Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This gem provides simple wrapper around a regular ruby Hash object. This wrapper provides the following functionality:
This gem is useful when you want to serialize/deserialize Ruby objects to store or to transmit them over network. This gem was designed with the following advantages in mind:
You can mix-in the functionality to existing Ruby objects.
DSL explicitly defines the protocol payload
Light-weight and fast
You can nest candywrappers inside candywrappers.
Given this design, please be aware that:
Any object state that you want to save or send should be stored in the wrapped hash object. (see usage)
The only types that can be stored as serializable attribute are basic JSON primitives, or other candywrapper objects. (see usage) For example, you cannot store a File object in a candywrapper attribute.
We do not support multiple references to the same object, circular or not. If you assign the same complex object across multiple serializable attributes, the behavior is undefined. (depending on how JSON generator implementation behaves)
Cloning a candywrapper object (.clone) will perform deep copy. If we don't do this, you could end up with two separate objects sharing the same internal state.
All serializable attributes are optional in nature. If you don't set them, they won't be part of the serialized payload.
We do not provide validation of values being assigned to serializable attributes. The reason for this is to keep things as minimal as possible. If we were to provide validation, we would also have to go through any nested raw hash object to see if they satisfy the structure specified in DSL, which means recursively traversing all the elements of the raw hash during deserialization.
The only thing that we check for you is whether something is allowed to be nil or not, as such feature tends to catch a lot of real bugs.
Currently, we do not support nested array of candywrappers. For now, arrays must only contain other JSON primitives. When we support this in the future, we will probably require each array explicitly define the element type, and we will not allow mixing of multiple candywrapper types within the same array.
Currently, we do not support arbitrary hash containing candywrappers as values. The reason for this is that to support deserializing a candywrapper object from value within an arbitrarily nested hash object requires decorating the raw payload. (e.g. mark a hash object as being payload of a candywrapper class using '_class_name' key)
Related advice here is that you stick to explicitly defining your object structure, rather than leaving it up to some run-time interpretation (based on existence of a specific key-val). I've tried to support this kind of functionality before in a previous job, and it became pretty ugly.
Add this line to your application's Gemfile:
gem 'candywrapper'
And then execute:
$ bundle
Or install it yourself as:
$ gem install candywrapper
Here is a simple example to illustrate how to use Candywrapper.
require 'candywrapper'
class Address
include Candywrapper
serializable_attr :street
serializable_attr :city
serializable_attr :state
serializable_attr :zip
end
class Person
include Candywrapper
serializable_attr :first_name
serializable_attr :middle_name
serializable_attr :last_name
serializable_attr :home_address, Address
serializable_attr :work_address, Address
def full_name
@full_name = [first_name, middle_name, last_name].compact.join(" ")
end
end
a = Address.new
a.street = "120 Cherry ST N"
a.city = "Seattle"
a.state = "WA"
a.zip = "98101"
p = Person.new
p.home_address = a
p.first_name = "James"
p.last_name = "Bond"
p.full_name # => "James Bond"
json = p.serialize_to_json
# =>
# {
# "first_name": "James",
# "last_name": "Bond",
# "home_address": {
# "street": "120 Cherry ST N",
# "city": "Seattle",
# "state": "WA",
# "zip": "98101"
# }
# }
p2 = Person.deserialize_from_json(json)
p2.class # => Person
p2.home_address.class # => Address
p2.work_address # => nil
p2.full_name # => "James Bond"
git checkout -b my-new-feature
)git commit -am 'Added some feature'
)git push origin my-new-feature
)FAQs
Unknown package
We found that candywrapper demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.