
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
RequestReduce allows any IIS based website to automaticaly sprite background images into a single optimized PNG as well as combine and minify CSS and Javascript with absolutely no coding beyond a few config tweaks. RequestReduce excercises common best practices when serving its javascript, css and sprited images ensuring that the appropriate caching headers are sent to the browser so that browsers will not need to pull down a new http response until absolutely necessary. Chances are you will see an immediate rise in your yslow and google page speed tests.
#RequestReduce RequestReduce Makes your website faster - sometimes much faster - with almost no effort
##Getting started
Install-Package RequestReduce
in the Package Manager Console and skip steps two and three, otherwise download the latest RequestReduce version [here] (http://www.requestreduce.com/)Assuming you are using IIS 7, you would add it by ensuring that your web.config's system.webServer/modules element contains an add element as follows:
<system.web>
<httpModules>
<add name="RequestReduce" type="RequestReduce.Module.RequestReduceModule, RequestReduce" />
</httpModules>
</system.web>
<system.webServer>
<validation validateIntegratedModeConfiguration="false"/>
<modules>
<add name="RequestReduce" type="RequestReduce.Module.RequestReduceModule, RequestReduce" />
</modules>
</system.webServer>
All background images you want to sprite [must have an explicit width in their css class] (http://github.com/mwrock/RequestReduce/wiki/Can-I-make-changes-to-my-CSS-classes-to-optimize-RequestReduce-spriting%3F). Otherwise RequestReduce cannot guarantee that the background positions it injects will not cause adjacent sprites to bleed into a background image's view port. Also, RequestReduce will ignore repeating images so make sure to mark the image no-repeat if it is not a repeating image.
##Troubleshooting If RequestReduce does not appear to be doing anything, check out this [troubleshooting wiki] (https://github.com/mwrock/RequestReduce/wiki/RequestReduce-is-not-working.-I-don%27t-see-any-spriting-or-minification.-How-can-I-troubleshoot-this%3F) which provides several scenarios, options and debugging tips for figuring out why your content may not be being reduced. Also check the [list of wiki support pages] (https://github.com/mwrock/RequestReduce/wiki) which provides documentation addressing several topics to help you optimize RequestReduce and explain how RequestReduce works.
##Requirements
##What's Next? There are a ton of features I intend to add in order to make web performance optimizations just happen as part of installing Request Reduce. Here is what's at the top of the backlog:
##Resources
##Acknowledgements RequestReduce uses the following excellent OSS and other Free projects:
###RequestReduce Core
###RequestReduce.SqlServer
###RequestReduce.SassLessCoffee
###RequestReduce Internal Code (testing and building)
##License Licenced under [Apache 2.0] (http://www.apache.org/licenses/LICENSE-2.0)
FAQs
RequestReduce allows any IIS based website to automaticaly sprite background images into a single optimized PNG as well as combine and minify CSS and Javascript with absolutely no coding beyond a few config tweaks. RequestReduce excercises common best practices when serving its javascript, css and sprited images ensuring that the appropriate caching headers are sent to the browser so that browsers will not need to pull down a new http response until absolutely necessary. Chances are you will see an immediate rise in your yslow and google page speed tests.
We found that requestreduce demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.