Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
A resque inspired (read: stolen) interface for delayed_job. This gem is written to work with rails 3 and 4 applications using activerecord.
Some features:
The interface (yeah, a ripoff of resque-web):
Add the dependency to your Gemfile
gem "delayed_job_web"
Install it...
bundle
Add the following route to your application for accessing the interface, and retrying failed jobs.
match "/delayed_job" => DelayedJobWeb, :anchor => false, :via => [:get, :post]
You probably want to password protect the interface, an easy way is to add something like this your config.ru file
if Rails.env.production?
DelayedJobWeb.use Rack::Auth::Basic do |username, password|
ActiveSupport::SecurityUtils.variable_size_secure_compare('username', username) &&
ActiveSupport::SecurityUtils.variable_size_secure_compare('password', password)
end
end
delayed_job_web
runs as a Sinatra application within the rails application. Visit it at /delayed_job
.
This can be accomplished in the routes.rb file using an authenticated
callback. Note, do not use an authenticate
callback as this forces an authentication check and redirects can be screwy, see here for more information.
A simple user check looks like this:
authenticated :user do
mount DelayedJobWeb, at: "/delayed_job"
end
But you probably want to check for administrator permissions:
authenticated :user, -> user { user.admin? } do
mount DelayedJobWeb, at: "/delayed_job"
end
If you mount the app on another route, you may encounter the CSS not working anymore. To work around this you can leverage a special HTTP header. Install it, activate it and configure it -- see below.
XSendFile On
XSendFilePath /path/to/shared/bundle
XSendFilePath
white-lists a directory from which static files are allowed to be served. This should be at least the path to where delayed_job_web is installed.
Using Rails you'll have to set config.action_dispatch.x_sendfile_header = "X-Sendfile"
.
Nginx uses an equivalent that's called X-Accel-Redirect
, further instructions can be found in their wiki.
Rails' will need to be configured to config.action_dispatch.x_sendfile_header = "X-Accel-Redirect"
.
Lighty is more X-Sendfile
, like outlined in their wiki.
The following settings can be changed using the .set
method in your configu.ru. For example:
DelayedJobWeb.set(:allow_requeue_pending, false)
allow_requeue_pending
(default: true
)
Controls whether the 'Enqueue all immediately' button is available on the list of Pending jobs. Hiding this button can be useful if you have jobs set to run in the future and you don't want to accidentally run them immediately.
rake test
Update the version in delayed_job_web.gemspec
git commit delayed_job_web.gemspec
with the following message format:
Version x.x.x
Changelog:
* Some new feature
* Some new bug fix
rake release
Erick Schmitt - @ejschmitt
Maintained by Andy Atkinson - @andatki
Get in touch if you'd like to take over maintenance!
FAQs
Unknown package
We found that delayed_job_web demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.