
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Serverside manipulation of CSS class lists. Works especially well with Tailwind and View Components.
Add this line to your application's Gemfile:
gem 'classlist'
# or if you don't want to manually require stuff:
gem 'classlist', require: 'classlist/all'
And then execute:
$ bundle install
Or install it yourself as:
$ gem install classlist
Imagine having a component that outputs the following markup when you render it:
<%= render(CardComponent.new) %>
<div class="card float-left">...</div>
Now you're tasked with implementing a card with another background color. That's easy, you think, I'll just add an option that adds more classes to the component:
<%= render(CardComponent.new(:classes => "bg-grey")) %>
<!-- card.html.erb -->
<div class="card float-left <%= classes %>">
That works and all is well. But next day the task is to make a card that isn't floated left. You could remove float-left
from the template and move it to all calls to render:
<%= render(CardComponent.new(:classes => "float-left bg-grey")) %>
<!-- card.html.erb -->
<div class="card <%= classes %>">
Depending on the number of classes and the number of render calls that could work. But how about if you were able to write
<%= render(CardComponent.new(:classes => Classlist::Remove.new("float-left"))) %>
With Classlist you can:
# card_component.rb
def classes
Classlist.new("card float-left") + @classes
end
<!-- card.html.erb -->
<div class="<%= classes %>">
The resulting markup will be
<div class="card">
because
Classlist.new("card float-left") + Classlist::Remove.new("float-left") == Classlist.new("card")
# Create a new classlist - these are equivalent:
classes = Classlist.new("pt-6 space-y-4")
classes = Classlist.new(["pt-6", "space-y-4"])
# Add classes
classes.add("md:p-8 text-center")
classes.to_s #=> "pt-6 space-y-4 md:p-8 text-center"
# Remove classes
classes.remove("md:p-8")
classes.to_s #=> "pt-6 space-y-4 text-center"
# Toggle classes
classes.toggle("hidden")
classes.to_s #=> "pt-6 space-y-4 text-center hidden"
classes.toggle("text-center")
classes.to_s #=> "pt-6 space-y-4 hidden"
# Replace classes
classes.replace("hidden", "block")
classes.to_s #=> "pt-6 space-y-4 block"
While Classlist aims to be a feature-compatible version of DOMTokenList
that doesn't always make for particularily Ruby'esque methods. In cases where Ruby has similar methods named differently than the DOM, we'll prefer Ruby-style method names while keeping aliases with the names from DOMTokenList
.
After checking out the repo, run bin/setup
to install dependencies. You can also run bin/console
for an interactive prompt that will allow you to experiment.
To install this gem onto your local machine, run bundle exec rake install
. To release a new version, update the version number in version.rb
, and then run bundle exec rake release
, which will create a git tag for the version, push git commits and the created tag, and push the .gem
file to rubygems.org.
Bug reports and pull requests are welcome on GitHub at https://github.com/substancelab/classlist.
FAQs
Unknown package
We found that classlist demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.