Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Extra stuff for click I use in basically every repo
The module more_click.options
has several options (pre-defined instances of click.option()
) that I use often. First,
verbose_option
makes it easy to adjust the logger of your package using -v
.
There are also several that are useful for web stuff, including
Name | Type | Flag |
---|---|---|
more_click.host_option | str | --host |
more_click.port_option | str | --port |
In many packages, I've included a Flask web application in wsgi.py
. I usually use the following form inside cli.py
file to import the web application and keep it insulated from other package-related usages:
# cli.py
import click
from more_click import host_option, port_option
@click.command()
@host_option
@port_option
def web(host: str, port: str):
from .wsgi import app # modify to point to your module-level flask.Flask instance
app.run(host=host, port=port)
if __name__ == '__main__':
web()
However, sometimes I want to make it possible to run via gunicorn
from the CLI, so I would use the following
extensions to automatically determine if it should be run with Flask's development server or gunicorn.
# cli.py
import click
from more_click import host_option, port_option, with_gunicorn_option, workers_option, run_app
@click.command()
@host_option
@port_option
@with_gunicorn_option
@workers_option
def web(host: str, port: str, with_gunicorn: bool, workers: int):
from .wsgi import app # modify to point to your module-level flask.Flask instance
run_app(app=app, with_gunicorn=with_gunicorn, host=host, port=port, workers=workers)
if __name__ == '__main__':
web()
For ultimate lazy mode, I've written a wrapper around the second:
# cli.py
from more_click import make_web_command
web = make_web_command('my_package_name.wsgi:app')
if __name__ == '__main__':
web()
This uses a standard wsgi
-style string to locate the app, since you don't want to be eagerly importing the app in your
CLI since it might rely on optional dependencies like Flask. If your CLI has other stuff, you can include the web
command in a group like:
# cli.py
import click
from more_click import make_web_command
@click.group()
def main():
"""My awesome CLI."""
make_web_command('my_package_name.wsgi:app', group=main)
if __name__ == '__main__':
main()
FAQs
More click.
We found that more-click demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.