
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
A GPU-accelerated Large-scale Open Microscopic Traffic Simulation System
Website: https://moss.fiblab.net
Documentation: https://python-moss.readthedocs.io/en/latest/
API Reference: https://python-moss.readthedocs.io/en/latest/apidocs/index.html
The related repositories of MOSS are as follows:
cityproto
: The protobuf-driven data structure definition for all city simulation projects of FIBLAB, URL. The project provides C/C++, Golang, Python, and Javascript/Typescript interfaces to access the data structure. (match python-moss>=1.0.0)mosstool
: The toolchain for MOSS, URL. The project is a Python packages that includes map building, traffic demand generation, SUMO format conversion, and some format conversion utilities. It is the key to build the input of MOSS. (match python-moss>=1.0.0)routing
: A gRPC-powered routing service with A* shortest path algorithm, URL. The project is the necessary service for mosstool
when generating traffic demand or just calling pre_route
functions to compute the routes of people. (match python-moss>=1.0.0)moss-replay
: A internal JS/TS package for building web-based UI to visualize the simulation results, URL. (match python-moss>=1.0.0)moss-webui-frontend
: A web UI to visualize the PostgreSQL output of the MOSS project, URL. The project is only a frontend built on moss-replay
and provide a simple 2D visualization for debugging. Users can choose the backend URL in the web settings to connect to their backend and databases. (match python-moss>=1.0.0)moss-webui-backend
: A web backend to provide HTTP Restful API for the database output of the MOSS project, URL. The project provides Docker images to allow users to deploy the backend easily. (match python-moss>=1.0.0)moss-ui
: A simple UI to visualize the AVRO output of the MOSS project by adapting moss-replay
to the AVRO output, URL. The project is a desktop application using web technologies, but it now faces performance challenges to manage data without a database. (match python-moss>=1.0.0, unstable)pip install python-moss
We assume that you have the map input map.pb
and the person input person.pb
generated by mosstool
. The following code is a simple demo to run the simulation.
from moss import Engine, Verbosity
from moss.export import DBRecorder
e = Engine(
"name",
"data/map.pb",
"data/person.pb",
0,
1,
output_dir="output", # AVRO output, local directory
speed_stat_interval=300, # open road status statistics
verbose_level=Verbosity.ALL,
)
recorder = DBRecorder(
e,
"postgres://user:password@url:port/simulation",
"map_db.map_coll", # map collection used for webui-backend
"name",
) # used for PostgreSQL output
for _ in range(3600):
e.next_step(1)
recorder.record()
# YOU CAN DO SOMETHING HERE
# persons = e.fetch_persons()
# ...
# save the simulation results to the database
recorder.flush()
If you are interested in the development of MOSS, you can follow the instructions below.
wget -O boost_1_86_0.tar.gz https://archives.boost.io/release/1.86.0/source/boost_1_86_0.tar.gz
tar -zxvf boost_1_86_0.tar.gz
cd boost_1_86_0
./bootstrap.sh --with-libraries=filesystem,iostreams,program_options,regex,system --prefix=/usr/local # avro dependency
./b2 cxxflags=-fPIC install
cd ..
rm -r boost_1_86_0
rm boost_1_86_0.tar.gz
mkdir build
cd build
cmake ..
make -j
./build/bin/moss -h
Usage: Moss [--help] [--version] --name VAR --config VAR [--gpu VAR] [--quiet]
Optional arguments:
-h, --help shows help message and exits
-v, --version prints version information and exits
-n, --name name of the simulation [required]
-c, --config path to config file [required]
--gpu GPU device ID [nargs=0..1] [default: 0]
-q, --quiet
The config file is a YAML file that contains the simulation parameters. You can refer to the ConfigFile in the repository. The meanings of the parameters can be found in the python package Engine's docstring in engine.py.
pip install . -v
That is what we change and why we change it.
FAQs
MObility Simulation System
We found that python-moss demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.