
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
WARNING - Version 4.0.0 is a breaking change from version 3.x.x. Please review the documentation before upgrading
A micro-library that allows for the registration of functions corresponding to AWS AppSync routes. This allows for cleanly creating a single AWS Lambda datasource without large numbers of conditionals to evaluate the called route.
pip install appsync-router
from appsync_router import discrete_route, route_event
# Context is a TypedDict that makes access to
# the items passed to your Lambda function simpler
from appsync_router.context import Context
# Here we are telling the router that when the field "getItems"
# is called on the type "Query", call the function "get_items"
@discrete_route("Query", "getItems")
def get_items(context: Context) -> list:
return [1, 2, 3, 4]
def function_handler(event, context):
# simply route the event and return the results
return route_event(event)
NOTE -
appsync-router
is designed to be used as a Direct Invocation AWS AppSync datasource. If you put a request VTL template in front of it, you must pass in the WHOLE $ctx/$context object.
Each route type has an overloaded signature allowing for simple declaration.
discrete_route
- This discretely routes to a named type and fieldmulti_route
- This routes to a set of named type/field combinationspattern_route
- This routes to types/fields that match the type and field regex patterns providedglob_route
- This routes to the types/fields that match the type and field glob patterns providedAs seen in the example above, the simplest form of event routing is to call route_event
with only the event argument. This will do the following:
NoRouteFoundException
Many times this will be sufficient. However, this behavior can be modified:
default_route
of type Route
to the route_event
method will call your default_route
if no route is foundshort_circuit=False
to the route_event
method will cause a MultipleRoutesFoundException
to be raised in the case of multiple matched routes.executor
of type concurrent.futures.Executor
to the route_event
method will cause all batch invocations (where the event
has a list of contexts) to be executed using your executor.You may extend the appsync_router
with your own route types. Any routes that you create must extend from the appsync_router.routes.Route
class.
FAQs
A framework easily routing AppSync requests using AWS Lambda
We found that appsync-router demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.