Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
nl.littlerobots.rxlint:rxlint
Advanced tools
rxlint
is a set of lint checks that check your RxJava code. There are currently three checks.
Checks if a RxJava subscriber is handling the onError()
callback.
By default, RxJava will throw an OnErrorNotImplemented
exception wrapped in an IllegalStateException
for every error that is not handled for RxJava 1.x or will call the default uncaught exception handler directly if you are using RxJava 2.x before version 2.0.6.
When subscribing on a Scheduler, like Schedulers.io()
the error will be thrown on the scheduler thread and the stack trace will have no reference to the place where you subscribed.
TL;DR you should handle onError
.
Checks that your code keeps a reference to a Subscription
(rx 1.x) or Disposable
. Not keeping a reference means that you can't unsubscribe()
or dispose()
at the appropriate times which might lead to memory leaks and crashes.
Checks if an RxJava 2.x operator is using a default scheduler. Operators like delay()
do this. This can cause errors on
Android in particular because a sequence like observable.observeOn(mainThread()).delay(10, TimeUnit.SECONDS)
will emit the value on the
default computation scheduler, and not the mainThread()
scheduler like one might think. If the subscriber is accessing views on any other thread than the main thread, will throw
an exception at runtime. This check is a warning by default.
As of 1.7.0 rxlint
supports RxKotlin
s subscribeBy
operator and checking of subscriptions that are managed by AutoDispose
.
Adding rxlint
to your project is easy, just add the following dependency to your build.gradle
:
implementation 'nl.littlerobots.rxlint:rxlint:<latest version>'
Once added to your project an error will be shown like this:
If you are calling subscribe()
with a Subscriber
(rx 1.x) or DisposableXXXSubscriber
(rx 2.x) the subscriber is not checked for handling errors, assuming that you'll handle the errors properly.
Use the @SuppressLint("RxSubscribeOnError")
annotation, lint.xml or use //noinspection AndroidLintCustomError
.
Refer to the tools documentation on lint for more info.
/*
* Copyright 2016 Little Robots
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
FAQs
The lint rule for rxjava packaged as an AAR
We found that nl.littlerobots.rxlint:rxlint demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.