
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
micropython-eydam-prototyping-ep-http
Advanced tools
Simple Library to run a http-server on an ESP32 or other MicroPython-enabled device. If you want to support my work, checkout my github repo.
# main.py
import ep_file_server
import ep_rest_server
import ep_http
import network
import time
import ubinascii
wlan=network.WLAN(network.STA_IF)
wlan.active(True)
wlan.connect("<SSID>", "<Password>")
while not wlan.isconnected():
time.sleep(1)
print("Connected")
# just return files to client
fs = ep_file_server.file_server(
html_dir="/html/", # directory with files
default_file="index.html" # default file that is returned when no specific file is requested
)
# edit a json configuration file via rest api
# currently supported: GET, PUT
crs = ep_rest_server.config_rest_server(
config_file="./config.json"
)
# sensor reading for sensor_rest_server, must return json serializeable dict
def scan_wifi(path):
nets = wlan.scan()
result = []
for ssid, bssid, channel, rssi, authmode, hidden in nets:
net = {
"ssid": ssid.decode("ascii"),
"bssid": ubinascii.hexlify(bssid).upper(),
"channel": channel,
"rssi": rssi,
"authmode": authmode,
"hidden": hidden
}
result.append(net)
return result
# return sensor reatings via rest api
# currently supported: GET
srs = ep_rest_server.sensor_rest_server(
[
("^wifinets$", scan_wifi) # assignment function <-> route
]
)
def default_route(sock, request):
print("unhandled request")
print(request)
routes = [
# files are available via http://<ip>/files/yourfile.html
("^\/?files\/([A-Za-z0-9_\.\/]*)\??([A-Za-z0-9_\.\/]*)$", lambda sock, req: fs.serve(sock, req)),
# configurations are available via http://<ip>/config/hierachy/of/json/file
("^\/?config\/?([A-Za-z0-9_\.\/]*)\??([A-Za-z0-9_\.\/]*)$", lambda sock, req: crs.serve(sock, req)),
# sensor readings are available via http://<ip>/sensor/wifinets
("^\/?sensor\/?([A-Za-z0-9_\.\/]*)\??([A-Za-z0-9_\.\/]*)$", lambda sock, req: srs.serve(sock, req)),
# favicon is forwarded to file server
("^(favicon\\.ico)$", lambda sock, req: fs.serve(sock, req)),
# route, if nothing else matches
("^(.*)$", default_route),
]
s = ep_http.http_server(routes=routes, micropython_optimize=True)
print("Starting HTTP-Server: " + wlan.ifconfig()[0])
s.start()
ep_http.http_server
is the main class, that listens to the port, handels incomming connections, parses the requests and forwards them to the corresponding routes.
ep_file_server.file_server
servers files.ep_rest_server.config_rest_server
is a minimal REST-Server to edit config-files. Currently only a reduced set of instructions is supported.ep_rest_server.sensor_rest_server
is also a minimal REST-Server, that accepts only GET-Requests. It is made to read sensor data.FAQs
Some wifi functions for MicroPython
We found that micropython-eydam-prototyping-ep-http demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.