
Security News
Follow-up and Clarification on Recent Malicious Ruby Gems Campaign
A clarification on our recent research investigating 60 malicious Ruby gems.
Autocomplete a group of files and directories simply by listing their globbable paths in a config file. Generate completions from your config, source them into your shell and you're ready to rock.
So instead of carpal-typing
bash> vim /System/Library/Frameworks/Ruby.framework/Versions/1.8/usr/lib/ruby/1.8/irb.rb
you type or complete
bash> rvim irb.rb
Uneasy about what lightning will execute? Test/print it out with a -test flag
bash> rvim -test irb.rb
rvim '/System/Library/Frameworks/Ruby.framework/Versions/1.8/usr/lib/ruby/1.8/irb.rb'
Want to autocomplete but don't remember how the basename starts? Just use a ruby regular expression:
# *'s are converted to .*'s for convience sakes
bash> rvim *dialog [TAB TAB]
canvasprintdialog.rb
extfileselectiondialog.rb
dialog.rb//System/Library/Frameworks/Ruby.framework/Versions/1.8/usr/lib/ruby/1.8/tk
fileselectiondialog.rb
dialog.rb//System/Library/Frameworks/Ruby.framework/Versions/1.8/usr/lib/ruby/1.8/tkextlib/bwidget
finddialog.rb
#re-edit your line to narrow down your completion to one entry
bash> rvim ca*dialog [TAB TAB]
#once the basename completes, you can execute your command
bash> rvim canvasprintdialog.rb
As you can see, you only need to autocomplete the basenames of paths and lightning will resolve their full paths. In these examples, rvim is a lightning command configured to autocomplete a certain group of paths for vim. In my case, rvim is configured to complete my ruby core and standard library files.
For newcomers to github, install this gem with: gem install cldwalker-lightning -s http://gems.github.com
To make your own commands, you'll need to:
Create ~/.lightning.yml or a lightning.yml in the current directory. Use the Configuration section below and the provided lightning.yml.example as guides.
Execute lightning-install
to generate ~/.lightning_completions from your config.
There is a config option for changing the location of the generated file. See Configuration
below. See lightning_completions.example for what would be generated for the enclosed example
config.
Source the generated file in your bashrc ie source ~/.lightning_completions
.
Since the globbable paths are interpreted by ruby's Dir.glob(), you can:
Autocomplete files and directories that don't start with specific letters.
Dir.glob("[^ls]*") -> Matches anything not starting with l or s
Autocomplete files ending with specific file extensions for a given directory.
Dir.glob("/painfully/long/path/*.{rb,erb}") -> Matches files ending with .rb or .erb
Autocomplete all directories however many levels deep under the current directory.
Dir.glob("**/")
ri Dir.glob
for more examples.
Lightning supports custom aliases for any path, globally and per command. So if there is some path that you access often but that's still too slow with completion, alias it away!
It helps to look at lightning.yml.example while reading this.
Configuration options are:
generated_file: Location of shell script file generated from config. Defaults to ~/.lightning_completions.
ignore_paths: List of paths to globally ignore when listing completions.
complete_regex: true or false (default is true) Turns on/off Ruby regular expression matching when completing. One convience is that a '' is converted to '.' ie glob-like behavior.
Note: Realize your regular expression normally just match the basename. However, since duplicates list their full paths, their full paths are subject to regex matching.
shell: Specifies shell script generator used for generating completions. Defaults to bash.
aliases: A hash (pairs) of custom aliases pointing to full paths. These aliases will be globally recognized by any lightning command.
commands: A list of lightning commands. A lightning command is just a shell function which executes a specified shell function with a defined set of paths to autocomplete on. A command consists of the following options/keys:
paths: This takes a hash (pairs) of path names and globbable paths. This should be used when you have a group of paths that are used in multiple commands. When doing that, you would specify the path name defined here in the command's paths key. Note: path names should only be alphanumeric
post_path: Text to add immediately after a resolved path. lightning.yml.example contains an example used for opening gem documentation in your browser.
So what happens when their are multiple matches for the same basename? Lightning appends a '/' + the full directory to each of the basenames.
For example, if I autocomplete button.rb for my ruby standard libraries I get:
bash> rvim button.rb
button.rb//System/Library/Frameworks/Ruby.framework/Versions/1.8/usr/lib/ruby/1.8/tk
button.rb//System/Library/Frameworks/Ruby.framework/Versions/1.8/usr/lib/ruby/1.8/tkextlib/bwidget
button.rb//System/Library/Frameworks/Ruby.framework/Versions/1.8/usr/lib/ruby/1.8/tkextlib/blt/tile
This isn't the prettiest completion but it resolves duplicates, displays the path differences between each and easily autocompletes. I'm open to suggestions on this syntax.
I've seen dotfiles on github and on blogs which accomplish this kind of autocompletion for gem documentation. There's even a gem just for gem editing: http://gemedit.rubyforge.org/. But once I saw how easy it was to manipulate completion through ruby, http://github.com/ryanb/dotfiles/blob/master/bash/completion\_scripts/project\_completion, I had to do something.
FAQs
Unknown package
We found that cldwalker-lightning demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.
Security News
ESLint now supports parallel linting with a new --concurrency flag, delivering major speed gains and closing a 10-year-old feature request.
Research
/Security News
A malicious Go module posing as an SSH brute forcer exfiltrates stolen credentials to a Telegram bot controlled by a Russian-speaking threat actor.