
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
A lightwieght wrapper for Google Drive API that makes file managment super easy!
npm install use-drive
# or
yarn add use-drive
# or
pnpm add use-drive
import {
initDrive,
getAuthUrl,
getTokens,
setCredentials,
listFiles,
uploadFile,
deleteFile,
} from "use-drive";
const oauth2Client = initDrive({
clientId: "YOUR_CLIENT_ID",
clientSecret: "YOUR_CLIENT_SECRET",
redirectUri: "YOUR_REDIRECT_URI",
});
async function authenticate() {
const authUrl = getAuthUrl();
console.log("Please authorize this app by visiting:", authUrl);
const code = "AUTHORIZATION_CODE_FROM_REDIRECT";
try {
const tokens = await getTokens(code);
console.log("Authentication successful!");
return true;
} catch (error) {
console.error("Authentication failed:", error);
return false;
}
}
function useExistingTokens() {
setCredentials({
access_token: "YOUR_ACCESS_TOKEN",
refresh_token: "YOUR_REFRESH_TOKEN",
expiry_date: 1234567890000,
});
}
async function listAllFiles() {
try {
const files = await listFiles();
console.log("Files in your Drive:", files);
/* Example output:
[
{ id: '1abc...', name: 'document.pdf', mimeType: 'application/pdf' },
{ id: '2def...', name: 'image.jpg', mimeType: 'image/jpeg' }
]
*/
} catch (error) {
console.error("Error listing files:", error);
}
}
async function uploadFileExample() {
try {
const fileId = await uploadFile(
"/local/path/to/file.pdf",
"uploaded-document.pdf",
"application/pdf"
);
console.log("File uploaded successfully with ID:", fileId);
return fileId;
} catch (error) {
console.error("Error uploading file:", error);
return null;
}
}
async function deleteFileExample(fileId: string) {
try {
await deleteFile(fileId);
console.log("File deleted successfully");
} catch (error) {
console.error("Error deleting file:", error);
}
}
async function exampleWorkflow() {
if (await authenticate()) {
await listAllFiles();
const newFileId = await uploadFileExample();
if (newFileId) {
console.log(
`File available at: https://drive.google.com/file/d/${newFileId}/view`
);
await deleteFileExample(newFileId);
}
}
}
You can also use environment variables for configuration:
import { initDrive } from "use-drive";
initDrive({
clientId: process.env.GOOGLE_CLIENT_ID!,
clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
redirectUri: process.env.GOOGLE_REDIRECT_URI!,
});
try {
const files = await listFiles();
} catch (error) {
if (error.message.includes("Drive API not initialized")) {
console.error("API not initialized. Call initDrive first.");
} else if (error.message.includes("auth")) {
console.error("Authentication error. Please re-authenticate.");
} else {
console.error("Operation failed:", error);
}
}
Creates a new UseDrive instance. You can either pass your OAuth credentials here or later using the configure method.
constructor(clientId?: string, clientSecret?: string, redirectUri?: string)
Sets up the OAuth2 client with your Google API credentials.
configure(clientId: string, clientSecret: string, redirectUri: string): void
Generates the authorization URL for OAuth2 flow.
getAuthUrl(): string
Exchanges the authorization code for access tokens.
getTokens(code: string): Promise<any>
Sets OAuth2 credentials if you already have tokens.
setCredentials(tokens: any): void
Lists all files in your Google Drive.
listFiles(): Promise<{ id: string; name: string; mimeType: string }[]>
Uploads a file to Google Drive.
uploadFile(filePath: string, fileName: string, mimeType: string): Promise<string>
Deletes a file from Google Drive.
deleteFile(fileId: string): Promise<void>
MIT
Pull requests are welcome! For major changes, please open an issue first to discuss what you would like to change.
Made with ❤️ by Ankur Gajurel
FAQs
A lightweight wrapper for Google Drive API
We found that use-drive demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.