Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
h1. Fluther Ruby Client
h2. Introduction
This gem provides an interface to the "Fluther discussion service":http://www.fluther.com/. It is implemented as a piece of Rack middleware which handles proxying requests to Fluther and returning the response so that it can be included in your web application. While it should be usable with any Rack-based application, these docs assume you are embedding Fluther in a Rails 2.x application.
Requirements:
h2. Installation
Add the @fluther@ gem to your application (i.e. in @Gemfile@ or @environment.rb@).
Create an initializer (e.g. @config/initializers/fluther.rb@) that inserts the Fluther proxy after the Warden module, mounting it on the appropriate path:
Rails.configuration.after_initialize do Rails.configuration.middleware.insert_after Warden::Manager, Fluther::Proxy, '/qna' end
class Fluther::Config # hostname of the Fluther server for this environment (provided by Fluther) fluther_host 'fstage.fluther.com' # federated API key (provided by Fluther) app_key '2b6a0009c414c53e3d4fa8f8c3134d59' # mapping of attributes in the User model to the Fluther user user_fields :id => :id, :name => :name, :email => :email # (defaults) end
h2. Rails Integration
The proxy provides three Rack variables that include the Fluther response: @fluther.header@, @fluther.title@, and @fluther.response@. The first two (may) contain HTML blocks which should be inserted into the page @@ and @@ blocks, respectively, and the third is the HTML for the Fluther widget itself.
To integrate the response into your application, you should add an action which is routed from the same path as the Fluther proxy. For this example, we assume the controller is @MainController@, the action is @fluther@, and as above, it is mounted at @/qna@. Also, we assume that the application layout includes @yield(:head)@ in the @<head>@ block:
# config/routes.rb map.fluther '/qna/*_', :controller => 'main', :action => 'fluther'
# app/views/main/fluther.html.erb <% if (header = request.env['fluther.header']).present? content_for :head, header end if (title = request.env['fluther.title']).present? content_for :head, content_tag(:title, title) end %> <%= request.env['fluther.response'] -%>
You should now be able to start your application, navigate to http://localhost:300/qna and see the Fluther page.
h2. Thin Integration
The Fluther gem uses "EventMachine":http://github.com/igrigorik/em-http-request to perform the HTTP request. When running under a non-EventMachine web server, the proxy request will be performed synchronously. However, when running under the "Thin":http://code.macournoyer.com/thin/ web server, the proxy can take advantage of the presense of EventMachine to perform the request asynchronously, i.e. without blocking the web server process. This does require some additional setup:
... Rails.configuration.threadsafe! Rails.configuration.dependency_loading = true class AsyncRack::Lock # kludge to disable error on async response in Rack::Lock def async_callback(result) super end end
h2. Credits
Special thanks to Andrew and Ben at Fluther for all their help with integration and testing.
FAQs
Unknown package
We found that fluther demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.