
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
URL MD5 是一个将 url 中的路径和查询参数使用 md5 加密的工具。
该项目需要在 node 环境下使用。
npm install url-md5
import urlMd5 from "url-md5";
// 传入完整 url
urlMd5.encode("https://www.hostname.com/pathname?a=1&b=2");
// 仅传入 pathname 和 search,适用于 axios 一类使用 basichURL
urlMd5.encode("/pathname?a=1&b=2");
// 还可以直接传入请求 options
urlMd5.encode({url: "/pathname", method: "POST", params: {a: 1, b: 2}});
encode 函数会将传入的参数格式化成标准的 url 然后截取 pathname+search 进行 md5 加密。
你可以定义配置 salt,md5 加密时会将 salt 拼接到 pathname+search 之后。
import urlMd5 from "url-md5";
// 设置 salt
urlMd5.config.salt = "Your salt";
// 示例
urlMd5.encode("https:/www.hostname.com/pathname?a=1&b=2"); // => md5("/pathname?a=1&b=2" + "Your salt");
urlMd5.encode("/pathname?a=1&b=2"); // => md5("/pathname?a=1&b=2" + "Your salt");
urlMd5.encode({url: "/pathname", params: {a: 1, b: 2}}); // => md5("/pathname?a=1&b=2" + "Your salt");
如在使用 axios 时,你需要替换加密的 pathname 则可以自定义该函数。
import urlMd5 from "url-md5";
// 设置 pathRewriter
urlMd5.config.pathRewriter = function (pathname, raw) {
return pathname.replace("/prefix", "") // 将 /prefix/pathname 替换为 /pathname
}
// 示例
urlMd5.encode("https://www.hostname.com/prefix/pathname?a=1&b=2") // => md5("/pathname/?a=1&b=2");
urlMd5.encode("/prefix/pathname?a=1&b=2") // => md5("/pathname/?a=1&b=2");
urlMd5.encode({url: "/prefix/pathname", params: {a: 1, b: 2}}) // => md5("/pathname/?a=1&b=2");
FAQs
> URL MD5 是一个将 url 中的路径和查询参数使用 md5 加密的工具。
The npm package url-md5 receives a total of 0 weekly downloads. As such, url-md5 popularity was classified as not popular.
We found that url-md5 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.