
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
A very simple RPC-like library to make writing Pyodide applications easier. At the core of the library is a simple App + Decorator based approach inspired by Flask.
Provides server-side bindings for prpc API.
To expose a python function as a prpc method you first create
a prpc RpcApp
and then decorate your function with @app.call
.
Create a file called myapp.py
and add the following code:
# myapp.py
from prpc_python import RpcApp
app = RpcApp("My Hello World App")
@app.call
def hello():
return "World"
You can now discover your API using the prpc
command line tool. To do this
you either have to specify the plugin ID of your app or "publish" the
plugin using the Python plugin discovery approach.
The ID of your plugin is the name of the module containing
your RpcApp
instance plus the name of the instance, e.g.
myapp:app
for the example above.
You can now use the command line tool to discover your API:
prpc commands -a myapp:app
and you can even call your function from the command line:
prpc run -a myapp:app hello
You don't always want to have to specify the plugin ID of your app. You can
use the approach described in the metadata section of the packaging
spec to publish your plugin. If you have a pyproject.toml
file, then add
the following section:
[tool.poetry.plugins."prpc_python"]
myapp = "myapp:app"
If your plugin is the only one in your installed dependencies, then it will
be automatically chosen, and you can omit the -a myapp:app
argument.
prpc also supports file transfers. If you receive a file from the remote
endpoint, you will receive a prpc_python.RemoteFile
object. This object
has a standard read
method, so you can use it as a file-like object.
It may also have filename
, size
and content_type
attributes but it
depends on the source of the file whether these are available.
FAQs
A very simple RPC-like library to make writing Pyodide applications easier. At the core of the library is a simple App + Decorator based approach inspired by Flask.
We found that prpc-python demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.