
Security News
minimatch Patches 3 High-Severity ReDoS Vulnerabilities
minimatch patched three high-severity ReDoS vulnerabilities that can stall the Node.js event loop, and Socket has released free certified patches.
zsl
Advanced tools
ZSL is a Python micro-framework utilizing dependency injection for creating service applications on top of Flask web framework and Gearman job server or Celery task queue.
We developed ZSL to modernize our workflow with maintaining our clients' mostly web applications written in various older CMS solutions without the need to rewrite them significantly. With ZSL we can write our new components in Python, with one coherent shared codebase, accessible trough Gearman or JavaScript. Also the same code can be called through various endpoints - web or task queue nowadays.
At current stage this should be taken as proof of concept. We don't recommend to run in any production except ours. It is too rigid, with minimum test coverage and lots of bad code practices. We open sourced it as way of motivation for us to make it better.
We recommend to install it trough PyPi and run it in a virtualenv or docker container.
$ pip install zsl
For now it is a bit cumbersome to get it running. It has inherited settings trough ENV variables from Flask and has a rigid directory structure like django apps. On top of that, it needs a database and Redis.
The minimum application layout has to contain:
.
├── app # application sources
│ ├── __init__.py
│ └── tasks # public tasks
│ ├── hello.py
│ └── __init__.py
├── settings # settings
│ ├── app_settings.cfg
│ ├── default_settings.py
│ └── __init__.py
└── tests
$ export ZSL_SETTINGS=`pwd`/settings/app_settings.cfg
# settings/app_settings.cfg
TASKS = TaskConfiguration()\
.create_namespace('task')\
.add_packages(['app.tasks'])\
.get_configuration()
RESOURCE_PACKAGE = ()
DATABASE_URI = 'postgresql://postgres:postgres@localhost/postgres'
DATABASE_ENGINE_PROPS = {}
SERVICE_INJECTION = ()
REDIS = {
'host': 'localhost',
'port': 6379,
'db': 0
}
RELOAD = True
# hello.py
class HelloWorldTask:
def perform(self, data):
return "Hello World"
$ python -m zsl web
* Running on http://127.0.0.1:5000/ (Press CTRL+C to quit)
$ curl http://localhost:5000/task/hello/hello_world_task
Hello world!
Deploy will happen upon pushing a new tag to Gitlab.
Use bump2version to update version in config files. It will also create commit and new tag.
$ bumpversion --new-version ${VERSION} {major|minor|patch} --tag-name ${VERSION}
Version name uses semver. Starts with number.
Current pipeline tries to copy previous Travis runs. It runs tox target seperately and on a tag push will create deploy.
Gitlab pipeline runs inside a docker image which is defined in docker/Dockerfile.tox. Currently we manually configure, build and push it to gitlab container registry. So to update the container follow this steps.
When pushing for the first time run, you have to create an access token and login to atteq gitlab container registry. Go to https://gitlab.atteq.com/atteq/z-service-layer/zsl/-/settings/access_tokens and create a token to read/write to registry. Then run
docker login registry.gitlab.atteq.com:443
To build/push the image:
Build image locally.
docker build -t zsl/tox-env -f docker/Dockerfile.tox .
Tag image.
docker tag zsl/tox-env registry.gitlab.atteq.com:443/atteq/z-service-layer/zsl/tox-env:latest
Push image.
docker push registry.gitlab.atteq.com:443/atteq/z-service-layer/zsl/tox-env:latest
Update image hash in .gitlab-ci.yml. (copy from build output or docker images --digests).
FAQs
zsl application framework for web based services
We found that zsl demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
minimatch patched three high-severity ReDoS vulnerabilities that can stall the Node.js event loop, and Socket has released free certified patches.

Research
/Security News
Socket uncovered 26 malicious npm packages tied to North Korea's Contagious Interview campaign, retrieving a live 9-module infostealer and RAT from the adversary's C2.

Research
An impersonated golang.org/x/crypto clone exfiltrates passwords, executes a remote shell stager, and delivers a Rekoobe backdoor on Linux.