
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Session extensions for Tornado,Support memory, file, redis or memcached to save session data.
Torndsession <https://github.com/MitchellChu/torndsession>
_ is a session extension for Tornado <https://github.com/tornadoweb/tornado>
__ web framework.
Torndsession support application memory, file, redis or memcached to save session data for request, and it's easy to extend for developer.
Documentation <http://blog.useasp.net/category/30.aspx>
_
Source (github) <https://github.com/MitchellChu/torndsession>
_
Torndsession License <https://raw.githubusercontent.com/MitchellChu/torndsession/master/LICENSE>
_
Examples <https://github.com/MitchellChu/torndsession/tree/master/demos>
_
Here is a simple "Hello, Session" example web app for Tornado with Torndsession.::
import tornado.web
import tornado.httpserver
import tornado.ioloop
import torndsession
class Application(tornado.web.Application):
def __init__(self):
handlers = [
(r"/", MainHandler),
]
settings = dict(
debug=True,
)
# sid_name, lifetime added in 1.1.5.0
# sid_name: the name of session id in cookies.
# lifetime: session default expires seconds.
session_settings = dict(
driver='memory',
driver_settings={'host': self},
force_persistence=True,
sid_name='torndsessionID',
session_lifetime=1800
),
settings.update(session=session_settings)
tornado.web.Application.__init__(self, handlers, **settings)
class MainHandler(torndsession.sessionhandler.SessionBaseHandler):
def get(self):
self.write("Hello, Session.<br/>")
if 'data' in self.session:
data = self.session['data']
else:
data = 0
self.write('data=%s' % data)
self.session["data"] = data + 1
def main():
http_server = tornado.httpserver.HTTPServer(Application())
http_server.listen(8000)
tornado.ioloop.IOLoop.instance().start()
if __name__ == "__main__":
main()
In this example, Request handler obtain memory session feature, it just inherit from SessionBaseHandler. more session example see torndsession demos <https://github.com/MitchellChu/torndsession/tree/master/demos>
_.
Automatic installation:
::
pip install torndsession
Torndsession is listed in PyPI <https://pypi.python.org/pypi/torndsession>
__ and can be installed with pip
or easy_install
. Note that this installation can not install demos applicatinos which be included in source code.
The another way is use git+
install torndsession from github.
::
pip install git+https://github.com/mitchellchu/torndsession
Manual installation:
In this way, you need download the source from PyPI <https://pypi.python.org/pypi/torndsession>
__.::
tar xvzf torndsession.tar.gz
cd torndsession
python setup.py build
sudo python setup.py install
The Torndsession source code is hosted on GitHub <https://github.com/MitchellChu/torndsession>
_.
Torndsession 1.1.5:
fixed bug in 1.1.4
default session id value generator changed. see #ISSUE 12# <https://github.com/MitchellChu/torndsession/issues/12>
_.
added two custom key in settings.
Torndsession 1.1.4:
Torndsession 1.1.3 fixed some bug and supported python 3.x.
Tornado <https://github.com/tornadoweb/tornado>
__Redis (Optional) <http://redis.io/>
_Memcached (Optional) <http://memcached.org/>
_Torndsession is licensed under MIT.
FAQs
Session extensions for Tornado,Support memory, file, redis or memcached to save session data.
We found that torndsession demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.