Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
A gem for discovering foreign key indexes that may be missing from your Rails project.
Given a Rails table like so:
ActiveRecord::Schema.define do
create_table :addresses, :force => true do |t|
t.string :street
...
t.integer :user_id
t.integer :property_id
end
add_index :addresses, :user_id
end
By default, inDexter will return a hash:
{:suffixes=>["_id", "_uuid"], :exclusions=>["schema_migrations"], :missing=>{"addresses" => ["property_id"]}}
which indicated that you that you might want to add an index on table addresses
for the property_id
column.
gem 'indexter'
And then execute:
$ bundle
Or install it yourself as:
$ gem install indexter
Indexter is configured by creating an .indexter.yaml
file in the root directory of your project (at the same level as your .gitignore
and .ruby-version
file).
Into this file you define the output format, the tables to be excluded from analysis, and the extensions the denote the columns you want to analyze.
The output format the results of the analysis should be displayed in. See Formatters, below, for more details.
A list of the tables you do not want to analyze.
A list of the column extensions that define which columns should probably be indexed.
format: table
exclusions:
- table: default_companies
- table: schema_migrations
- table: taggings
suffixes:
- _id
- _uuid
Indexter provides a convenience rake task for viewing your .indexter.yaml
config file:
rake indexter:config
$ rails c
irb(main):001:0> Indexter.validate
=> {:suffixes=>["_id", "_uuid"], :exclusions=>["schema_migrations"], :missing=>{}}
In that example the project has no missing indexes.
$ rails c
irb(main):001:0> Indexter.validate
=> {:suffixes=>["_id", "_uuid"], :exclusions=>["schema_migrations"], :missing=>{"users"=>["active_company_id"]}}
In that example the users
table is missing an index on active_company_id
.
$ bundle exec rake indexter:validate
{:suffixes=>["_id", "_uuid"], :exclusions=>["schema_migrations"], :missing=>{}}
In that example the project has no missing indexes.
$ bundle exec rake indexter:validate
{:suffixes=>["_id", "_uuid"], :exclusions=>["schema_migrations"], :missing=>{"users"=>["active_company_id"]}}
In that example the users
table is missing an index on active_company_id
.
Out of the box, inDexter returns a Ruby hash of the results. But maybe that's not what you want? Fortunately inDexter also provides a number of additional formatting options:
hash
: the default option, returns a Ruby hashjson
: renders the output as a JSON stringpass_fail
: like a Unix process, returns 0 if no missing index, n
if missing indexes, where n
is the number of missing indexestable
: renders the output as an ASCII-art tableBug reports and pull requests are welcome on GitHub at Github: inDexter. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the Contributor Covenant code of conduct.
The gem is available as open source under the terms of the MIT License.
FAQs
Unknown package
We found that indexter demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.