
Research
Security News
Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
@lanetix/odata-ast-transformations
Advanced tools
Perform AST transformations on OData 4.0 AST parsed with @lanetix/odata-parser.
An AST transformation adaptor, intended for use with ASTs produced from https://github.com/lanetix/node-odata-parser.
npm install @lanetix/odata-ast-transformations
Example with context.
import parser from '@lanetix/odata-parser'
import astTransformer from '@lanetix/odata-ast-transformations'
// parse into AST
const ast = parser.parse("$top=10&$skip=5&$select=foo,bar")
// this ast transformation requires a context object
const context = {
securityRules: {
recordTypeBaz: [ "$select=bar"] // only bar is selectable
}
}
const securedAst = astTransformer.addSecurity(ast, context)
Example with different arg requirements.
import parser from '@lanetix/odata-parser'
import astTransformer from '@lanetix/odata-ast-transformations'
// parse into AST
const ast = parser.parse("$top=10&$skip=5&$select=foo,bar")
// this ast transformation requires a list of filters
const filtersToAdd = [
"$select=name&$filter=lanetix/id ne 456 and name ne 'bozo'",
"$filter=favorite/id eq 123",
"$filter=parent/favorite/name ne 'harry'"
]
const unifiedAst = astTransformer.intersectFilters(ast, filtersToAdd)
Common transformations:
Security Squad:
Condition Builder:
npm run repl
Commands in this module are of the format: methodName(ast, otherArgs)
.
The repl may be used by either:
withAst.methodName(otherArgs)
.withUri.methodName(otherArgs)
.In order to set the ast, you may use 2 approaches:
setAstJSON({"tag":"yes"})
// must be a minified JSON formatsetAstFILE('./test-ast.json')
In order to set the uri, you may use 2 approaches:
setUriTEXT("$select=id,lanetix/archived,lanetix/id&$filter=name eq 'Antwan'")
setUriFILE('./test-uri.json')
Resulting AST can be shown in 2 formats. Default is prettyPrint. Here are the commands to switch:
makePretty
makeNormal
// returns minified JSON. Useful for outputs to use in test fixtures.Usage of the REPL (e.g. which args you can use) are detailed in each transformation's own README. See links above.
src/index.js
export const addSecurity = (ast: AstRoot, context: MapperContext): AstRoot => {
const acc = { insideExpand: false, expandRT: '' }
const { recordType, securityRules } = context
const visitMethods = {
$select: securityTransformations.visitSelect,
$filter: securityTransformations.visitFilter,
$expand: securityTransformations.visitExpand,
$apply: securityTransformations.visitApply,
$orderby: securityTransformations.visitOrderby
}
// FIXME: security rules should already be in the mapperContext
const newContext = { recordType, securityRules, visitMethods }
return visitQueryOptions(acc, ast, newContext)
}
src/index.js
export default { addSecurity, yourNewMethodName }
visitMethods
in a separate js fileimport * as securityTransformations from './transformations/security/add-security'
// see the `src/transformations/security/add-security.js` for example methods.
Note: if you do not define a visit method for a given query option, then this query option will be returned untransformed (unchanged).
// no changes to $top, $skip, $search
const visitMethods = {
$select: securityTransformations.visitSelect,
$filter: securityTransformations.visitFilter,
$expand: securityTransformations.visitExpand,
$apply: securityTransformations.visitApply,
$orderby: securityTransformations.visitOrderby
}
To update the changelog, first npm publish <version>
then npm run build:changelog
and push to master.
This is an internal Lanetix module. Report to Lanetix internal issue tracking.
This module is a pre-walker of an AST parsed by the @lanetix/odata-parser. Additional transformations may include:
(A) transformations based on odata parameter-aliases
(B) planned future updates to security rules
(C) Any application which integrates >=2 odata uri into a single output.
FAQs
Perform AST transformations on OData 4.0 AST parsed with @lanetix/odata-parser.
The npm package @lanetix/odata-ast-transformations receives a total of 0 weekly downloads. As such, @lanetix/odata-ast-transformations popularity was classified as not popular.
We found that @lanetix/odata-ast-transformations demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 11 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.
Security News
Newly introduced telemetry in devenv 1.4 sparked a backlash over privacy concerns, leading to the removal of its AI-powered feature after strong community pushback.