Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/serhiy-t/errf
Declarative error handling for Go.
Reading list:
ErrorFlow goal is to provide a library solution to the issues raised in articles above.
Library solution (as opposed to a language change), although less clean, has a very important benefit: it is optional. Many language proposals for addressing this issue have been rejected because language change is required to be universally applicable. Library solution can be used only for use cases where it works well.
reader := errf.Io.CheckReadCloser(os.Open(srcFilename))
/* vs */
reader, err := os.Open(srcFilename)
if err != nil {
return err
}
defer errf.IfError().ReturnFirst().ThenAssignTo(&err)
defer errf.CheckDeferErr(writer.Close)
/* vs */
defer func() {
closeErr := writer.Close()
if closeErr != nil and err == nil {
err = closeErr
}
}()
defer errf.IfError().LogIfSuppressed().ThenAssignTo(&err)
defer errf.CheckDeferErr(writer.Close)
/* vs */
defer func() {
closeErr := writer.Close()
if closeErr != nil {
if err == nil {
err = closeErr
} else {
log.Printf("error closing writer: %w", err)
}
}
}()
Error handling requirements for function:
func GzipFile(dstFilename string, srcFilename string) (err error) {
// defer IfError()... creates and configures
// ErrorFlow error handler for this function.
// When any of Check* functions encounters non-nil error
// it immediately sends error to this handler
// unwinding all stacked defers.
errWrapper := errf.WrapperFmtErrorw("error compressing file")
defer errf.IfError().ReturnFirst().LogIfSuppressed().Apply(errWrapper).ThenAssignTo(&err)
errf.CheckAssert(len(dstFilename) > 0, "dst file should be specified")
errf.CheckAssert(len(srcFilename) > 0, "src file should be specified")
reader := errf.Io.CheckReadCloser(os.Open(srcFilename))
defer errf.With(errWrapper).LogDefer(reader.Close)
writer := errf.Io.CheckWriteCloser(os.Create(dstFilename))
defer errf.Handle().OnAnyErrOrPanic(func() { os.Remove(dstFilename) })
defer errf.CheckDeferErr(writer.Close)
gzipWriter := gzip.NewWriter(writer)
defer errf.CheckDeferErr(gzipWriter.Close)
return errf.CheckDiscard(io.Copy(gzipWriter, reader)).IfOkReturnNil
}
func GzipFile(dstFilename string, srcFilename string) error {
reader, _ := os.Open(srcFilename)
defer reader.Close()
writer, _ := os.Create(dstFilename)
defer writer.Close()
gzipWriter := gzip.NewWriter(writer)
defer gzipWriter.Close()
_, _ = io.Copy(gzipWriter, reader)
return nil
}
func GzipFile(dstFilename string, srcFilename string) (err error) {
if len(dstFilename) == 0 {
return fmt.Errorf("error compressing file: dst file should be specified")
}
if len(srcFilename) == 0 {
return fmt.Errorf("error compressing file: src file should be specified")
}
reader, err := os.Open(srcFilename)
if err != nil {
return fmt.Errorf("error compressing file: %w", err)
}
defer func() {
closeErr := reader.Close()
if closeErr != nil {
log.Println(closeErr)
}
}()
writer, err := os.Create(dstFilename)
if err != nil {
return fmt.Errorf("error compressing file: %w", err)
}
defer func() {
if err != nil {
os.Remove(dstFilename)
}
}()
defer func() {
closeErr := writer.Close()
if closeErr != nil {
if err == nil {
err = fmt.Errorf("error compressing file: %w", closeErr)
} else {
log.Println(fmt.Errorf("[suppressed] error compressing file: %w", closeErr))
}
}
}()
gzipWriter := gzip.NewWriter(writer)
defer func() {
closeErr := gzipWriter.Close()
if closeErr != nil {
if err == nil {
err = fmt.Errorf("error compressing file: %w", closeErr)
} else {
log.Println(fmt.Errorf("[suppressed] error compressing file: %w", closeErr))
}
}
}()
_, err = io.Copy(gzipWriter, reader)
if err != nil {
return fmt.Errorf("error compressing file: %w", err)
}
return nil
}
func GzipFile(dstFilename string, srcFilename string) (err error) {
errflow := errf.With(
errf.LogStrategyIfSuppressed,
errf.WrapperFmtErrorw("error compressing file"),
)
if len(dstFilename) == 0 {
return fmt.Errorf("error compressing file: dst file should be specified")
}
if len(srcFilename) == 0 {
return fmt.Errorf("error compressing file: src file should be specified")
}
reader, err := os.Open(srcFilename)
if err != nil {
return fmt.Errorf("error compressing file: %w", err)
}
defer errflow.LogDefer(reader.Close)
writer, err := os.Create(dstFilename)
if err != nil {
return fmt.Errorf("error compressing file: %w", err)
}
defer func() {
if err != nil {
os.Remove(dstFilename)
}
}()
defer errflow.IfErrorAssignTo(&err, writer.Close)
gzipWriter := gzip.NewWriter(writer)
defer errflow.IfErrorAssignTo(&err, gzipWriter.Close)
_, err = io.Copy(gzipWriter, reader)
if err != nil {
return fmt.Errorf("error compressing file: %w", err)
}
return nil
}
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.