Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
io.mola.galimatias:galimatias
Advanced tools
galimatias is a library for URL parsing, canonicalization and manipulation.
galimatias is a URL parsing and normalization library written in Java.
galimatias is not a generic URI parser. It can parse any URI, but only schemes defined in the URL Standard (i.e. http, https, ftp, ws, wss, gopher, file) will be parsed as hierarchical URIs. For example, in git://github.com/smola/galimatias.git
you'll be able to extract scheme (i.e. git
) and scheme data (i.e. //github.com/smola/galimatias.git
), but not host (i.e. github.com
). This is intended. We cannot guarantee that applying a set of generic rules won't break certain kind of URIs, so we do not try with them. I will consider adding further support for other schemes if enough people provides solid use cases and testing. You can check this issue if you are interested.
galimatias started out of frustration with java.net.URL and java.net.URI. Both of them are good for basic use cases, but severely broken for others:
java.net.URI can pase only RFC 2396 URI syntax. java.net.URI
will only parse a URI if it's strictly compliant with RFC 2396. Most URLs found in the wild do not comply with any syntax standard, and RFC 2396 is outdated anyway.
java.net.URI is not protocol-aware. http://example.com
, http://example.com/
and http://example.com:80
are different entities.
Manipulation is a pain. I haven't seen any URL manipulation code using java.net.URL
or java.net.URI
that is simple and concise.
Not IDN ready. Java has IDN support with java.net.IDN
, but this does not apply to java.net.URL
or java.net.URI
.
galimatias is available at Maven Central. Just add to your pom.xml <dependencies>
section:
<dependency>
<groupId>io.mola.galimatias</groupId>
<artifactId>galimatias</artifactId>
<version>0.1.0</version>
</dependency>
Development snapshots are also available at Sonatype OSS Snapshots repository.
// Parse
String urlString = //...
URL url;
try {
url = URL.parse(urlString);
} catch (GalimatiasParseException ex) {
// Do something with non-recoverable parsing error
}
URL url = //...
java.net.URL javaURL;
try {
javaURL = url.toJavaURL();
} catch (MalformedURLException ex) {
// This can happen if scheme is not http, https, ftp, file or jar.
}
URL url = //...
java.net.URI javaURI;
try {
javaURI = url.toJavaURI();
} catch (URISyntaxException ex) {
// This will happen in rare cases such as "foo://"
}
You can use a strict error handler that will throw an exception on any invalid URL, even if it's a recovarable error.
URLParsingSettings settings = URLParsingSettings.create()
.withErrorHandler(StrictErrorHandler.getInstance());
URL url = URL.parse(settings, urlString);
Check out the Javadoc.
Did you find a bug? Report it on GitHub.
Did you write a patch? Send a pull request.
Something else? Email me at santi@mola.io.
Copyright (c) 2013-2014 Santiago M. Mola santi@mola.io
galimatias is released under the terms of the MIT License.
FAQs
galimatias is a library for URL parsing, canonicalization and manipulation.
We found that io.mola.galimatias:galimatias demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.