Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/romshark/yamagiconf
The heavily opinionated YAML Magic Configuration framework for Go keeps your configs simple and consistent by being more restrictive than your regular YAML parser 🚷 allowing only a subset of YAML and enforcing some restrictions to the target Go type.
If you hate YAML, and you're afraid of YAML documents from hell, and you can't stand complex, unexplorable and unintuitive configurations then yamagiconf is for you!
🪄 It's magic because it uses reflect to find recursively all
values of types that implement interface { Validate() error }
and calls them reporting
an error annotated with line and column in the YAML file if necessary.
any
, int
& uint
(unspecified width), and other types.
Only maps, slices, arrays and deterministic primitives are allowed.yaml
struct tags on all exported fields.env
struct tags to be POSIX-style.env
struct tag on non-primitive fields.
Allows only floats, ints, strings, bool and types that implement the
encoding.TextUnmarshaler
interface.env
on primitive fields implementing
the yaml.Unmarshaler
interface.yaml
and env
struct tags within implementations of
encoding.TextUnmarshaler
and/or
yaml.Unmarshaler
."inline"
for non-embedded structs and
requires embedded structs to use option "inline"
.no
, yes
, on
and off
for bool
,
allows only true
and false
.~
, Null
and other variations, allows only null
for nilables.null
to non-nilables (which normally would assign zero value).null
value (no value) like foo: &bar
.encoding.TextUnmarshaler
interface.Validate
interface,
then its validation method will be called using reflection
(doesn't apply to unexported fields which are invisible to reflect
).
If it returns an error - the error will be reported.
Keeps your validation logic close to your configuration type definitions.line:column
when possible.env
struct tags to overwrite fields from env vars if provided.encoding.TextUnmarshaler
and yaml.Unmarshaler
(except for the root struct type).time.Duration
.https://go.dev/play/p/PjV0aG7uIUH
list:
- foo: valid
bar: valid
- foo: valid
bar: valid
map:
valid: valid
secret: 'this will be overwritten from env var SECRET'
required: 'this must not be empty'
package main
import (
"fmt"
"github.com/romshark/yamagiconf"
)
type Config struct {
List []Struct `yaml:"list"`
Map map[ValidatedString]ValidatedString `yaml:"map"`
// Secret will be overwritten if env var SECRET is set.
Secret string `yaml:"secret" env:"SECRET"`
// See https://github.com/go-playground/validator
// for all available validation tags
Required string `yaml:"required" validate:"required"`
}
type Struct struct {
Foo string `yaml:"foo"`
Bar ValidatedString `yaml:"bar"`
}
// Validate will automatically be called by yamagiconf
func (v *Struct) Validate() error {
if v.Foo == "invalid" {
return fmt.Errorf("invalid foo")
}
if v.Bar == "invalid" {
return fmt.Errorf("invalid bar")
}
return nil
}
type ValidatedString string
// Validate will automatically be called by yamagiconf
func (v ValidatedString) Validate() error {
if v == "invalid" {
return fmt.Errorf("string is invalid")
}
return nil
}
func main() {
var c Config
if err := yamagiconf.LoadFile("./config.yaml", &c); err != nil {
fmt.Println("Whoops, something is wrong with your config!", err)
}
fmt.Printf("%#v\n", c)
}
Consider the following YAML array:
array:
-
- ''
- ""
- x
Even though this YAML array works as expect with a Go array:
[4]string{"", "", "", "x"}
, parsing the same YAML into a Go slice will result in
the empty item being ommited: []string{"", "", "x"}
which is counterintuitive.
Therefore, yamagiconf forbids empty array items in general to keep behavior
consistent and intuitive independent of the Go target type.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.