Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Circuitbox is a Ruby circuit breaker gem. It protects your application from failures of its service dependencies. It wraps calls to external services and monitors for failures in one minute intervals. Using a circuit's defaults once more than 5 requests have been made with a 50% failure rate, Circuitbox stops sending requests to that failing service for 90 seconds. This helps your application gracefully degrade.
Resources about the circuit breaker pattern:
Upgrading to 2.x? See 2.0 upgrade
Circuitbox.circuit(:your_service, exceptions: [Net::ReadTimeout]) do
Net::HTTP.get URI('http://example.com/api/messages')
end
Circuitbox will return nil for failed requests and open circuits.
If your HTTP client has its own conditions for failure, you can pass an exceptions
option.
class ExampleServiceClient
def circuit
Circuitbox.circuit(:yammer, exceptions: [Zephyr::FailedRequest])
end
def http_get
circuit.run(exception: false) do
Zephyr.new("http://example.com").get(200, 1000, "/api/messages")
end
end
end
Using the run
method will throw an exception when the circuit is open or the underlying service fails.
def http_get
circuit.run do
Zephyr.new("http://example.com").get(200, 1000, "/api/messages")
end
end
Circuitbox defaults can be configured through Circuitbox.configure
.
There are two defaults that can be configured:
default_circuit_store
- Defaults to a Circuitbox::MemoryStore
. This can be changed to a compatible Moneta store.default_notifier
- Defaults to Circuitbox::Notifier::ActiveSupport
if ActiveSupport::Notifications
is defined, otherwise defaults to Circuitbox::Notifier::Null
After configuring circuitbox through Circuitbox.configure
, the internal circuit cache of Circuitbox.circuit
is cleared.
Any circuit created manually through Circuitbox::CircuitBreaker
before updating the configuration will need to be recreated to pick up the new defaults.
The following is an example Circuitbox configuration:
Circuitbox.configure do |config|
config.default_circuit_store = Circuitbox::MemoryStore.new
config.default_notifier = Circuitbox::Notifier::Null.new
end
class ExampleServiceClient
def circuit
Circuitbox.circuit(:your_service, {
# exceptions circuitbox tracks for counting failures (required)
exceptions: [YourCustomException],
# seconds the circuit stays open once it has passed the error threshold
sleep_window: 300,
# length of interval (in seconds) over which it calculates the error rate
time_window: 60,
# number of requests within `time_window` seconds before it calculates error rates (checked on failures)
volume_threshold: 10,
# the store you want to use to save the circuit state so it can be
# tracked, this needs to be Moneta compatible, and support increment
# this overrides what is set in the global configuration
circuit_store: Circuitbox::MemoryStore.new,
# exceeding this rate will open the circuit (checked on failures)
error_threshold: 50,
# Customized notifier
# this overrides what is set in the global configuration
notifier: Notifier.new
})
end
end
You can also pass a Proc as an option value which will evaluate each time the circuit breaker is used. This lets you configure the circuit breaker without having to restart the processes.
Circuitbox.circuit(:yammer, {
sleep_window: Proc.new { Configuration.get(:sleep_window) },
exceptions: [Net::ReadTimeout]
})
Holds all the relevant data to trip the circuit if a given number of requests fail in a specified period of time. Circuitbox also supports Moneta. As moneta is not a dependency of circuitbox it needs to be loaded prior to use. There are a lot of moneta stores to choose from but some pre-requisits need to be satisfied first:
Circuitbox ships with a Faraday HTTP client middleware.
The versions of faraday the middleware has been tested against is >= 0.17
through ~> 2.0
.
The middleware does not support parallel requests through a connections in_parallel
method.
require 'faraday'
require 'circuitbox/faraday_middleware'
conn = Faraday.new(:url => "http://example.com") do |c|
c.use Circuitbox::FaradayMiddleware
end
response = conn.get("/api")
if response.success?
# success
else
# failure or open circuit
end
By default the Faraday middleware returns a 503
response when the circuit is
open, but this as many other things can be configured via middleware options
default_value
value to return for open circuits, defaults to 503 response
wrapping the original response given by the service and stored as
original_response
property of the returned 503, this can be overwritten
with either
lambda
which is passed the original_response
and original_error
.
original_response
will be populated if Faraday returns an error response,
original_error
will be populated if an error was thrown before Faraday
returned a response.c.use Circuitbox::FaradayMiddleware, default_value: lambda { |response, error| ... }
identifier
circuit id, defaults to request urlc.use Circuitbox::FaradayMiddleware, identifier: "service_name_circuit"
circuit_breaker_options
options to initialize the circuit with defaults to
{ exceptions: Circuitbox::FaradayMiddleware::DEFAULT_EXCEPTIONS }
.
Accepts same options as Circuitbox:CircuitBreaker#newc.use Circuitbox::FaradayMiddleware, circuit_breaker_options: {}
open_circuit
lambda determining what response is considered a failure,
counting towards the opening of the circuitc.use Circuitbox::FaradayMiddleware, open_circuit: lambda { |response| response.status >= 500 }
Add this line to your application's Gemfile:
gem 'circuitbox'
And then execute:
$ bundle
Or install it yourself as:
$ gem install circuitbox
git checkout -b my-new-feature
)git commit -am 'Add some feature'
)git push origin my-new-feature
)FAQs
Unknown package
We found that circuitbox demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.