Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
This is a common Python library which contains reusable components, developed at Infrae.
Sprout, while mainly XML related, does not have a functional goal as such. Its goals instead are organizational:
Enable code reuse between projects, such as Silva and Infrae's topicmaps implementation
Allow us to write modern, pure Python code without external dependencies -- it only depends on the Python standard library.
Allow us to write solid code, covered by a large unit test suite. The lack of external dependencies and focus on modern code makes this easier.
While Sprout's aim is mainly for use within Infrae at present, the code inside should be general enough for use in your own projects as well.
Sprout's focus is mainly currently XML related. It features:
sprout.saxext
, a library to make writing SAX-based code more
easy.
htmlsubset
, a system to easily create HTML-ish subsets that are
secure and robust to wrong user input.
The code for this extension can be found in Mercurial: https://hg.infrae.com/Sprout
getData
and clearData
that
wipe all data associated with the importer in one pass.Improve sprout.saxext xmlimport and xmlexport classes:
To make available user-defined options to the handlers. Those
options have to be defined with the help of registerOption
before being usuable.
To support work on temporary files and already opened files. This is
more efficient on large import and export, and prevent to create
large StringIO
objects.
Every piece of code using those classes will need to be updated to work with this new version.
Add two misisng methods for prefix mapping on the handler, in order to follow the SAX handler.
The xmlexport handler takes now arguments and keyword arguments that it passes along to child handlers.
Remove deprecated silvasubset,
Add support to register producers with adapters,
saxify as now a validate option to verify the validity of the incoming XML to work on before doing anything,
Update and clean tests.
<a>
tags, they are now
recognized but nothing is done with them. Previously, the presence
of a 'title' attribute corrupted the link.Added support for hex entities (e.g.  
for a non-breaking
space) to html2sax
.
Added support for limiting HTML, taking safe, well-formed snippets out of larger HTML strings. Can deal with HTML that is not well-formed.
sax2html
handles empty attributes in HTML now, so that <option selected>
gets turned into <option selected="selected">
.in Silva subset, accept nested <b>
, <i>
and <a href="">
in those.
Allow optional filtering handler that events get passed through before import happens.
In silva subset, treat \n
as <br>
.
In html2sax
, we're now making sure that any tags that cannot be
singletons in HTML are kept open, by adding an extra space character
event.
FAQs
Common Python library which contains reusable components, developed at Infrae.
We found that Sprout demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.