino = require('pino')
const logger = defaultConfig =>
pino({
...defaultConfig,
messageKey: 'message',
mixin: () => ({ name: 'custom-pino-instance' }),
})
module.exports = {
logger,
}
Or with winston
:
npm install winston
const { createLogger, format, transports } = require('winston')
const logger = defaultConfig =>
createLogger({
transports: [
new transports.Console({
handleExceptions: true,
format: format.json(),
}),
],
})
module.exports = {
logger,
}
This package name, next-logging-patcher
has been inherited from @frank47, who had deprecated their published logging middleware for Next.js. The original package and this one aim to solve similar problems for JSON logging in Next.js. However, the implementation and usage of this solution is significantly different from the original, which was published up to v0.4.0
. To minimise unexpected issues for previous users of the original next-logging-patcher
, the new package begins at major v1.0.0
.
Changes are published to npm
, however with 2FA rules in place for security, this cannot be achieved through GitHub Actions at this time. To release a new version, merge all work intended to be in the release, and then follow these steps:
npm version <major|minor|patch>
git push --follow-tags
npm publish
Then create a new release on GitHub, pointing to the tag created by npm version
.
FAQs
JSON logging patcher for Next.js
The npm package test-topdev-logger-v1 receives a total of 0 weekly downloads. As such, test-topdev-logger-v1 popularity was classified as not popular.
We found that test-topdev-logger-v1 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.