
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
KaioRetry is (yet another) retry decorator implementation, which is clearly inspired by the original retry module and is actually backward compatible with it.
Transparently perform retries on failures:
from kaioretry import retry, aioretry
@retry(exceptions=ValueError, tries=2)
def some_func(...):
...
@aioretry(exceptions=(ValueError, SomeOtherError), tries=-1, delay=1)
async def some_coroutine(...):
...
If you care to read more, a more lengthy documentation is available on readthedocs.
Pylint, it seems, is not really good a detecting decorators that change function signatures, and kaioretry defines and uses a lot of decorators (relatively speaking).
This means that such basic code:
from kaioretry import aioretry
@aioretry(exceptions=ZeroDivisionError)
async def func(x, y):
return x / y
Will trigger the following pylint errors:
E1120: No value for argument 'retry_obj' in function call (no-value-for-parameter)
According to pylint documentation, the only way to widely work around this
issue is to use the
signature-mutators
feature of pylint. This can be done either on the command line:
pylint --signature-mutators=kaioretry._make_decorator
Or through pylint configuration file:
# The TYPECHECK section accepts a signature-mutators directive.
[TYPECHECK]
# List of decorators that change the signature of a decorated function.
signature-mutators=kaioretry._make_decorator
(Of course, you can inline a # pylint: disable=no-value-for-parameter
comment on all aioretry()
and retry()
call lines, and it can be good
enough to disable a one-time warning, but repeating that line can be
tedious. The signature-mutators
directive will globally disable the
signature-checking for aioretry()
and retry()
calls, so this can be easier
depending of your own usage of kaioretry.)
Mypy may incorrectly infer the type of an
aioretry-decorated function as def (*Any, **Any) -> Any
if the original
function:
Any
and/or if parameters are hinted as Any
.If the original function is fully annotated as non-Any
, the resulting
decorated function annotations should be correctly inferred (according to
kaioretry
test).
It is unclear to me right now, if the kaioretry.aioretry
function type hints
are incorrect or if it is an issue with either mypy or cpython. Or both. Or
all 3. Go figure.
Any information on that matter would be greatly appreciated. I've spent weeks trying to track down this issue. And while walking down this path has allowed me to fix some other (rather unrelated) type-hinting boo-boos from my part, this very specific issue is still puzzling me.
Always.
FAQs
All in one retry and aioretry decorators
We found that kaioretry demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.