Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
A set of Cucumber step definitions utilizing Rack-Test that ease basic testing of REST-style APIs using either XML or JSON formats.
Adapted from a blog post by Anthony Eden with a few additions based on my own needs. I found myself copying these step definitions around to multiple projects, and decided that it would be worthwhile to gem them up to keep things nice and DRY.
Requires Cucumber (obviously). Also makes use of JSONPath for setting criteria against JSON responses. See the gemspec for more info.
Add the following line to your Gemfile, preferably in the test or cucumber group:
gem 'cucumber-api-steps', :require => false
Then add the following line to your env.rb to make the step definitions available in your features:
require 'cucumber/api_steps'
Still a work in progress. For now, read the api_steps.rb file or check out the stashboard-rails project - its Cucumber features make extensive use of the steps in this gem.
Feature: API
Scenario: List tweets in JSON
When I send and accept JSON
And I send a GET request to "/api/tweets"
Then the response status should be "200"
And the JSON response should be:
"""
[{"tweet":"Hello World!"},{"tweet":"New Rails has been released"}]
"""
And the JSON response should have "$..tweet" with the text "Hello World!"
And the JSON response should have "$..tweet" with a length of 2
Scenario: List tweets in XML
When I send and accept XML
And I send a GET request to "/api/tweets"
Then the XML response should have "tweet" with text "Hello World!"
Scenario: Post tweet using POST-params
When I send a POST request to "/api/tweets" with the following:
| tweet | Hello World! |
| lat | 42.848282 |
| lng | 74.634933 |
Then the response status should be "201"
Scenario: Post tweet using json in POST body
When I send a POST request to "/api/tweets" with the following:
"""
{"tweet":"Hello World!","lat":"42.848282", "lng":"74.634933"}
"""
Then the response status should be "201"
Scenario: Basic authentication
When I authenticate as the user "joe" with the password "password123"
And I send a GET request to "/api/tweets"
Then the response status should be "200"
Scenario: Digest authentication
When I digest-authenticate as the user "joe" with the password "password123"
And I send a GET request to "/api/tweets"
Then the response status should be "200"
Copyright (c) 2011 Jay Zeschin. Distributed under the MIT License.
FAQs
Unknown package
We found that cucumber-api-steps demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.