Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
gosrc.io/xmpp
Fluux XMPP is a Go XMPP library, focusing on simplicity, simple automation, and IoT.
The goal is to make simple to write simple XMPP clients and components:
The library is designed to have minimal dependencies. Currently it requires at least Go 1.13.
It is not recommended to disable the check for domain name and certificate chain. Doing so would open your client to man-in-the-middle attacks.
However, in development, XMPP servers often use self-signed certificates. In that situation, it is better to add the root CA that signed the certificate to your trusted list of root CA. It avoids changing the code and limit the risk of shipping an insecure client to production.
That said, if you really want to allow your client to trust any TLS certificate, you can customize Go standard
tls.Config
and set it in Config struct.
Here is an example code to configure a client to allow connecting to a server with self-signed certificate. Note the
InsecureSkipVerify
option. When using this tls.Config
option, all the checks on the certificate are skipped.
config := xmpp.Config{
Address: "localhost:5222",
Jid: "test@localhost",
Credential: xmpp.Password("Test"),
TLSConfig: tls.Config{InsecureSkipVerify: true},
}
XMPP stanzas are basic and extensible XML elements. Stanzas (or sometimes special stanzas called 'nonzas') are used to leverage the XMPP protocol features. During a session, a client (or a component) and a server will be exchanging stanzas back and forth.
At a low-level, stanzas are XML fragments. However, Fluux XMPP library provides the building blocks to interact with stanzas at a high-level, providing a Go-friendly API.
The stanza
subpackage provides support for XMPP stream parsing, marshalling and unmarshalling of XMPP stanza. It is a
bridge between high-level Go structure and low-level XMPP protocol.
Parsing, marshalling and unmarshalling is automatically handled by Fluux XMPP client library. As a developer, you will generally manipulates only the high-level structs provided by the stanza package.
The XMPP protocol, as the name implies is extensible. If your application is using custom stanza extensions, you can implement your own extensions directly in your own application.
To learn more about the stanza package, you can read more in the stanza package documentation.
TODO
TODO
We have several examples to help you get started using Fluux XMPP library.
Here is the demo "echo" client:
package main
import (
"fmt"
"log"
"os"
"gosrc.io/xmpp"
"gosrc.io/xmpp/stanza"
)
func main() {
config := xmpp.Config{
TransportConfiguration: xmpp.TransportConfiguration{
Address: "localhost:5222",
},
Jid: "test@localhost",
Credential: xmpp.Password("test"),
StreamLogger: os.Stdout,
Insecure: true,
// TLSConfig: tls.Config{InsecureSkipVerify: true},
}
router := xmpp.NewRouter()
router.HandleFunc("message", handleMessage)
client, err := xmpp.NewClient(config, router, errorHandler)
if err != nil {
log.Fatalf("%+v", err)
}
// If you pass the client to a connection manager, it will handle the reconnect policy
// for you automatically.
cm := xmpp.NewStreamManager(client, nil)
log.Fatal(cm.Run())
}
func handleMessage(s xmpp.Sender, p stanza.Packet) {
msg, ok := p.(stanza.Message)
if !ok {
_, _ = fmt.Fprintf(os.Stdout, "Ignoring packet: %T\n", p)
return
}
_, _ = fmt.Fprintf(os.Stdout, "Body = %s - from = %s\n", msg.Body, msg.From)
reply := stanza.Message{Attrs: stanza.Attrs{To: msg.From}, Body: msg.Body}
_ = s.Send(reply)
}
func errorHandler(err error) {
fmt.Println(err.Error())
}
The code documentation is available on GoDoc: gosrc.io/xmpp
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.