Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Parse OPML subscription lists in Python.
If you're building a feed reader and you need to parse OPML subscription lists, you've come to the right place!
listparser makes it easy to parse and use subscription lists in multiple formats. It supports OPML, RDF+FOAF, and the iGoogle exported settings format, and runs on Python 3.8+ and on PyPy 3.8.
.. code-block:: pycon
>>> import listparser
>>> result = listparser.parse(open("feeds.opml").read())
A dictionary will be returned with several keys:
meta
: a dictionary of information about the subscription listfeeds
: a list of feedslists
: a list of subscription listsversion
: a format identifier like "opml2"bozo
: True if there is a problem with the list, False otherwisebozo_exception
: (if bozo
is 1) a description of the problemFor convenience, the result dictionary supports attribute access for its keys.
Continuing the example:
.. code-block:: pycon
>>> result.meta.title
'listparser project feeds'
>>> len(result.feeds)
2
>>> result.feeds[0].title, result.feeds[0].url
('listparser blog', 'https://kurtmckee.org/tag/listparser')
More extensive documentation is available in the docs/
directory
and online <https://listparser.readthedocs.io/en/latest/>
_.
There are going to be bugs. The best way to handle them will be to isolate the simplest possible document that susses out the bug, add that document as a test case, and then find and fix the problem.
...you can also just report the bug and leave it to someone else to fix the problem, but that won't be as much fun for you!
Bugs can be reported on GitHub <https://github.com/kurtmckee/listparser/issues>
_.
listparser basically follows the git-flow methodology:
main
branch.
They merge back into the main
branch.main
branch.
The project metadata is updated (like the version and copyright years),
and then the release branch merges into the releases
branch.
The releases
branch is then tagged, and then it is merged back into main
.releases
branch.
As with feature releases, the project metadata is updated,
the hotfix branch merges back into the releases
branch,
which is then tagged and merged back into main
.To set up a development environment, follow these steps at a command line:
.. code-block:: shell
# Set up a virtual environment.
python -m venv .venv
# Activate the virtual environment in Linux:
. .venv/bin/activate
# ...or in Windows Powershell:
& .venv/Scripts/Activate.ps1
# Install dependencies.
python -m pip install -U pip setuptools wheel
python -m pip install poetry pre-commit tox scriv
poetry install --all-extras
# Enable pre-commit.
pre-commit install
# Run the unit tests.
tox
When submitting a PR, be sure to create and edit a changelog fragment.
.. code-block:: shell
scriv create
The changelog fragment will be created in the changelog.d/
directory.
Edit the file to describe the changes you've made.
FAQs
Parse OPML subscription lists
We found that listparser demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.