
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Sparrow is a library that provides a high-level API for RDF Databases. Any database the provides support for SPARQL Queries and has a triplestore that can handle contexts can be used as a backend.
The goal of Sparrow is to make sure all these different backends act the same, making it possible to change RDF Database backends without having to change your code.
At the moment there is support for the following backends:
Redland / librdf
_RDFLib
_Sesame / openrdf
_Allegro Graph
_.. _Redland / librdf: http://librdf.org .. _RDFLib: http://www.rdflib.net .. _Sesame / openrdf: http://www.openrdf.org .. _Allegro Graph: http://www.franz.com/agraph/
The API provides support for the following basic functions:
Sparrow does not provide a Graph API, but it can parse and serialize python dictionary objects. This uses the same format as the JSON serialization. Each TripleStore backend provides the following formats:
Sparrow comes with buildout profiles for several databases. These profiles will install and setup the different backends for you. You don't have to use buildout, but I would recommend it.
To install type:
::
python2.5 bootstrap.py ./bin/buildout
This will create some scripts in the bin folder like a testrunner and (depending on which profile you choose) scripts for configuring and starting the different backends.
Normally, you will only need to import the base sparrow module
import sparrow
Most of the database backends will not work out of the box. Since the RDFLib backend is written in python and packaged on pypi, it is always available, and installed with Sparrow.
Let's create an in memory rdflib database
db = sparrow.database('rdflib', 'memory') db <sparrow.rdflib_backend.RDFLibTripleStore ...>
Let's add some triples to the database, we will use turtle syntax for this. We'll make some example statements where we will state that john is a person, and that his firstname is "John".
data = """@prefix ex: http://example.org# . ... ex:john a ex:Person; ex:name "John" ."""
Now we can add this to the database. We will need to tell the database in which context to store the data. The data itself can be either a file or http based URI, a string of data, or a file-like object.
So, let's add this to the persons
context.
db.add_turtle(StringIO(data), 'persons')
We can now ask the database, which contexts it has:
db.contexts() [u'persons']
You can store data in as many different contexts as you like, or put everything in a single context.
Lets do a simple SPARQL query on the database
result = db.select('SELECT ?x {?x http://example.org#name "John".}')
We can get the results as a list of dictionaries. This follows the SPARQL JSON result format.
result [{u'x': {'type': u'uri', 'value': u'http://example.org#john'}}]
Besides querying, we can also get the data back from the database in any of the supported formats. We specify which format we want, and which context to use.
db.get_ntriples('persons').read() 'http://example.org#john ...'
If the database backend supports it, you can ask how many triples are in a context.
db.count('persons') 2
If you want to remove triples, you will need to supply data describing which triples to remove.
data = 'http://example.org#john a http://example.org#Person.' db.remove_turtle(data, 'persons') db.count('persons') 1
You can also remove all triples in a context
db.clear('persons') db.count('persons') 0
Since the 'persons' context is now empty, it is also removed.
db.contexts() []
FAQs
Sparrow, Common RDF/SPARQL Database API
We found that sparrow demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.