Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
zgo.at/sconfig
sconfig
is a simple and functional configuration file parser for Go.
Import as zgo.at/sconfig
; API docs: https://godocs.io/zgo.at/sconfig
Go 1.5 and newer should work, but the test suite only runs with 1.7 and newer.
A file like this:
# This is a comment
port 8080 # This is also a comment
# Look ma, no quotes!
base-url http://example.com
# We'll parse these in a []*regexp.Regexp
match ^foo.+
match ^b[ao]r
# Two values
order allow deny
host # Idented lines are collapsed
arp242.net # My website
goatcounter.com # My other website
address arp242.net
Can be parsed with:
package main
import (
"fmt"
"os"
"zgo.at/sconfig"
// Types that need imports are in handlers/pkgname
_ "zgo.at/sconfig/handlers/regexp"
)
type Config struct {
Port int64
BaseURL string
Match []*regexp.Regexp
Order []string
Hosts []string
Address string
}
func main() {
config := Config{}
err := sconfig.Parse(&config, "config", sconfig.Handlers{
// Custom handler
"address": func(line []string) error {
addr, err := net.LookupHost(line[0])
if err != nil {
return err
}
config.Address = addr[0]
return nil
},
})
if err != nil {
fmt.Fprintf(os.Stderr, "Error parsing config: %v", err)
os.Exit(1)
}
fmt.Printf("%#v\n", config)
}
Will result in:
example.Config{
Port: 8080,
BaseURL: "http://example.com",
Match: []*regexp.Regexp{[..], [..]},
Order: []string{"allow", "deny"},
Hosts: []string{"arp242.net", "goatcounter.com"},
Address: "arp242.net",
}
=
and "
characters is just so much work man!Isn't "rolling your own" a bad idea? I don't think so. It's not that hard, and the syntax is simple/intuitive enough to be grokable by most people.
Handlers can be chained. For example the default handler for int64
is:
RegisterType("int64", ValidateSingleValue(), handleInt64)
ValidateSingleValue()
returns a type handler that will give an error if there
isn't a single value for this key; for example this is an error:
foo 42 42
There are several others as well. See Validate*()
in godoc. You can add more
complex validation handlers if you want, but in general I would recommend just
using plain ol' if
statements.
Adding things such as tag-based validation isn't a goal at this point. I'm not at all that sure this is a common enough problem that needs solving, and there are already many other packages which do this (no need to reinvent the wheel).
My personal recommendation would be zvalidate, mostly because I wrote it ;-)
Set them before parsing:
c := MyConfig{Value: "The default"}
sconfig.Parse(&c, "a-file", nil)
There is no direct built-in support for that, but there is Fields()
to list
all the field names. For example:
c := MyConfig{Foo string}
sconfig.Parse(&c, "a-file", nil)
for name, val := range sconfig.Fields(&c) {
if flag[name] != "" {
val.SetString(flag[name])
}
}
int
types? I get an error?Only int64
and uint64
are handled by default; this should be fine for almost
all use cases of this package. If you want to add any of the other (u)int types
you can do easily with your own type handler.
"lol, no generics", or something, I guess.
Note that the size of int
and uint
are platform-dependent, so adding those
may not be a good idea.
You have three options:
sconfig.RegisterType()
.encoding.TextUnmarshaler
interface.Handler
in sconfig.Parse()
.Include the package name; even if the type handler is in the same package. Do:
sconfig.RegisterType("[]main.RecordT", func(v []string) (interface{}, error) { .. }
and not:
sconfig.RegisterType("[]RecordT", func(v []string) (interface{}, error) { .. }
Replace main
with the appropriate package name.
The syntax of the file is very simple.
#
(U+0023), Backslash: \
(U+005C), Space: a space (U+0020), NULL: U+0000A file must be encoded in UTF-8.
Everything after the first Hash is considered to be a comment and will be ignored unless a Hash is immediately preceded by a Backslash.
All Whitespace is collapsed to a single Space unless a Whitespace character is preceded by a Backslash.
Any Backslash immediately preceded by a Backslash will be treated as a single Backslash.
Any Backslash immediately followed by anything other than a Hash, Whitespace, or Backslash is treated as a single Backslash.
Anything before the first Whitespace is considered the Key.
source
can be used to include other config files. The
Value for this must be a path.Anything after the first Whitespace is considered the Value.
All Lines that start with one or more Whitespace characters will be appended to the last Value, even if there are blank lines or comments in between. The leading whitespace will be removed.
Aside from those mentioned in the "But why not..." section above:
Probably others? Open an issue/PR and I'll add it.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.