Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Works with any valid Git URI as described in the git docs.
git clone
accepts many different URI formats for remote repositories.
Unfortunately, not all of them are actually URIs. Addressable is able to parse
many of the standard URIs accepted by git, and this library extends Addressable
to handle the non-standard scp-style repository locations.
Gitable provides a uniform way to parse a git repository location and determine
information about the project. Gitable can determine whether or not a repository
will require authentication before actually using git
to clone the repository.
Gitable is also very useful for determining equivalence between git remotes that
are entered slightly differently (e.g. trailing slashes, uri scheme, uri format)
This is not a general substitute for Addressable, but rather a specific solution for accepting git repository addresses and confirming validity and authentication. Gitable should not be used as a general URI parser for anything other than git repository locations.
Many thanks to Bob Aman (sporkmonger) for his work on Addressable and for his feedback on this gem.
require 'gitable/uri'
uri = Gitable::URI.parse('git@github.com:martinemde/gitable.git')
uri.path # => 'martinemde/gitable.git'
uri.user # => 'git'
uri.host # => 'github.com'
Maintain the same url format.
uri.to_s # => 'git@github.com:martinemde/gitable.git'
Uses ssh?
uri.ssh? # => true
SCP format?
uri.scp? # => true
If it can't guess the name, you named your repository wrong.
uri.project_name # => 'gitable'
Will this uri require authentication?
uri.authenticated? # => true
Will I have to interactively type something into git (a password)?
uri.interactive_authenticated? # => false
Matching public to private git uris?
uri.equivalent?('git://github.com/martinemde/gitable.git') # => true
uri.equivalent?('https://martinemde@github.com/martinemde/gitable.git') # => true
Link to the web page for a project (github)
if uri.github?
uri.to_web_uri # => <Addressable::URI https://github.com/martinemde/gitable>
end
Inherited from Addressable::URI
uri.kind_of?(Addressable::URI) # => true
Teenage Mutant Ninja Urls (mutable uris like Addressable, if you want)
uri.path = 'someotheruser/gitable.git'
uri.basename = 'umm.git'
uri.to_s # => 'git@github.com:someotheruser/umm.git'
Gitable::URI.heuristic_parse
Gitable::URI.heuristic_parse
can be used to accept user input.
Currently this supports the mistake of copying the url bar instead of the git
uri for a few of the popular git webhosts. It also runs through Addressable's
heuristic_parse
so it will correct some poorly typed URIs.
uri = Gitable::URI.heuristic_parse('http://github.com:martinemde/gitable')
uri.to_s # => 'git://github.com/martinemde/gitable.git'
heuristic_parse
is currently very limited. If the url doesn't end in .git, it
switches http:// to git:// and adds .git to the basename.
This works fine for github.com and gitorious.org but will happily screw up other
URIs.
Copyright (c) 2014 Martin Emde. See LICENSE for details.
FAQs
Unknown package
We found that gitable demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.