Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Unofficial helpers and extensions for the Google Discovery V1 API
Gems in the Google API helper, extensions, and examples series:
Install the gem and add to the application's Gemfile by executing:
bundle add discovery_v1
If bundler is not being used to manage dependencies, install the gem by executing:
gem install discovery_v1
TODO
This Gem's YARD documentation is hosted on rubydoc.info.
Detailed API documenation is hosted on rubygems.org.
No credential file is needed to access the discovery service.
discovery_service = DiscoveryV1.discovery_service
The Discovery API provides a list of Google APIs and a machine-readable "Discovery
Document" for each API. Both capabilities are provided by
Google::Apis::DirectoryV1::DirectoryService
instance methods:
#list_apis
returns the list of supported APIs#get_rest_api
returns the "discovery document" which is a description of a particular version
of an apiEach discovery document includes schemas for the objects that can be passed as parameters to methods in that API.
This gem can use the schemas that are part of a discovery document to validate objects that parameters to an API method call.
This can be helpful to troubleshoot invalid requests since requests can become very large and complex.
The DiscoveryV4.validate_object
method can be used to validate a request object before an API call. This method
requires the following information:
DirectoryService#get_read_api
DirectoryService.object_schema_names
)For example, in the Google Sheets API, speradsheets are often updated by calling
SheetsService#batch_update_spreadsheet
. This API method requires a
BatchUpdateSpreadsheetRequest
object.
Here is an example that builds a request to write the value 'A' to cell A1 but it contains an error (see if you can spot the error):
require 'discovery_v1'
batch_update_spreadsheet_request = {
requests: [
{
update_cells: {
rows: [
{ values: [ { user_entered_value: { string_value: 'A' } } ] }
],
fields: '*',
start: { sheet_id: 0, row_index: '1', column_index: 'A' }
}
}
],
response_include_grid_data: false
}
api_name = 'sheets'
api_version = 'v4'
discovery_service = DiscoveryV1.discovery_service
rest_description = discovery_service.get_rest_api(api_name, api_version)
schema_name = 'batch_update_spreadsheet_request'
begin
DiscoveryV1.validate_object(rest_description:, schema_name:, object: batch_update_spreadsheet_request)
rescue => e
puts e.message
end
Running this example shows the following output:
Object does not conform to batch_update_spreadsheet_request: value at `/requests/0/update_cells/start/row_index` is not an integer
The DiscoveryV1.validate_object
method can be used to validate objects prior to using them in a Google API request
described by the Discovery service.
This method takes a schema_name
and an object
to validate. Schema names for a
schema can be listed using
DiscoveryV1.object_schema_names
.
validate_object
will either return true
if object
conforms to the schema OR it
will raise a RuntimeError noting where the object structure did not conform to
the schema. RuntimeError#message
will give details about where the structure did
not conform.
The DiscoveryV1::GoogleExtensions
module provides extensions to the Google::Apis::DiscoveryV1
modules and classes to simplify use of the SheetsV4 API.
These extensions are not loaded by default and are not required to use other parts of this Gem. To enable these extension, you must:
require 'discovery_v1/google_extensions'
Convenience methods are been added to Google::Apis::DiscoveryV1::RestDescription
:
RestDescription
.After checking out the repo, run bin/setup
to install dependencies. Then, run rake spec
to run the tests. You can also run bin/console
for an interactive prompt that will allow you to experiment.
To install this gem onto your local machine, run bundle exec rake install
. To release a new version, update the version number in version.rb
, and then run bundle exec rake release
, which will create a git tag for the version, push git commits and the created tag, and push the .gem
file to rubygems.org.
Bug reports and pull requests are welcome on GitHub at https://github.com/[USERNAME]/discovery_v1. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the code of conduct.
All commit messages must follow the Conventional Commits standard. This helps us maintain a clear and structured commit history, automate versioning, and generate changelogs effectively.
To ensure compliance, this project includes:
A git commit-msg hook that validates your commit messages before they are accepted.
To activate the hook, you must have node installed and run npm install
.
A GitHub Actions workflow that will enforce the Conventional Commit standard as part of the continuous integration pipeline.
Any commit message that does not conform to the Conventional Commits standard will cause the workflow to fail and not allow the PR to be merged.
All pull requests must be merged using rebase merges. This ensures that commit messages from the feature branch are preserved in the release branch, keeping the history clean and meaningful.
The gem is available as open source under the terms of the MIT License.
Everyone interacting in the DiscoveryV1 project's codebases, issue trackers, chat rooms and mailing lists is expected to follow the code of conduct.
FAQs
Unknown package
We found that discovery_v1 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.