
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
use-file-picker
Advanced tools
🏠 Homepage
npm i use-file-picker
or
yarn add use-file-picker
https://use-file-picker-storybook-b0wsuz1yj-mrkampla.vercel.app/
https://codesandbox.io/s/inspiring-swartz-pjxze?file=/src/App.js
import { useFilePicker } from 'use-file-picker';
import React from 'react';
export default function App() {
const [openFileSelector, { filesContent, loading }] = useFilePicker({
accept: '.txt',
});
if (loading) {
return <div>Loading...</div>;
}
return (
<div>
<button onClick={() => openFileSelector()}>Select files </button>
<br />
{filesContent.map((file, index) => (
<div>
<h2>{file.name}</h2>
<div key={index}>{file.content}</div>
<br />
</div>
))}
</div>
);
}
https://codesandbox.io/s/busy-nightingale-oox7z?file=/src/App.js
import { useFilePicker } from 'use-file-picker';
import React from 'react';
export default function App() {
const [openFileSelector, { filesContent, loading, errors }] = useFilePicker({
readAs: 'DataURL',
accept: 'image/*',
multiple: true,
limitFilesConfig: { max: 1 },
// minFileSize: 0.1, // in megabytes
maxFileSize: 50,
imageSizeRestrictions: {
maxHeight: 900, // in pixels
maxWidth: 1600,
minHeight: 600,
minWidth: 768,
},
});
if (loading) {
return <div>Loading...</div>;
}
if (errors.length) {
return <div>Error...</div>;
}
return (
<div>
<button onClick={() => openFileSelector()}>Select files </button>
<br />
{filesContent.map((file, index) => (
<div key={index}>
<h2>{file.name}</h2>
<img alt={file.name} src={file.content}></img>
<br />
</div>
))}
</div>
);
}
https://codesandbox.io/s/musing-moon-wuq4u?file=/src/App.js
import { useFilePicker } from 'use-file-picker';
import React from 'react';
export default function App() {
const [openFileSelector, { filesContent, loading, errors, plainFiles, clear }] = useFilePicker({
multiple: true,
readAs: 'DataURL', // availible formats: "Text" | "BinaryString" | "ArrayBuffer" | "DataURL"
// accept: '.ics,.pdf',
accept: ['.json', '.pdf'],
limitFilesConfig: { min: 2, max: 3 },
// minFileSize: 1, // in megabytes
// maxFileSize: 1,
// readFilesContent: false, // ignores file content
});
if (errors.length) {
return (
<div>
<button onClick={() => openFileSelector()}>Something went wrong, retry! </button>
{errors[0].fileSizeTooSmall && 'File size is too small!'}
{errors[0].fileSizeToolarge && 'File size is too large!'}
{errors[0].readerError && 'Problem occured while reading file!'}
{errors[0].maxLimitExceeded && 'Too many files'}
{errors[0].minLimitNotReached && 'Not enought files'}
</div>
);
}
if (loading) {
return <div>Loading...</div>;
}
return (
<div>
<button onClick={() => openFileSelector()}>Select file </button>
<button onClick={() => clear()}>Clear</button>
<br />
Number of selected files:
{plainFiles.length}
<br />
{/* If readAs is set to DataURL, You can display an image */}
{!!filesContent.length && <img src={filesContent[0].content} />}
<br />
{plainFiles.map(file => (
<div key={file.name}>{file.name}</div>
))}
</div>
);
}
Prop name | Description | Default value | Example values |
---|---|---|---|
multiple | Allow user to pick multiple files at once | true | true, false |
accept | Set type of files that user can choose from the list | "*" | [".png", ".txt"], "image/*", ".txt" |
readAs | Set a return type of filesContent | "Text" | "DataURL", "Text", "BinaryString", "ArrayBuffer" |
limitFilesConfig | Set maximum and minimum files that user can select | n/a | {min: 1, max: 2}, {max: 1} |
readFilesContent | Ignores files content and omits reading process if set to false | true | true, false |
minFileSize | Set minimum limit of file size in megabytes | n/a | 0.01 - 50 |
maxFileSize | Set maximum limit of file size in megabytes | n/a | 0.01 - 50 |
imageSizeRestrictions | Set maximum and minimum constraints for image size in pixels | n/a | { maxHeight: 1024, minWidth: 768, minHeight:480 } |
validators | Add custom validation logic | [] | [MyValidator, MySecondValidator] |
Name | Description |
---|---|
openFileSelector | Opens file selector |
clear | Clears all files and errors |
filesContent | Get files array of type FileContent |
plainFiles | Get array of the File objects |
loading | True if the reading files is in progress, otherwise False |
errors | Get errors array of type FileError if any appears |
useFilePicker allows for injection of custom validation logic. Validation is divided into two steps:
interface Validator {
validateBeforeParsing(config: UseFilePickerConfig, plainFiles: File[]): Promise<void>;
validateAfterParsing(config: UseFilePickerConfig, file: FileWithPath, reader: FileReader): Promise<void>;
}
Validators must return Promise object - resolved promise means that file passed validation, rejected promise means that file did not pass.
/**
* validateBeforeParsing allows the user to select only an even number of files
* validateAfterParsing allows the user to select only files that have not been modified in the last 24 hours
*/
const customValidator: Validator = {
validateBeforeParsing: async (config, plainFiles) => new Promise((res, rej) => (plainFiles.length % 2 === 0 ? res() : rej({ oddNumberOfFiles: true }))),
validateAfterParsing: async (config, file, reader) =>
new Promise((res, rej) =>
file.lastModified < new Date().getTime() - 24 * 60 * 60 * 1000 ? res() : rej({ fileRecentlyModified: true, lastModified: file.lastModified })
),
};
LimitFilesConfig {
min?: number;
max?: number;
}
UseFilePickerConfig extends Options {
multiple?: boolean;
accept?: string | string[];
readAs?: ReadType;
limitFilesConfig?: LimitFilesConfig;
readFilesContent?: boolean;
imageSizeRestrictions?: ImageDims;
}
FileContent {
lastModified: number;
name: string;
content: string;
}
ImageDims {
minWidth?: number;
maxWidth?: number;
minHeight?: number;
maxHeight?: number;
}
Options extends ImageDims {
minFileSize?: number;
maxFileSize?: number;
}
FileError extends FileSizeError, FileReaderError, FileLimitError, ImageDimensionError {
name?: string;
}
FileReaderError {
readerError?: DOMException | null;
}
FileLimitError {
minLimitNotReached?: boolean;
maxLimitExceeded?: boolean;
}
FileSizeError {
fileSizeToolarge?: boolean;
fileSizeTooSmall?: boolean;
}
ImageDimensionError {
imageWidthTooBig?: boolean;
imageWidthTooSmall?: boolean;
imageHeightTooBig?: boolean;
imageHeightTooSmall?: boolean;
imageNotLoaded?: boolean;
}
👤 Milosz Jankiewicz
👤 Kamil Planer
Contributions, issues and feature requests are welcome!
Feel free to check the issues page.
Give a ⭐️ if this project helped you!
FAQs
Simple react hook to open browser file selector.
The npm package use-file-picker receives a total of 50,870 weekly downloads. As such, use-file-picker popularity was classified as popular.
We found that use-file-picker demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.