
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
fastapi-better-di
is a utility that allows you to use DI in fastapi without Depends()
pip install fastapi_better_di
# app.py
import uvicorn
from fastapi import FastAPI
from fastapi_better_di.patcher.auto import is_pathed
# functions were patched immediately after import
assert is_pathed(), "Something went wrong"
class MyType:
def __init__(self, value):
self.value = value
app = FastAPI()
app.dependency_overrides[MyType] = lambda: MyType(123)
@app.get("/")
def handler(my_type: MyType): # <- DI without `Depends()`
assert my_type.value == 123
return my_type
if __name__ == "__main__":
uvicorn.run(app)
Auto patching: patches classes when importing:
from fastapi_better_di.patcher.auto import is_pathed # The classes were patched immediately after import
# To check if everything is OK, use assert
assert is_pathed(), "Something went wrong"
Manual patching: you need to call patch()
by yourself:
from fastapi_better_di.patcher.manual import patch, is_pathed
patch()
# To check if everything is OK, use assert
assert is_pathed(), "Something went wrong"
IMPORTANT: You can still use = Depends()
without a function as an argument,
and it won't add unnecessary arguments to the swagger.
IMPORTANT: The main app(FastAPI
) and dependency_overrides
must be initialized before importing routers!
fastapi-better-di
simply patch the handler function and add = Depends(func)
as the default argument
FAQs
Unknown package
We found that fastapi-better-di demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.