
Research
/Security News
Popular Tinycolor npm Package Compromised in Supply Chain Attack Affecting 40+ Packages
Malicious update to @ctrl/tinycolor on npm is part of a supply-chain attack hitting 40+ packages across maintainers
http_instrumentation
Advanced tools
This gem adds instrumentation to a variety of the most commonly used Ruby HTTP client libraries via ActiveSupport notifications. The goal is to add a common instrumentation interface across all the HTTP client libraries used by an application (including ones installed as dependencies of other gems).
Note that several other popular HTTP client libraries like Faraday, HTTParty, and RestClient are built on top of these low level libraries.
To capture information about HTTP requests, simply subscribe to the request.http
events with ActiveSupport notifications (note that you should really use monotonic_subscribe
instead of subscribe
to avoid issues with clock adjustments).
The payload on event notifications for all HTTP requests will include:
:client
- The client library used to make the request:count
- The number of HTTP requests that were madeIf a single HTTP request was made, then these keys will exist as well:
:uri
- The URI for the request:url
- The URL for the request with any query string stripped off:http_method
- The HTTP method for the request:status_code
- The numeric HTTP status code for the responseThese additional values will not be present if multiple, concurrent requests were made. Only the typhoeus, ethon, and httpx libraries support making concurrent requests.
ActiveSupport::Notifications.monotonic_subscribe("request.http") do |*args|
event = ActiveSupport::Notifications::Event.new(*args)
client = event.payload[:client]
count = event.payload[:count]
url = event.payload[:url]
uri = event.payload[:uri]
http_method = event.payload[:http_method]
status_code = event.payload[:status_code]
puts "HTTP request: client: #{client}, count: #{count}, duration: #{event.duration}ms"
if count == 1
puts "#{http_method} #{url} - status: #{status_code}, host: #{uri&.host}"
end
end
# Single request
Net::HTTP.get(URI("https://example.com/info"))
# => HTTP request: client: net/http, count: 1, duration: 100ms
# => GET https://example.com/info - status 200, host: example.com
# Multiple, concurrent requests
HTTPX.get("https://example.com/r1", "https://example.com/r2")
# => HTTP request: client: httpx, count: 2, duration: 150ms
The :uri
element in the event payload will be sanitized to remove any user/password elements encoded in the URL as well as any access_token
query parameters.
The :url
element will also have the query string stripped from it so it will just include the scheme, host, and path.
HTTP.get("https://user@password123@example.com/path")
HTTP.get("https://example.com/path?access_token=secrettoken")
# event.payload[:url] will be https://example.com/path in both cases
The hostname will also be converted to lowercase in these attributes.
If you want to suppress notifications, you can do so by surrounding code with an HTTPInstrumentation.silence
block.
HTTPInstrumentation.silence do
HTTP.get("https://example.com/info") # Notification will not be sent
end
You can instrument additional HTTP calls with the HTTPInstrumentation.instrument
method. Adding instrumentation to higher level clients will suppress any instrumentation from lower level clients they may be using so you'll only get one event per request.
class MyHttpClient
def get(url)
HTTPInstrumentation.instrument("my_client") do |payload|
response = Net::HTTP.get(URI(url))
payload[:http_method] = :get
payload[:url] = url
payload[:status_code] = response.code
response
end
end
end
MyHttpClient.get("https://example.com/")
# Event => {client: "my_client", http_method => :get, url: "https://example.com/"}
You can also take advantage of the existing instrumentation and just override the client name in the notification event.
class MyHttpClient
def get(url)
HTTPInstrumentation.client("my_client")
Net::HTTP.get(URI(url))
end
end
end
MyHttpClient.get("https://example.com/")
# Event => {client: "my_client", http_method => :get, url: "https://example.com/"}
Add this line to your application's Gemfile:
gem "http_instrumentation"
Then execute:
$ bundle
Or install it yourself as:
$ gem install http_instrumentation
Open a pull request on GitHub.
Please use the standardrb syntax and lint your code with standardrb --fix
before submitting.
The gem is available as open source under the terms of the MIT License.
FAQs
Unknown package
We found that http_instrumentation demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Malicious update to @ctrl/tinycolor on npm is part of a supply-chain attack hitting 40+ packages across maintainers
Security News
pnpm's new minimumReleaseAge setting delays package updates to prevent supply chain attacks, with other tools like Taze and NCU following suit.
Security News
The Rust Security Response WG is warning of phishing emails from rustfoundation.dev targeting crates.io users.