Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
The package provides base classes and utils for flake8 plugin writing.
pip install flake8-plugin-utils
Write simple plugin
from flake8_plugin_utils import Error, Visitor, Plugin
class MyError(Error):
code = 'X100'
message = 'my error'
class MyVisitor(Visitor):
def visit_ClassDef(self, node):
self.error_from_node(MyError, node)
class MyPlugin(Plugin):
name = 'MyPlugin'
version = '0.1.0'
visitors = [MyVisitor]
and test it with pytest
from flake8_plugin_utils import assert_error, assert_not_error
def test_code_with_error():
assert_error(MyVisitor, 'class Y: pass', MyError)
def test_code_without_error():
assert_not_error(MyVisitor, 'x = 1')
To add configuration to a plugin, do the following:
add_options
in your plugin class, as per the
flake8 docs.parse_options_to_config
in your plugin class
to return any object holding the options you need.__init__
for your visitor, make sure it accepts
a keyword argument named config
and pass it to super().__init__
self.config
in visitor code.Example:
from flake8_plugin_utils import Error, Visitor, Plugin, assert_error
class MyError(Error):
code = 'X100'
message = 'my error with {thing}'
class MyConfig:
def __init__(self, config_option):
self.config_option = config_option
class MyVisitorWithConfig(Visitor):
def visit_ClassDef(self, node):
self.error_from_node(
MyError, node, thing=f'{node.name} {self.config.config_option}'
)
class MyPluginWithConfig(Plugin):
name = 'MyPluginWithConfig'
version = '0.0.1'
visitors = [MyVisitorWithConfig]
@classmethod
def add_options(cls, options_manager):
options_manager.add_option('--config_option', parse_from_config=True, ...)
@classmethod
def parse_options_to_config(cls, option_manager, options, args):
return MyConfig(config_option=options.config_option)
def test_code_with_error():
assert_error(
MyVisitorWithConfig,
'class Y: pass',
MyError,
config=MyConfig(config_option='123'),
thing='Y 123',
)
Your Error
s can take formatting arguments in their message
:
from flake8_plugin_utils import Error, Visitor, assert_error
class MyFormattedError(Error):
code = 'X101'
message = 'my error with {thing}'
class MyFormattedVisitor(Visitor):
def visit_ClassDef(self, node):
self.error_from_node(MyFormattedError, node, thing=node.name)
def test_code_with_error():
assert_error(
MyFormattedVisitor,
'class Y: pass',
MyFormattedError,
thing='Y',
)
The Plugin
and Visitor
classes are generic with the config class as type
parameter. If your plugin does not have any config, inherit it from
Plugin[None]
and the visitors from Visitor[None]
. Otherwise, use the
config class as the type parameter (e.g. Plugin[MyConfig]
and
Visitor[MyConfig]
in the above example).
assert_error
, assert_not_error
Utilities for testing visitors (see examples above).
is_true
, is_false
, is_none
Convenience functions to check if an AST node represents a
True
/False
/None
value.
check_equivalent_nodes
Checks if two given AST nodes are equivalent.
The nodes are considered equivalent in the following cases:
**expansions
taken into accountmake help
make init
make precommit
make pretty lint test
make bump_major
make bump_minor
make bump_patch
check_equivalent_nodes
utility functionconfig
argument to assert_error
and assert_not_error
Plugin[None]
and Visitor[None]
to fix.FAQs
The package provides base classes and utils for flake8 plugin writing
We found that flake8-plugin-utils demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.