Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
software.betamax:betamax-core
Advanced tools
Betamax is a tool for mocking external HTTP resources such as web services and REST APIs in your tests.
Betamax is a tool for mocking external HTTP resources in your tests. The project was inspired by the VCR library for Ruby.
This project currently has no maintainer. The ambitious 2.X release turned out to be architectually flawed, difficult to use, and even more difficult to accurately document. 2.X is essentially a failure and has been abandoned.
Documentation hosted at http://betamax.software/ is currently only for the 1.X branch and is deprecated. New documentation is being produced, but it will take some time. Please see examples in Betamax's tests and follow this readme.
In an effort to refocus the project and do some house-keeping, all relevant work has been moved to our Trello board. If you'd like to see what we're doing and where we're going with the project, please check it out!
Since 2.0.1, requires JDK7 or later.
Betamax is hosted via Sonatype and is intended to be compatible with any Maven-based build tool.
JUnit
<dependency>
<groupId>software.betamax</groupId>
<artifactId>betamax-junit</artifactId>
<version>2.0.1</version>
<scope>test</scope>
</dependency>
Specs2 Maven
<dependency>
<groupId>software.betamax</groupId>
<artifactId>betamax-specs2_2.11</artifactId>
<version>2.0.1</version>
<scope>test</scope>
</dependency>
Specs2 SBT
libraryDependencies += "software.betamax" %% "betamax-specs2" % "2.0.1" % "test"
Snapshots are made after every successful build in master, so if you want the bleeding edge, you know where to get it.
JDK 7 dramatically increased the security of the JVM, making it much more difficult to exploit man-in-the-middle attacks. Because Betamax is a legitimate use of MITM, it is necessary to configure the environment to allow Betamax to do so. This will be accomplished by installing a Betamax certificate-authority into Java's cacerts
which will allow Betamax to generate a mock-SSL certificate for any site.
For all environments where tests are being run, a one-time installation of the Betamax certificate into Java's cacerts
is necessary.
keytool -importcert -keystore $JAVA_HOME/jre/lib/security/cacerts -file betamax.pem -alias betamax -storepass changeit -noprompt
Notes:
sudo
will likely be required for unix-based operating systemsbetamax.pem
is included in the betamax-core.jar
, but it's probably best to pull it from GitHub.betamax.pem
shouldn't have a need to change for the foreseeable future, so this installation should last for the life of the tests.SecureRandom
requires a significant amount of entropy in order to generate random numbers, and when using SSL, Betamax stresses this aggressively. When SecureRandom
fails to generate a random in a given time frame (usually around 3 seconds), a test will fail with almost no indiciation as to why, other than an SSL error occurred. It is likely best to get ahead of that issue before it becomes one, especially if your CI environment is Docker/Virtual Machine based.
To ensure SecureRandom
will have adequate entropy on Unix-based systems:
sed -i -e 's/securerandom.source=file:\/dev\/random/securerandom.source=file:\/dev\/urandom/' $JAVA_HOME/jre/lib/security/java.security
Files to Ignore:
Betamax generates files with the following extensions that should not be committed to source control:
Continuous Integration Considerations:
For Docker users, please use the JDK images hosted on Docker Hub; they have the Betamax CA installed and ready to go.
For Travis CI users, please see Betamax's .travis.yml
. As of writing, sudo:required
is necessary in order to install the CA. Hopefully this won't be the case in the future.
For all other CI environments, be sure to use the keytool
command listed above to ensure the Betamax CA is installed.
Betamax Team
Additional Contributions (sorted alphabetically by last name)
Note: There were 3 others who didn't appropriately identify themselves via Git, and thus are not on this list.
FAQs
Betamax is a tool for mocking external HTTP resources such as web services and REST APIs in your tests.
We found that software.betamax:betamax-core demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.