Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
A pip module that let you define a __json__
method, that works like the toJSON
from JavaScript.
(e.g. it magically gets called whenever someone does json.dumps(your_object)
)
From a technical perspective, this module is a safe, backwards-compatible, reversable patch to the built-in python json
object that allows classes to specify how they should be serialized.
Because sometimes external code uses something like
import json
json.dumps(list_containing_your_object)
And it simply throws an error no matter how you customize your object
pip install json-fix
import json_fix # import this before the JSON.dumps gets called
# same file, or different file
class YOUR_CLASS:
def __json__(self):
# YOUR CUSTOM CODE HERE
# you probably just want to do:
# return self.__dict__
return "a built-in object that is natually json-able"
There's 2 ways; the aggressive override_table
or the more collaboration-friendly fallback_table
. Some really powerful stuff can be done safely with the fallback table.
If a pip module defines a class, you can control how it is json-dumped, even if they defined a .__json__()
method, by using json.override_table
.
import that_module
and THEN adding your rule to the override table.import json_fix # import this before the JSON.dumps gets called
import json
import pandas as pd
SomeClassYouDidntDefine = pd.DataFrame
# create a boolean function for identifying the class
class_checker = lambda obj: isinstance(obj, SomeClassYouDidntDefine)
# then assign it to a function that does the converting
json.override_table[class_checker] = lambda obj_of_that_class: json.loads(obj_of_that_class.to_json())
json.dumps([ 1, 2, SomeClassYouDidntDefine() ], indent=2) # dumps as expected
Let's say we want all python classes to be jsonable by default, well we can easily do that with the fallback table. The logic is if notthing in override table, and no .__json__ method, then check the fallback table
.
import json_fix # import this before the JSON.dumps gets called
import json
# a checker for custom objects
checker = lambda obj: hasattr(obj, "__dict__")
# use the __dict__ when they don't specify a __json__ method
json.fallback_table[checker] = lambda obj_with_dict: obj_with_dict.__dict__
class SomeClass:
def __init__(self):
self.thing = 10
json.dumps([ 1, 2, SomeClass() ], indent=2) # dumps as expected
Like the override table, the most recently-added checker will have the highest priority.
FAQs
allow custom class json behavior on builtin json object
We found that json-fix demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.