Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
git-http-mock-server
Advanced tools
Clone and push to git repository test fixtures over HTTP or SSH.
It is similar to git-http-server
but designed for test cases only.
It uses copy-on-write so that pushing to the repo doesn't actually alter the repo.
Run in a directory full of bare git repositories, git-http-mock-server
will serve those repos using the
native git-http-backend
process built into git
(which needs to be installed on the machine).
You can then:
Git hooks such as hooks/update
and hooks/post-receive
are automatically supported.
It also supports HTTP Basic Auth password protection of repos so you can test how your code handles 401 errors.
Using isomorphic-git
and testing things from browsers? Fear not, git-http-mock-server
includes appropriate CORS headers.
git-ssh-mock-server
is similar, but because authentication happens before the client can say which repo
they are interested in, the authentication can't be customized per repository.
By default it allows anonymous SSH access. You can disable anonymous access and activate password authentication by setting the GIT_SSH_MOCK_SERVER_PASSWORD
evironment variable.
(When password auth is activated, any username will work as long as the password matches the environment variable.)
Alternatively, you can set the GIT_SSH_MOCK_SERVER_PUBKEY
environment variable to true to disable anonymous access and activate Public Key authentication. What key to use is explained in detail later in this document.
npm install --save-dev git-http-mock-server
Now cd
to a directory in which you have some bare git repos and run this server:
> cd __fixtures__
> ls
test-repo1.git test-repo2.git imaginatively-named-repo.git
> git-http-mock-server
Now in another shell, clone and push away...
> git clone http://localhost:8174/test-repo1.git
> git clone http://localhost:8174/test-repo2.git
> git clone http://localhost:8174/imaginatively-named-repo.git
To do the same thing but with SSH
> cd __fixtures__
> ls
test-repo1.git test-repo2.git imaginatively-named-repo.git
> git-ssh-mock-server
Now in another shell,
> git clone ssh://localhost:2222/imaginatively-named-repo.git
If you want to reuse the same shell (as part of a shell script, for example) you can run the server as a daemon in the background:
> git-http-mock-server start
> # do stuff
> git-http-mock-server stop
Just be sure to run start
and stop
from the same working directory.
(The start
command writes the PID of the server to ./git-http-mock-server.pid
so that the stop
command knows what process to kill.)
Same thing for SSH:
> git-ssh-mock-server start
> # do stuff
> git-ssh-mock-server stop
GIT_HTTP_MOCK_SERVER_PORT
default is 8174 (to be compatible with git-http-server)GIT_HTTP_MOCK_SERVER_ROUTE
default is /
GIT_HTTP_MOCK_SERVER_ROOT
default is process.cwd()
GIT_HTTP_MOCK_SERVER_ALLOW_ORIGIN
default is *
(used for CORS)GIT_SSH_MOCK_SERVER_PORT
default is 2222GIT_SSH_MOCK_SERVER_ROUTE
default is /
GIT_SSH_MOCK_SERVER_ROOT
default is process.cwd()
GIT_SSH_MOCK_SERVER_PASSWORD
activate Password Authentication and use this password (leave blank to allow anonymous SSH access.)GIT_SSH_MOCK_SERVER_PUBKEY
activate PubKey Authentication using the self-generated keypair (leave blank to allow anonymous SSH access.)You can place an Apache-style .htpasswd
file in a bare repo to protect it with Basic Authentication.
> cd __fixtures__/test-repo1.git
> htpasswd -cb .htpasswd testuser testpassword
Adding password for user testuser.
> cat .htpasswd
testuser:$apr1$BRdvH4Mu$3HrpeyBrWiS88GcSPidgq/
If you don't have htpasswd
on your machine, you can use htpasswd which is
a cross-platform Node implementation of htpasswd
.
git-ssh-mock-server
generates its own keypair using the system's native ssh-keygen
the first time it's run,
in order to create encrypted SSH connections.
This key can be used to authenticate with the server as well!
GIT_SSH_MOCK_SERVER_PUBKEY=true git-ssh-mock-server
git clone ssh://localhost:2222/imaginatively-named-repo.git
). It shouldn't work.git-ssh-mock-server exportKeys
which will copy the key files to ./id_rsa
and ./id_rsa.pub
in the working directory with the correct file permissions (600
).ssh-add ./id_rsa
ssh-add -d ./id_rsa
You can use GIT_SSH_MOCK_SERVER_PUBKEY
and GIT_SSH_MOCK_SERVER_PASSWORD
together, but using either one disables anonymous SSH access.
originally inspired by 'git-http-server'
MIT
1.2.0 - add SSH server 1.1.0 - support running in background and CORS headers 1.0.0 - Initial release
FAQs
Clone and push to git repository test fixtures over HTTP.
The npm package git-http-mock-server receives a total of 211 weekly downloads. As such, git-http-mock-server popularity was classified as not popular.
We found that git-http-mock-server demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.