Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/carlosstrand/graphql-pagination-go
This library makes it easy to create paginated fields for graphql-go. We currently have the following features:
Example:
fields := graphql.Fields{
"languages": pagination.Paginated(&pagination.PaginatedField{
Name: "Languages",
Type: graphql.String,
Args: nil,
DataResolve: func(p graphql.ResolveParams, page pagination.Page) (i interface{}, e error) {
return []string{"Go", "Javascript", "Ruby"}, nil
},
CountResolve: func(p graphql.ResolveParams, page pagination.Page) (i interface{}, e error) {
return 3, nil
},
}),
}
rootQuery := graphql.ObjectConfig{Name: "RootQuery", Fields: fields}
schemaConfig := graphql.SchemaConfig{Query: graphql.NewObject(rootQuery)}
Now you can query as below:
query {
languages(limit: 10, skip: 20) {
data
count
}
}
This library already has the limit
and skip
arguments ready to be used in a query with the database or external service. See the following example:
var DataResolver = func(p graphql.ResolveParams, page pagination.Page) (i interface{}, e error) {
users, err := users.FindMany(db.Filter{
Limit: page.Limit,
Skip: page.Skip,
})
if err != nil {
return nil, err
}
return users, nil
}
In some datasources or databases like MongoDB, calling a count comes at an additional cost and is not always used. Thus, this library takes care of resolvers only of the requested fields (data and / or count).
query {
languages {
count
}
}
As you can see in example above, only the CountResolve
you be called and the query will not have the cost of calling DataResolve because data
was not requested.
If your API or your Database already returns Data and Count, you can use DataAndCountResolver. Example:
fields := graphql.Fields{
"languages": pagination.Paginated(&PaginatedField{
Name: "Languages",
Type: graphql.String,
Args: nil,
DataAndCountResolve: func(p graphql.ResolveParams, page Page) (interface{}, int, error) {
return []string{"Go", "Javascript", "Ruby", "Elixir"}, 4, nil
},
}),
}
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.