Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
githu3 is a ruby wrapper for github's v3 api.
gem install githu3
There are two ways to authenticate
Basic Authentication:
client = Githu3::Client.new('username', 'password')
OAuth2 Token (send in a header):
client = Githu3::Client.new('myawesomelyverylongoauth2token')
Or you can use the lib as an un-authenticated client to access only public Github resources...
client = Githu3::Client.new
The Githu3::Client instance can directly access github's top-level resources : orgs, repos, teams and users
to get them :
c = Githu3::Client.new
# Org
rails_org = c.org 'rails' # -> 'rails' organization wrapped in a Gihu3::Org object
# Repo
rails_repo = c.repo 'rails/rails' # -> That's Rails !
# User
sbellity = c.user 'sbellity' # -> That's me !
# Team
a_team = c.team 123 # -> well... team number '123' if you have access to it
When authenticated, your Githu3::Client instance can give you direct access to your top-level stuff...
me = Githu3::Client.new 'myawesomelyverylongoauth2token'
# Orgs
# returns a paginable Githu3::ResourceCollection stuffed with YOUR organizations
# more on this Githu3::ResourceCollection thing later...
my_orgs = me.orgs
# Repos
my_repos = me.repos
# Me
me = me.me # -> well, you get the point...
# Followers
me.following # -> returns a list a the Githu3::User, that you follow
me.followers # -> returns a list a the Githu3::User, that follow you
me.following?("rails") # -> true if you follow 'rails', false otherwise
All the calls to the API either return Githu3::Resource objects (ex. Githu3::User, Githu3::Repo, Githu3::Org...) et Githu3::ResourceCollection objects that wrap... Githu3::Resource objects
All the member attributes are accessible directly via their names. If you try to access an attribute that does not exist... you'll get nil
Examples:
c = Githu3::Client.new
rails_org = c.org 'rails'
rails_org.login # -> 'rails'
rails_org.html_url # -> 'https://github.com/rails'
rails_org.public_repos # -> 44
rails_org.foo # -> nil
Relations between the Resources follow the nesting of the Github's REST Api. For example, you can get the list of an org's repos directly from the Githu3::Org object.
c = Githu3::Client.new
rails_org = c.org "rails"
rails_org.repos # -> the list of rails' repos
You can even do this !
rails_org.repos.first.issues # -> latest issues from rails' first repo
Github often embeds objects inside others. For example, rails Repo has an owner object, that is a Githu3::User object... which let you do this:
rails_repo = c.repo "rails/rails"
rails_repo.owner # -> rails org wrapped in a Githu3::User object
Most results from the Api calls are collections of stuff. Those collections are wrapped in Githu3::ResourceCollection objects that primarily act as Arrays. Meaning that you can safely call the usual length
, first
, last
, each
, map
, select
... an so on... on them.
Warning !... this Pagination api is very alpha-ish... and very susceptible to change
In fact, Github's api generally returns paginated results. Github::ResourceCollection have a pagination api built right in, that lets you do those kinds of stuff :
rails_repo = c.repo "rails/rails"
rails_issues = rails_repo.issues(:per_page => 10, :page => 4) # -> :per_page defaults to 30, :page defaults to 1
rails_issues.current_page # -> 4
rails_issues.length # -> 10
next_issues = rails_issues.fetch_next # -> next_issues is a plain Array here...
# new records are added to your original collection
rails_issues.current_page # -> 5
rails_issues.length # -> 20
Github Api provides filter options for most collection calls. To use a filter on your Githu3::ResourceCollection object, you can do
repo = c.repo "sbellity/githu3"
open_issues = repo.issues :state => "open"
bugs = repo.issues :tag => "bug"
my_issues = repo.issues :assignee => "sbellity"
# You can also combine and sort them
my_open_bugs = repo.issues :assignee => "sbellity",
:tag => "bug",
:state => "open",
:sort => "updated",
:direction => "desc"
Your app may generate a LOT of requests to Github's API... By default, you are rate-limitted to 5000 requests per day. You can check anytime the status of your allowance via the method "rate_limit" on your Githu3::Client instance.
c = Githu3::Client.new
...
c.rate_limit # -> {:limit=>"5000", :remaining=>"4969"}
Githu3 provides a very basic cache mechanism to avoid making duplicate requests too often. Basically what it does is just record HTTP request results in a store with an expiration timeout and attempts to retrieve the results back from this store before hitting Github's servers. The different clients private data... should be safe, the request headers (that contain auth info) are used to generate the hash. 2 stores are provided by default : Redis and Disk.
To use them (these are the default options):
disk_cached_client = Githu3::Client.new('myawesomelyverylongoauth2token', :cache => :disk, :cache_config => {
:path => "/tmp/githu3",
:namespace => "cache", # or "myawesomelyverylongoauth2token" if you are paranoid...
:expire => 120 # in seconds
})
require 'redis'
require 'redis-namespace'
redis_cached_client = Githu3::Client.new('myawesomelyverylongoauth2token', :cache => :redis, :cache_config => {
:host => "localhost", # defaults to localhost
:port => 6379 # defaults to 6379
:namespace => "githu3", # or "githu3:myawesomelyverylongoauth2token" if you are paranoid...
:expire => 120 # in seconds
})
c.repo('rails/rails').issues
-> 2 HTTP GET) make unnecessary calls to github, we will try to find a way to avoid this overhead in a future version.Copyright (c) 2011 Stephane Bellity. See LICENSE.txt for further details.
FAQs
Unknown package
We found that githu3 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.