Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
py-gql is a pure python GraphQL implementation aimed at creating GraphQL servers and providing common tooling.
It supports:
pip install py-gql
For more details see install.rst.
from py_gql import build_schema, graphql_blocking
schema = build_schema(
"""
type Query {
hello(value: String = "world"): String!
}
"""
)
@schema.resolver("Query.hello")
def resolve_hello(*_, value):
return "Hello {}!".format(value)
result = graphql_blocking(schema, '{ hello(value: "World") }')
assert result.response() == {
"data": {
"hello": "Hello World!"
}
}
For more usage examples, you can refer to the User Guide and some more involved examples available in the examples folder.
The tests should also provide some contrived examples.
This project was initially born as an experiment / learning project following some frustration with graphql-core and Graphene I encountered at work.
The main goals were originally to:
Get a deeper understanding of GraphQL
Provide an alternative to graphql-core
which:
graphql-core
didn't at the time)Graphene
and graphql-core
Not all these points are satisfied yet, and some have been changed over time, but py-gql should be ready for general use. It is however still in a fairly experimental phase and to reflect that versions are still in the 0.x.y
.The API is still subject to change as different part of the codebase are iterated on and are getting more use against production codebases.
Make sure you are using Python 3.6+ (you can run the tests under 3.5 but `other development tasks such as black are not guaranteed to work).
Clone this repo and create a virtualenv before installing the development dependencies:
git clone git@github.com:lirsacc/py-gql.git
python -m venv $WORKON_HOME/py-gql --copies
pip install -U -r requirements-dev.txt
pip install -e .
Development tasks are available through invoke. Check tasks.py
or use inv -l
to list all available tasks and inv --help {TASK}
to get help on a specific task. Most of the tools used should be usable directly, but the tasks provide some common aliases and targets.
As a shortcut, inv check
will run all checks that are normally run on CI (lint, typecheck and tests).
CI is done on Github Actions.
master
contains unreleased changes that are planned to be releaseddev
is used for experimenting and hard changes such as rebase and force pushed should be expected. For now this is the branch I used in side projects and where most of the iteration happens.FAQs
Comprehensive GraphQL implementation for Python.
We found that py-gql demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.