
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
FiftyOne.DeviceDetection
Advanced tools
51Degrees Device Detection parses HTTP headers to return detailed hardware, operating system, browser, and crawler information for the devices used to access your website or service. This is an alternative to popular UAParser, DeviceAtlas, and WURFL packages.
Pipeline API
This repository contains the device detection engines for the .NET implementation of the Pipeline API.
The specification is also available on GitHub and is recommended reading if you wish to understand the concepts and design of this API.
Visual Studio 2022 or later is recommended. Although Visual Studio Code can be used for working with most of the projects.
The core device detection projects are written in C and C++. The Pipeline engines are written in C# and target .NET Standard 2.0.3. Example and test projects mostly target .NET 6.0 though in some cases, projects are available targeting other frameworks.
For runtime dependencies, see our
dependencies
page. The ci/options.json
file lists the tested and packaged .NET versions
and operating systems automatic tests are performed with. The solution will
likely operate with other versions.
The API can either use our cloud service to get its data or it can use a local (on-premise) copy of the data.
You will require a resource key to use the Cloud API. You can create resource keys using our configurator, see our documentation on how to use this.
In order to perform device detection on-premise, you will need to use a 51Degrees data file. This repository includes a free, 'lite' file in the 'device-detection-data' sub-module that has a significantly reduced set of properties. To obtain a file with a more complete set of device properties see the 51Degrees website. If you want to use the lite file, you will need to install GitLFS.
On Linux:
sudo apt-get install git-lfs
git lfs install
Then, navigate to 'device-detection-cxx/device-detection-data' and execute:
git lfs pull
The easiest way to install is to use NuGet to add the reference to the package:
Install-Package FiftyOne.DeviceDetection
Device detection on-premise uses a native binary (i.e. compiled from C code to target a specific platform/architecture). The NuGet package contains several binaries for common platforms. However, in some cases, you'll need to build the native binaries yourself for your target platform. This section explains how to do this.
v143
10.0.18362.0
sudo apt-get install g++ make libatomic1
git submodule update --init --recursive
Visual studio should now be able to build the native binaries as part of its normal build process.
You can package a project into NuGet *.nupkg
file by running a command like:
dotnet pack [Project] -o "[PackagesFolder]" /p:PackageVersion=0.0.0 -c [Configuration] /p:Platform=[Architecture]
FiftyOne.DeviceDetection.Hash.Engine.OnPremise
📝 Using AnyCPU
might prevent the unmanaged (C++) code from being built into .Native.dll
library. Use x86
/x64
/arm64
specifically.
📝 If creating cross-platform package from multiple native dlls, put all 6x FiftyOne.DeviceDetection.Hash.Engine.OnPremise.Native.dll
into respective folders:
../
macos/
arm64/
x64/
linux/
x64/
x86/
windows/
x64/
x86/
and add to the packaging command:
/p:BuiltOnCI=true
related CI scripts:
BuiltOnCI
var:
We currently do not strong name assemblies due to downsides for developers. The main of which is that .NET Framework on Windows enables strict loading of assemblies once an assembly is strong named. A strong-named assembly reference must exactly match the version of the loaded assembly, forcing developers to configure binding redirects when using the assembly.
If it is absolutely critical for your use case to integrate a strong-named assembly - please create a feature request issue.
Examples can be found in device-detection-dotnet-examples repository.
Tests can be found in the Tests/
folder. These can all be run from within
Visual Studio or by using the dotnet test
command line tool.
Some tests require additional resources to run. These will either fail or return an 'inconclusive' result if these resources are not provided.
DEVICEDETECTIONDATAFILE
environment variable.SUPER_RESOURCE_KEY
environment variable should be populated with a
key that includes all properties. A
license is required in order to access
some properties.For complete documentation on the Pipeline API and associated engines, see the 51Degrees documentation site.
FAQs
51Degrees Device Detection parses HTTP headers to return detailed hardware, operating system, browser, and crawler information for the devices used to access your website or service. This is an alternative to popular UAParser, DeviceAtlas, and WURFL packages.
We found that fiftyone.devicedetection demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.