
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
原生Socket实现用于TCP监听 TCPServer监听 UDP监听 HTTP 监听 1.2.0 增加Json/form-data数据直接转为实体对象给目标函数 路由标签使用方法时 方法所在类必须继承HttpRequest基类 1.2.5+ 增加对Task异步支持 更改 超过65535字节接收不了的问题 1.2.7 优化HTTP接收json时转换实体对象问题 1.2.8 解决formdata数据时解析字符串问题 1.2.10 优化异步数据接收 解决并发时数据接收不全的问题 1.2.11 增加无返回类型函数中通过this.Connection.send返回数据给客户端的功能 2.0.1 UDPServer中增加ClientSend方法 更改调用方式 2.0.2 允许使用 255.255.255.255 对某个端口进行广播 2.0.3 解决接收数据容易出现的已知问题 使用方式: ``` //TCP监听 var listener = TCPServer.Create(2020); listener.StartListen(s => { s.OnConnection = e => Console.WriteLine($@"OnConnection:{e.RemoteEndPoint}"); s.OnReceived = (e, data) => { Random random = new Random(); int randomNum = random.Next(0, 1000000); s.Send(Encoding.UTF8.GetBytes($@"ok>{s.RemoteEndPoint.ToString()}>>{randomNum}")); Console.WriteLine($@"OnData:{e.RemoteEndPoint},data:{Encoding.UTF8.GetString(data)}"); }; s.OnClosed = e => Console.WriteLine($@"OnClosed:{e.RemoteEndPoint}"); s.OnError = (conn, str, e) => Console.WriteLine($@"{conn.OnConnection} {str}:{e.Message}"); }); //UDP监听 var UDPlistener = UDPServer.Create(2020); UDPlistener.StartListen(s => { s.OnReceived = (e, data) => { Random random = new Random(); int randomNum = random.Next(0, 1000000); s.Send(s.RemoteEndPoint,Encoding.UTF8.GetBytes($@"ok>{s.RemoteEndPoint.ToString()}>>{randomNum}")); Console.WriteLine($@"UDP OnData:{e.RemoteEndPoint},data:{Encoding.UTF8.GetString(data)}"); }; s.OnError = (conn, str, e) => Console.WriteLine($@"{conn.RemoteEndPoint.ToString} {str}:{e.Message}"); }); //HTTP监听 var httplistener = HTTPServer.Create(2021); httplistener.SetPath(MethodEnum.GET, "/start"); httplistener.SetPath(MethodEnum.POST, "/start"); httplistener.StartListen(s => { //s.OnConnection = e => Console.WriteLine($@"OnConnection:{e.RemoteEndPoint}"); s.OnReceived = (e, Req) => { Random random = new Random(); int randomNum = random.Next(0, 1000000); s.Send($@"ok>{s.RemoteEndPoint.ToString()}>>{randomNum}"); Console.WriteLine($@"OnData:{e.RemoteEndPoint},data:{Req.Body}"); }; }); //HTTP监听路由写法: public class Workers : HTTPRequest { [Router("/start1", MethodEnum.GET)] public string Tests(string UserAccount, int Password) { Console.WriteLine("Body+>"+Content); return (new { code = 200, msg = "ok" }).ObjectToJson(); } [Router("/start1", MethodEnum.POST)] public object Tests2(string asd,List<int> aas) { foreach (var item in Headers) { Console.WriteLine(item.Key+":"+item.Value); } return new { code = 200, msg = "ok" }; } [Router("/start2", MethodEnum.POST)] public object Tests3(Testss testss) { foreach (var item in Headers) { Console.WriteLine(item.Key + ":" + item.Value); } return new { code = 200, msg = "ok" }; } } public class Testss { public string? UserAccount { get; set; } public string? Password { get; set; } } ```
FAQs
原生Socket实现用于TCP监听 TCPServer监听 UDP监听 HTTP 监听 1.2.0 增加Json/form-data数据直接转为实体对象给目标函数 路由标签使用方法时 方法所在类必须继承HttpRequest基类 1.2.5+ 增加对Task异步支持 更改 超过65535字节接收不了的问题 1.2.7 优化HTTP接收json时转换实体对象问题 1.2.8 解决formdata数据时解析字符串问题 1.2.10 优化异步数据接收 解决并发时数据接收不全的问题 1.2.11 增加无返回类型函数中通过this.Connection.send返回数据给客户端的功能 2.0.1 UDPServer中增加ClientSend方法 更改调用方式 2.0.2 允许使用 255.255.255.255 对某个端口进行广播 2.0.3 解决接收数据容易出现的已知问题 使用方式: ``` //TCP监听 var listener = TCPServer.Create(2020); listener.StartListen(s => { s.OnConnection = e => Console.WriteLine($@"OnConnection:{e.RemoteEndPoint}"); s.OnReceived = (e, data) => { Random random = new Random(); int randomNum = random.Next(0, 1000000); s.Send(Encoding.UTF8.GetBytes($@"ok>{s.RemoteEndPoint.ToString()}>>{randomNum}")); Console.WriteLine($@"OnData:{e.RemoteEndPoint},data:{Encoding.UTF8.GetString(data)}"); }; s.OnClosed = e => Console.WriteLine($@"OnClosed:{e.RemoteEndPoint}"); s.OnError = (conn, str, e) => Console.WriteLine($@"{conn.OnConnection} {str}:{e.Message}"); }); //UDP监听 var UDPlistener = UDPServer.Create(2020); UDPlistener.StartListen(s => { s.OnReceived = (e, data) => { Random random = new Random(); int randomNum = random.Next(0, 1000000); s.Send(s.RemoteEndPoint,Encoding.UTF8.GetBytes($@"ok>{s.RemoteEndPoint.ToString()}>>{randomNum}")); Console.WriteLine($@"UDP OnData:{e.RemoteEndPoint},data:{Encoding.UTF8.GetString(data)}"); }; s.OnError = (conn, str, e) => Console.WriteLine($@"{conn.RemoteEndPoint.ToString} {str}:{e.Message}"); }); //HTTP监听 var httplistener = HTTPServer.Create(2021); httplistener.SetPath(MethodEnum.GET, "/start"); httplistener.SetPath(MethodEnum.POST, "/start"); httplistener.StartListen(s => { //s.OnConnection = e => Console.WriteLine($@"OnConnection:{e.RemoteEndPoint}"); s.OnReceived = (e, Req) => { Random random = new Random(); int randomNum = random.Next(0, 1000000); s.Send($@"ok>{s.RemoteEndPoint.ToString()}>>{randomNum}"); Console.WriteLine($@"OnData:{e.RemoteEndPoint},data:{Req.Body}"); }; }); //HTTP监听路由写法: public class Workers : HTTPRequest { [Router("/start1", MethodEnum.GET)] public string Tests(string UserAccount, int Password) { Console.WriteLine("Body+>"+Content); return (new { code = 200, msg = "ok" }).ObjectToJson(); } [Router("/start1", MethodEnum.POST)] public object Tests2(string asd,List<int> aas) { foreach (var item in Headers) { Console.WriteLine(item.Key+":"+item.Value); } return new { code = 200, msg = "ok" }; } [Router("/start2", MethodEnum.POST)] public object Tests3(Testss testss) { foreach (var item in Headers) { Console.WriteLine(item.Key + ":" + item.Value); } return new { code = 200, msg = "ok" }; } } public class Testss { public string? UserAccount { get; set; } public string? Password { get; set; } } ```
We found that serverlisterner demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.