
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Python (3.6 or later) library to read and write records of HTTP exchanges in the HTTP types format.
pip install http-types
Using HttpExchangeWriter
a recording of HTTP traffic can be serialised for use with any program that can handle the HTTP Types format:
request = RequestBuilder.from_dict({
"host": "api.github.com",
"protocol": "https",
"method": "get",
"pathname": "/v1/users",
"query": {"a": "b", "q": ["1", "2"]},
}
)
response = ResponseBuilder.from_dict({
"statusCode": 200,
"headers": {"content-type": "text/plain"},
"body": "(response body string)",
}
)
exchange = HttpExchange(request=request, response=response)
with tempfile.TemporaryFile(mode="w") as output:
writer = HttpExchangeWriter(output)
writer.write(exchange)
# Serialize to dictionary
as_dict = HttpExchangeWriter.to_dict(exchange)
# Serialize to JSON string
as_str = HttpExchangeWriter.to_json(exchange)
With HttpExchangeReader
recordings in the HTTP Types format can be read for processing:
for exchange in HttpExchangeReader.from_jsonl(input_file):
assert exchange.request.method == HttpMethod.GET
assert exchange.request.protocol == Protocol.HTTPS
assert exchange.response.statusCode == 200
Initial setup:
pip install --upgrade -e '.[dev]'
To test, run python setup.py test
, which will:
pytest
, configured in pytest.ini.mypy
.python setup.py test
and python setup.py dist
to check that everything works.python setup.py upload
. Insert PyPI credentials to upload the package to PyPI
. The command will also run git tag
to tag the commit as a release and push the tags to remote.To see what the different commands do, see Command
classes in setup.py.
FAQs
Types for HTTP requests and responses
We found that http-types demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.