Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
opal-fetcher-mongodb
Advanced tools
An OPAL fetch provider to bring authorization state from MongoDB.
Check out OPAL main repo here.
An OPAL custom fetch provider to bring authorization state from MongoDB.
You can test this fetcher with the example docker compose file in this repository root. Clone this repo, cd
into the cloned repo, and then run:
docker compose up
this docker compose configuration already correctly configures OPAL to load the MongoDB Fetch Provider, and correctly configures OPAL_DATA_CONFIG_SOURCES
to include an entry that uses this fetcher.
Dockerfile
The official docker image only contains the built-in fetch providers. You need to create your own Dockerfile
(that is based on the official docker image), that includes this fetcher's pip package.
Your Dockerfile
should look like this:
FROM permitio/opal-client:latest
RUN pip install --no-cache-dir --user opal-fetcher-mongodb
Say your special Dockerfile from step one is called custom_client.Dockerfile
.
You must build a customized OPAL container from this Dockerfile, like so:
docker build -t yourcompany/opal-client -f custom_client.Dockerfile .
OPAL_FETCH_PROVIDER_MODULES
Pass the following environment variable to the OPAL client docker container (comma-separated provider modules):
OPAL_FETCH_PROVIDER_MODULES=opal_common.fetcher.providers,opal_fetcher_mongodb.provider
Notice that OPAL receives a list from where to search for fetch providers.
The list in our case includes the built-in providers (opal_common.fetcher.providers
) and our custom MongoDB provider.
Your DataSourceEntry objects (either in OPAL_DATA_CONFIG_SOURCES
or in dynamic updates sent via the OPAL publish API) can now include this fetcher's config.
Example value of OPAL_DATA_CONFIG_SOURCES
(formatted nicely, but in env var you should pack this to one-line and no-spaces):
{
"config": {
"entries": [
{
"url": "mongodb://user:password@mongodb/test_database?authSource=admin",
"config": {
"fetcher": "MongoDBFetchProvider",
"database": "opal_fetcher_mongodb",
"collection": "cities_collection",
"find": { "query": {} }
},
"topics": ["policy_data"],
"dst_path": "cities"
}
]
}
}
Notice how config
is an instance of MongoDBFetchProvider
(code is in opal_fetcher_mongodb/provider.py
).
Values for this fetcher config:
url
is actually a MongoDB uri.config
must include the fetcher
key to indicate to OPAL that you use a custom fetcher.config
must include the collection
key to indicate what collection to query in MongoDB.config
may include the database
key to indicate what database to query in MongoDB. If not specified, the default database will be used.config
must include one of findOne
, find
or aggregate
keys to indicate what query to run against MongoDB.config
may include the transform
key to transform the results from the find
or aggregate
queries.All the three available query methods accept the same input parameters as defined in the MongoDB documentation.
findOne
- MongoDB docs{
"config": {
"entries": [
{
...
"config": {
...
"findOne": {
"query": {
...
},
"projection": {
...
},
"options": {
...
}
}
}
}
]
}
}
find
- MongoDB docs{
"config": {
"entries": [
{
...
"config": {
...
"find": {
"query": {
...
},
"projection": {
...
},
"options": {
...
}
},
"transform": {
"first": false,
"mapKey": "",
"merge": true
}
}
}
]
}
}
aggregate
- MongoDB docs{
"config": {
"entries": [
{
...
"config": {
...
"aggregate": {
"pipeline": [
...
],
"options": {
...
}
},
"transform": {
"first": false,
"mapKey": ""
}
}
}
]
}
}
transform
allows you to transform the results from the find
or aggregate
queries.
transform.first
allows you to return only the first result from the query.
Equivalent to the following Python code:
result = query_result[0]
transform.mapKey
allows you to map the original list-like result to a dictionary-like result using the property specified in the mapKey
as the key for the dictionary.
Equivalent to the following Python code:
result = {}
for item in query_result:
result[item['key']] = item
Only properties in the root of the document can be used as the key for the dictionary.
transform.merge
allows you to merge the results from the query into a single document. Duplicate keys will be overwritten by the last document in the list.
Equivalent to the following Python code:
result = {}
for item in query_result:
for key, value in item.items():
result[key] = value
We invite all developers who use Treedom's open-source code to support our mission of sustainability by planting a tree with us. By contributing to reforestation efforts, you help create a healthier planet and give back to the environment. Visit our Treedom Open Source Forest to plant your tree today and join our community of eco-conscious developers.
Additionally, you can integrate the Treedom GitHub badge into your repository to showcase the number of trees in your Treedom forest and encourage others to plant new ones. Check out our integration guide to get started.
Together, we can make a lasting impact! 🌍💚
FAQs
An OPAL fetch provider to bring authorization state from MongoDB.
We found that opal-fetcher-mongodb demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.