Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
“Dependency Injection” is a 25-dollar term for a 5-cent concept.
James Shore
Tired of complex abstractions? Tired of things like "to do dependency injection let's first dive into providers, scopes and binders"?
Just want dead simple syntax for injecting dependencies and mocking them inside tests?
Say no more!
pip install dimi
from dimi import Container
from typing import Annotated
from flask import Flask, jsonify
# DI container instance stores all the dependencies you place inside
di = Container()
# dependency is a function, async function or a class
# it can be added to the container via the following decorator:
@di.dependency
def get_weather_service_url():
return 'https://awesome-weather-provider.com/api'
# Dependency may have sub-dependencies defined via typing.Annotated
# For dimi mostly the second part of Annotated matters, the first part is for type checkers
@di.dependency
class WeatherService:
def __init__(self, url: Annotated[str, get_weather_service_url])
self.url = url
def get_weather(self, city): ...
app = Flask(__name__)
# Annotated[MyCls, ...] is the shortcut for Annotated[MyCls, MyCls]
@app.route("/api/weather/<city>")
@di.inject
def get_weather(city: str, weather_service: Annotated[WeatherService, ...]):
return jsonify(weather_service.get_weather())
The DI container also supports dict-like way of retrieving the dependencies:
weather_service = di[WeatherService]
print(weather_service.get_weather('london'))
Someone may ask, "Why not just do this instead?"
# the same API handle but w/o DI
@app.route("/api/weather/<city>")
def get_weather(city: str):
return jsonify(
WeatherService('https://awesome-weather-provider.com/api').get_weather(city)
)
The simplest argument for DI is easier testing.
How would you test the non-DI API handle above? I guess something nasty with monkey patches.
But with DI in action everything becomes much simpler and more obvious:
from myapp import di # app-wide instance of the Container
from myapp.services import WeatherService
def test_weather_api_handle(test_client):
class MockWeatherService:
def get_weather(self, city):
return {'temperature': 30.5, 'wind_speed': 3.1, 'city': city}
# override() preserves and restores DI container state after exit from context manager
with di.override({WeatherService: MockWeatherService}):
weather = test_client.get('/api/weather/london').json()
assert weather == {'temperature': 30.5, 'wind_speed': 3.1, 'city': 'london'}
Annotated[SomeType, some_callable]
type annotation@di.dependency
@di.inject
di.override()
Annotated[]
@di.dependency(scope=Singleton)
to cache first call of a function for the lifetime of the app.Want to know more? Welcome to the docs
FAQs
Minimalistic Dependency Injection for Python
We found that dimi demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.