
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
This README is meant for developers of the project, and not for end users. For end users, please see the documentation linked above.
This project uses Poetry for packaging. Although one should refer to Poetry docs for a thorough introduction, here's a short summary of the intended workflow with Poetry:
poetry install
. After installation, if the Python scripts folder is in your PATH, you should be able to invoke main.main()
with pg4n
.poetry env info
, copy virtual environment executable path, press F1 and type Python: Select Interpreter
> Enter interpreter path...
> paste path and press <ENTER>
.poetry add <dep>
/poetry remove <dep>
.poetry run <cmd>
.poetry shell
.You can bump the version number automatically with poetry version patch
, poetry version minor
, etc. See poetry version -h
.
See version history here.
During development, you must run the program as a module, e.g., poetry run python -m src.pg4n.main
, so that the imports work.
Having PostgreSQL running on port 5432, do poetry run pytest
.
You may need to provide environment variables that match your config:
Variable | Default value | Description |
---|---|---|
PGHOST | 127.0.0.1 | Hostname of the PostgreSQL server. |
PGPORT | 5432 | Port to an active PostgreSQL instance. |
PGUSER | postgres | The user that will be used to manage the test database. |
PGPASSWORD | Password, in case password authentication is used. | |
PGDBNAME | test_database | Database name. |
For example, if PostgreSQL is on port 5433, just do PGPORT=5433 poetry run pytest
(Bash syntax).
To get a similar PostgreSQL instance as with GitHub Actions workflow:
docker run --rm -P -p 127.0.0.1:5432:5432 --name pg -e POSTGRES_PASSWORD=postgres -d postgres:14.5-alpine
You'll need to tell pytest the password: PGPASSWORD=postgres poetry run pytest
.
docs/api
is not up-to-date or doesn't exist, run:poetry run sphinx-apidoc -f -o docs/api src/pg4n '*/test*'
poetry run sphinx-build -b html docs docs/build
Note that the GitHub Pages site is only updated on pushes to main
branch.
For linting, the following tools are used:
black
for formattingpylint
for lintingmypy
for static type checkingisort
for sorting importsTo get a grade that the CI/CD pipeline would give you, you can do poetry run scripts/ci-grade.sh
to run all the checks. The output is possibly long, so pipe it to a file perusal filter such as less
to scroll through it and search for things of concern, e.g., summary
to see scores.
This project uses poetry-githooks
to run automatic formatting on each commit. To set this up, run:
poetry run githooks setup
This needs to be re-run each time the [tool.githooks]
section is modified in the pyproject.toml
file.
One can skip pre-commit hooks by running git commit
with the --no-verify
flag.
FAQs
PostgreSQL for novices - helps debug PostgreSQL queries
We found that pg4n demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.