Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
The gem wraps the Ruby graphql-client gem, to dinamically define GraphQL Clients.
Add this line to your application's Gemfile:
gem 'graphql_util'
And then execute:
$ bundle install
Or install it yourself as:
$ gem install graphql_util
Define a GraphQL client class, like so:
class Client
GraphqlUtil.act_as_graphql_client(
self, # Required
endpoint: 'https://api.github.com/graphql', # Required
path: __dir__, # Required, (Recommended: __dir__)
headers: {} # Optional
)
end
The act_as_graphql_client
method accepts the following parameters:
self
, which allows GraphqlUtil to inject the required code inside the class;endpoint
, which has to be the URL of the GraphQL endpoint;path
, which has to be the location where to store operations files and the Schema dump. (__dir__
is the suggested one, but any valid path will do);headers
, a Hash of headers to be attached to any performed HTTP request.The very first time the Client class loads, an Introspection Query will be performed agains the GraphQL endpoint to dump the relative Schema.
You'll find your schema.json
dump file under the above mentioned path
.
(Remember that the Graphql Schema may change over time, therefore whenever you need to update the dump, simply delete the file. The new version will get created later.)
The Graphql operations you want your client to perform must be defined inside .graphql
files under any dir
subdirectory.
Let's take the Github Graphql API as an example.
github
to contain all the necessary code.client.rb
, just like this: module Github
class Client
GraphqlUtil.act_as_graphql_client(
self,
endpoint: 'https://api.github.com/graphql',
path: __dir__,
headers: { # You can place any HTTP Header here
'Authorization': GITHUB_TOKEN
}
)
end
end
github/queries/user_info.graphql
query userInfo($username: String!) {
user(login: $username) {
followers(first: 1) {
totalCount
}
}
}
or
github/mutations/add_comment.graphql
mutation addComment($input: AddCommentInput!) {
clientMutaitonId
}
github
├── queries
│ └── user_info.graphql
├── mutations
│ └── add_comment.graphql
├── client.rb
└── schema.json
.user_info
& .add_comment
.Github::Client.user_info(username: 'LapoElisacci')
or
Github::Client.add_comment(input: { body: 'This gem is awesome!', subjectId: '12345678' })
The client Class as well as the sudirectories names are up to you, but only one level nesting is allowed.
Something like anywhere/anything/whatever/whatever.graphql
won't produce the relative method, but anywhere/anything/whatever.graphql
will, as long as anywhere/whatever.rb
is the class that "act_as_graphql_client".
anywhere
├── anything
│ ├── wont_work
│ │ └── wont_work.graphql
│ └── anything_that_works.graphql
├── anything_2
│ └── anything_that_works_too.graphql
├── whatever.rb
└── schema.json
You can find more details about the graphql-client
here.
After checking out the repo, run bin/setup
to install dependencies. Then, run bundle exec rspec spec
to run the tests. You can also run bin/console
for an interactive prompt that will allow you to experiment.
Bug reports and pull requests are welcome on GitHub at https://github.com/LapoElisacci/graphql_util.
The gem is available as open source under the terms of the MIT License.
FAQs
Unknown package
We found that graphql_util demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.