Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
A synchronous Python client package for loading, reading, and dumping REPL projects from repl.it
A synchronous Python client package for loading, reading, and dumping REPL projects from repl.it
There currently isn't any functionality for writing to REPLs, nor running REPLs in this version, those features will come at a later date. This library is still in alpha and much more is still to come. Version 0.1.0 won't hit until the ability to run a REPL is added. Currently working on learning crosis first lol
You first have to instantiate a Client
class from replbox
. Like so:
import replbox
client = replbox.Client()
Then you can either load a REPL from a user/team path, or create an anonymous REPL with the client.
repl = client.create(language="python3", title="New Repl")
otherRepl = client.load_from_path("@replbox/dummy-repl")
client.create()
can take a number of keyword arguments but only requires the language
kwarg, which defaults to python3
. You get a list of valid languages by running print(replbox.fetch_langs())
client.load_from_path()
takes a single argument: a user/team REPL path. This path is usually follow the format @<username>/<replname>.
The username is case-insensitive, but the REPL name has to be a compatible slug, so for example, "This is a New Repl" becomes This-is-a-New-Repl
.
Once you've done that, you now have a REPL!
You can ouput the REPL object in a pretty way like this:
print(json.dumps(repl.json, indent=2))
which will get you a similar output to this:
{
"id": "dd6f9fcd-c515-4d7f-ae93-0e3b317c85d8",
"user_id": 4532700,
"title": "dummy-repl",
"description": "",
"is_project": false,
"is_private": false,
"time_created": "2020-10-26T20:59:41.312Z",
"time_updated": "2020-10-26T21:59:42.407Z",
...
}
NOTE: All attributes in repl.json
can be accessed individually, like repl.id
or repl.time_created
You can read the contents of a file within a REPL with:
file = repl.read('mock/__init__.py')
print(file)
OR
mainFile = repl.read_main()
print(mainFile)
The main file of a REPL is usually named main.<language-extension>
. If a main file can't be found then it will default to the first file in the list repl.fileNames
.
Using a bit of os
magic, you can download all the contents of a repl to a folder of your choosing, take a look at this code:
path = os.getcwd() + "/" + repl.slug + "/"
for file in repl.fileNames:
repl.ensure_path(path + file)
print(f"Created directory: {path + file}")
with open(path + file, 'w+') as fp:
repl.dump(file, fp)
print(f"Contents successfully dumped.")
print()
This code does a few things:
repl.ensure_path()
Splices the file path and file name, then creates the directory if it doesn't exist already.repl.dump()
Writes the contents of the REPL file to the local copy.You can login with your repl.it SID. Find this value in your cookies after logging into repl.it under connect.sid
and keep this supder-duper ultra secret! It'll look a little something like this:
Then login like so:
import os
import replbox
SID = os.getenv("SID")
client = replbox.Client()
user = client.login(SID)
client.login()
will return a UserClient()
which is essentially the same as a base client but will make requests to the API on your behalf. So loading a REPL from a path under your username should make repl.is_owner
equal to True
.
FAQs
A synchronous Python client package for loading, reading, and dumping REPL projects from repl.it
We found that replbox demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.