Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
sc.ala:http-mock_2.11
Advanced tools
Real http server for stubbing and expectations in Scala
import sc.ala.http.mock._
val server = HttpMock.start()
server.port // => 37781 (automatically set by default)
// send requests to "http://127.0.0.1:37781" (or server.url)
server.stop
val server = HttpMock.start(9000)
server.port // => 9000
val server = HttpMock.start(9000) // GET: ok
val stopped = server.stop() // GET: error
val restarted = stopped.start() // GET: ok
run()
ensures server.stop()
after actionHttpMock.run() { server => ... }
HttpMock.run(port) { server => ... }
Setting(port).run() { server => ... }
val server = Setting(methods = Set(GET, POST)).start()
/*
GET => 200
POST => 200
PUT => 404
*/
val server = Setting(handler = {
case h: RequestHeader if h.version == "HTTP/1.0" => Results.HttpVersionNotSupported
})
/*
GET => 200
GET with HTTP/1.0 => 505
*/
import sc.ala.http.mock._
import scala.concurrent.duration._
val server = HttpMock.start(9000)
curl http://127.0.0.1:9000/
server.logs.expect(GET , count = 1)(1.second) // (PASS)
server.logs.expect(GET , count = 2)(1.second) // java.lang.AssertionError
server.logs.expect(POST, count = 1)(1.second) // java.lang.AssertionError
server.stop()
curl -X POST -H "Content-type: application/octet-stream" http://127.0.0.1:9000/ -d foo
curl -X POST -H "Content-type: application/octet-stream" http://127.0.0.1:9000/ -d bar
curl -X POST -H "Content-type: application/octet-stream" -H "X-ID: 1" http://127.0.0.1:9000/ -d bar
server.logs.expect(POST).body("foo")(1.second) // (PASS)
server.logs.expect(POST).body("bar")(1.second) // java.lang.AssertionError
server.logs.expect(POST).body("bar").count(2)(1.second) // (PASS)
server.logs.expect(POST).body("baz")(1.second) // java.lang.AssertionError
server.logs.expect(POST).header("X-ID", "1")(1.second) // (PASS)
server.stop()
curl -X POST -H "Content-type: application/octet-stream" http://127.0.0.1:9000/ -d foo
curl -X POST -H "Content-type: application/octet-stream" http://127.0.0.1:9000/ -d bar
curl -X POST -H "Content-type: application/octet-stream" -H "X-ID: 1" http://127.0.0.1:9000/ -d bar
server.logs.expect(POST).bodies(Set("foo", "bar"))(1.second) // (PASS)
server.logs.expect(POST).bodies(Set("bar", "foo"))(1.second) // (PASS)
server.logs.expect(POST).bodies(Set("foo", "XXX"))(1.second) // java.lang.AssertionError
server.stop()
import sc.ala.http.mock._
import scala.concurrent.duration._
import org.scalatest.FunSpec
class FooSpec extends FunSpec {
describe("foo") {
it("test with real httpd") {
HttpMock.run { server =>
// your application logic to `server.url`
...
// assert your requests like this
server.logs.expect(POST, count = 2)(3.seconds)
}
}
}
}
See build.sbt
% sbt
> + compile
> + publishSigned
> + sonatypeRelease
If you got Unable to find credentials
in publishSigned
phase,
it might have to do with credentials at ~/.sbt/0.13/sonatype.sbt
.
[error] Unable to find credentials for [Sonatype Nexus Repository Manager @ oss.sonatype.org].
[trace] Stack trace suppressed: run last *:publishSigned for the full output.
[error] (*:publishSigned) java.io.IOException: Access to URL https://oss.sonatype.org/service/local/staging/deploy/maven2/sc/ala/http-mock_2.11/0.3.3/http-mock_2.11-0.3.3-javadoc.jar was refused by the server: Unauthorized
See: http://www.scala-sbt.org/release/docs/Using-Sonatype.html
FAQs
Real http server for stubbing and expectations in Scala
We found that sc.ala:http-mock_2.11 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.