Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Ruby and Lambda splat out a baby and that child's name is Jets.
Upgrading: If you are upgrading Jets, please check on the Upgrading Notes.
Jets is a Ruby Serverless Framework. Jets allows you to create serverless applications with a beautiful language: Ruby. It includes everything required to build an application and deploy it to AWS Lambda.
It is key to understand AWS Lambda and API Gateway to understand Jets conceptually. Jets maps your code to Lambda functions and API Gateway resources.
The official documentation is at Ruby on Jets.
Refer to the official docs for more info, but here's a quick intro.
Jets supports writing AWS Lambda functions with Ruby. You define them in the app/functions
folder. A function looks like this:
app/functions/simple.rb:
def handler_function(event:, context:)
puts "hello world"
{hello: "world"}
end
Here's the function in the Lambda console:
Though simple functions are supported by Jets, they do not add much value as other ways to write Ruby code with Jets. Classes like Controllers and Jobs add many conveniences and are more powerful to use. We’ll cover them next.
A Jets controller handles a web request and renders a response. Here's an example:
app/controllers/posts_controller.rb:
class PostsController < ApplicationController
def index
# renders Lambda Proxy structure compatible with API Gateway
render json: {hello: "world", action: "index"}
end
def show
id = params[:id] # params available
# puts goes to the lambda logs
puts event # raw lambda event available
render json: {action: "show", id: id}
end
end
Helper methods like params
provide the parameters from the API Gateway event. The render
method renders a Lambda Proxy structure back that API Gateway understands.
Jets creates Lambda functions for each public method in your controller. Here they are in the Lambda console:
You connect Lambda functions to API Gateway URL endpoints with a routes file:
config/routes.rb:
Jets.application.routes.draw do
get "posts", to: "posts#index"
get "posts/new", to: "posts#new"
get "posts/:id", to: "posts#show"
post "posts", to: "posts#create"
get "posts/:id/edit", to: "posts#edit"
put "posts", to: "posts#update"
delete "posts", to: "posts#delete"
resources :comments # expands to the RESTful routes above
any "posts/hot", to: "posts#hot" # GET, POST, PUT, etc request all work
end
The routes.rb
gets translated to API Gateway resources:
Test your API Gateway endpoints with curl or postman. Note, replace the URL endpoint with the one that is created:
$ curl -s "https://quabepiu80.execute-api.us-east-1.amazonaws.com/dev/posts" | jq .
{
"hello": "world",
"action": "index"
}
A Jets job handles asynchronous background jobs performed outside of the web request/response cycle. Here's an example:
app/jobs/hard_job.rb:
class HardJob < ApplicationJob
rate "10 hours" # every 10 hours
def dig
puts "done digging"
end
cron "0 */12 * * ? *" # every 12 hours
def lift
puts "done lifting"
end
end
HardJob#dig
runs every 10 hours and HardJob#lift
runs every 12 hours. The rate
and cron
methods created CloudWatch Event Rules. Example:
You can test your application with a local server that mimics API Gateway: Jets Local Server. Once ready, deploying to AWS Lambda is a single command.
jets deploy
After deployment, you can test the Lambda functions with the AWS Lambda console or the CLI.
Here are some demos of Jets applications:
Please feel free to add your own example to the jets-examples repo.
Jets Afterburner Mode provides Rails support with little effort. This allows you to run a Rails application on AWS Lambda. Also here's a Tutorial Blog Post: Jets Afterburner: Rails Support.
For more documentation, check out the official docs: Ruby on Jets. Here's a list of useful links:
FAQs
Unknown package
We found that jets-fs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.