
Security News
Follow-up and Clarification on Recent Malicious Ruby Gems Campaign
A clarification on our recent research investigating 60 malicious Ruby gems.
Provides a robust set of parsers for dealing with HTTP Accept
, Accept-Language
, Accept-Encoding
, Accept-Charset
headers.
I've been developing some tools for building RESTful endpoints and part of that involved versioning. After reviewing the options, I settled on using the Accept: application/json;version=1
method as outlined here.
The version=1
part of the media-type
is a parameter
as defined by RFC7231 Section 3.1.1.1. After reviewing several existing different options for parsing the Accept:
header, I noticed a disturbing trend: header.split(',')
. Because parameters may contain quoted strings which contain commas, this is clearly not an appropriate way to parse the header.
I am concerned about correctness, security and performance. As such, I implemented this gem to provide a simple high level interface for both parsing and correctly interpreting these headers.
Add this line to your application's Gemfile:
gem 'http-accept'
And then execute:
$ bundle
Or install it yourself as:
$ gem install http-accept
You can then require it in your code like so:
require 'http/accept'
Here are some examples of how to parse various headers.
You can parse the incoming Accept:
header:
media_types = HTTP::Accept::MediaTypes.parse("text/html;q=0.5, application/json; version=1")
expect(media_types[0].mime_type).to be == "application/json"
expect(media_types[0].parameters).to be == {'version' => '1'}
expect(media_types[1].mime_type).to be == "text/html"
expect(media_types[1].parameters).to be == {'q' => '0.5'}
Normally, you'd want to match the media types against some set of available mime types:
module ToJSON
def content_type
HTTP::Accept::ContentType.new("application", "json", charset: 'utf-8')
end
# Used for inserting into map.
def split(*args)
content_type.split(*args)
end
def convert(object, options)
object.to_json
end
end
module ToXML
# Are you kidding?
end
map = HTTP::Accept::MediaTypes::Map.new
map << ToJSON
map << ToXML
object, media_range = map.for(media_types)
content = object.convert(model, media_range.parameters)
response = [200, {'Content-Type' => object.content_type}, [content]]
You can parse the incoming Accept-Language:
header:
languages = HTTP::Accept::Languages.parse("da, en-gb;q=0.8, en;q=0.7")
expect(languages[0].locale).to be == "da"
expect(languages[1].locale).to be == "en-gb"
expect(languages[2].locale).to be == "en"
Normally, you'd want to match the languages against some set of available localizations:
available_localizations = HTTP::Accept::Languages::Locales.new(["en-nz", "en-us"])
# Given the languages that the user wants, and the localizations available, compute the set of desired localizations.
desired_localizations = available_localizations & languages
The desired_localizations
in the example above is a subset of available_localizations
.
HTTP::Accept::Languages::Locales
provides an efficient data-structure for matching the Accept-Languages header to set of available localizations according to https://tools.ietf.org/html/rfc7231#section-5.3.5 and https://tools.ietf.org/html/rfc4647#section-2.3
We welcome contributions to this project.
git checkout -b my-new-feature
).git commit -am 'Add some feature'
).git push origin my-new-feature
).This project uses the Developer Certificate of Origin. All contributors to this project must agree to this document to have their contributions accepted.
This project is governed by the Contributor Covenant. All contributors and participants agree to abide by its terms.
FAQs
Unknown package
We found that http-accept demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 8 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.
Security News
ESLint now supports parallel linting with a new --concurrency flag, delivering major speed gains and closing a 10-year-old feature request.
Research
/Security News
A malicious Go module posing as an SSH brute forcer exfiltrates stolen credentials to a Telegram bot controlled by a Russian-speaking threat actor.