Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
noun place where records are stored
Add this line to your application's Gemfile:
gem 'atheneum'
And then execute:
$ bundle
Or install it yourself as:
$ gem install atheneum
You have a user record, it's always a user, that has a password. There is a crypted_password
field on your model from the database. Atheneum can use the crypt strategy to take care of storing and retrieving the password. It will also privatise the original attribute accessors so the objects public interface is only the new attribute accessors.
NB: you must also include bcrypt in your gems for this example
class UserRecord < Struct.new(:crypted_password)
include Atheneum.crypt(:password)
end
user_record = UserRecord.new
user_record.password = 'password'
puts user
# => #<struct UserRecord crypted_password="$2a$10$0lScjOJwCUVdtqGrtIgww.RbvVWXGPD.oISi4DBcIgK3f3YO66aju">
user_record.password == 'password'
# => true
user_record.crypted_password
# => NoMethodError: private method `crypted_password' called for #<UserRecord:0x0000000236f9f0>
# Without Atheneum
class UserRecord < Struct.new(:crypted_password)
def password=(password)
self.crypted_password = BCrypt::Password.create(password).to_s
end
def password
BCrypt::Password.new(crypted_password)
end
private :crypted_password, :crypted_password=
end
Storage methods accept more than one attribute. They also take an optional configuration hash
privatise (default: true) Sets whether existing accessors should privatised
prefix Overwrites the strategies default prefix
Strategies with no default prefix will use the strategies name eg SomeStrategy
=> some_strategy
Say you wanted some strings to be reversed before adding to the database. Perhaps exceptionally mild security.
Atheneum looks up strategy classes namespaced under Atheneum::Strategy
. These need to implement a pack and unpack method as well as optionally generating the storage location
module Atheneum
class Strategy
class Reverse < Base
def pack(item)
item.reverse
end
def unpack(item)
item.reverse
end
end
end
end
class LocationRecord < Struct.new(:obscured_address, :obscured_name)
include Atheneum.reverse :address, :name, :prefix => 'obscured', :privatise => false
end
location_record = LocationRecord.new
location_record.name = 'office'
location_record.obscured_name
# => "eciffo"
By privatising the existing attributes then the record object can remain an immaculate record, it appears to have only getters and setters. This is an example of how I have been using them. The example is with sequel, I have yet to try with active record but the priciple should hold.
require "sequel"
require "atheneum"
require "bcrypt"
# connect to an in-memory database
DB = Sequel.sqlite
# create an users table
DB.create_table :users do
primary_key :id
String :email
String :crypted_password
end
# create a user record
class UserRecord < Sequel::Model(:users)
Atheneum.crypt :password
end
# create a user model
class User < SimpleDelegator
def check_password(candidate_password)
password == candidate_password
end
private
def model
__getobj__
end
end
# In production
user = User.new(UserRecord.new)
user.password = 'password'
user.check_password('password')
# => true
# In test
TestRecord = Struct.new(:email, :password)
user = User.new(TestRecord.new)
user.password = 'password'
user.check_password('password')
# => true
An immaculate record is one that acts purely as a data structure. In practise this works for all classes that can be proxied with a Struct/OpenStruct. Its value is in
Separating all buisness logic from state
fast tests
git checkout -b my-new-feature
)git commit -am 'Add some feature'
)git push origin my-new-feature
)FAQs
Unknown package
We found that atheneum demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.