
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
thread-worker-group
Advanced tools
网址: https://github.com/mailhonor/node-thread-worker-group
npm i thread-worker-group
注意: 下划线开头的方法/变量不应该使用
// 请求
export interface ServiceRequest {
// 数据
data: any
// 通知消息接收器, 请注意: 不是此"请求"的返回的处理函数
tipReceiver?: TipReceiver
// 可以指定 workerId
workerId?: string
}
// 通知消息接收器
export type TipReceiver = (data: any) => void
// 请求的返回结果
export interface ServiceResponse {
// 框架上的返回状态, 空表示正常
status: string
// 返回的数据
data: any
}
// 创建worker线程组的 选项
export interface WorkerGroupOptions {
// 脚本路径
scriptPathname: string
// 是否独占模式(如:cpu密集型), 如果是则每个worker同时只处理一个请求
exclusive?: boolean
// 是否开启 debug
debug?: boolean
}
// 创建一个worker的选项
export interface WorkerOptions {
// 可以指定worker的id
workerId?: string
// 传递给worker的数据
workerData?: any
// node原生的创建worker的选项
workerOriginalOptions?: any
}
// 统计信息
export interface workerGroupStatistics {
// 所有请求的数量
enteredCount: number
// 已经处理完毕的请求的数量
dealedCount: number
}
// worker端, 消息通知发送器
export type ThreadTipSender = (data: any) => void
// worker端, 模块请求
export interface ThreadJobRequest {
data: any
tipSender: ThreadTipSender
}
export interface ThreadJobResponse {
data: any
}
export type ThreadJobHandler = (req: ThreadJobRequest) => Promise<ThreadJobResponse>
import * as threadWorkerGroup from "thread-worker-group"
// 返回是否主线程
threadWorkerGroup.isMainThread()
var wg = new threadWorkerGroup.workerGroup({
scriptPathname: __filename,
/* exclusive: false, */
})
wg.createWorker({
workerId: "id123",
workerData: "xxx",
})
wg.createWorker({
workerData: {a: "ccc"},
})
wg.createWorker({ })
// 是Promise, 没有 catch
wg.request({
data: {a: 123, b: "xxx"},
}).then((res:ServiceResponse) => {
console.log("response:", res.status, res.data)
})
wg.request({
data: {a: 123, b: "xxx"},
workerId: "id123",
}).then((res:ServiceResponse) => {
console.log("response:", res.status, res.data)
})
wg.request({
data: {a: 123, b: "xxx"},
tipReceiver: (tip: any) => {
console.log(tip)
},
}).then((res:ServiceResponse) => {
console.log("response:", res.status, res.data)
})
var st:workerGroupStatistics = wg.statistics
function handler(data: any) {
console.log(data)
}
wg.registerGlobalTipReceiver("somename", handler)
const threadWorkerGroup = require("thread-worker-group")
// 返回是否主线程
threadWorkerGroup.isMainThread()
// 必须是 async 的
const handler = async (req: ) => {
var i = 0;
for (i = 0; i < 100; i++) {
req.tipSender({ data: i})
req.tipSender("xxx")
}
return { data: "something" }
}
threadWorkerGroup.threadRegisterHandler(handler)
threadWorkerGroup.threadGlobalTipSender("somename", anydata)
var d = threadWorkerGroup.threadGetWorkerData();
FAQs
thread worker group
The npm package thread-worker-group receives a total of 0 weekly downloads. As such, thread-worker-group popularity was classified as not popular.
We found that thread-worker-group demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.