
Security News
Follow-up and Clarification on Recent Malicious Ruby Gems Campaign
A clarification on our recent research investigating 60 malicious Ruby gems.
jr is jq like JSON processor.
Its script can be written not a specific language but Ruby!
Add this line to your application's Gemfile:
gem 'jr-cli'
And then execute:
$ bundle
Or install it yourself as:
$ gem install jr-cli
jr filter can be written in Ruby!
$ jr [options] <jr filter> [file...]
You can also read JSON not from files but from STDIN.
--require FILE require the FILE before execution
-c, --compact-output output each JSON in single line
-f, --from-file FILE read filter from file
-r, --raw-output output strings as raw output
-R, --raw-input read each line as string
-C, --color-output output with colors even if writing to a pipe or a file
-M, --monochrome-output output without colors
-n, --null-input use null as input instead of any files
--unbuffered output each JSON without buffering
Let's process JSON of GitHub API!
At first, download JSON of repos into your local to avoid API rate limit.
$ curl -s 'https://api.github.com/users/yuya-takeyama/repos?per_page=100' > repos.json
Enumerable#unwrap
Because response from GET /users/:username/repos
is wrapped with Array
, unwrap it using Enumerable#unwrap
.
It's a built-in method of jr.
You'll get stream of JSON reperesents repositories.
$ jr 'unwrap' repos.json
Enumerable
Enumerable
has many useful methods and you can transform data with them.
$ jr 'unwrap.group_by(&:language).map{|k, v| [k, v.size] }.sort_by{|k, v| -v }' repos.json
[
"Ruby",
28
]
[
"PHP",
22
]
[
"Go",
17
]
(...omitted...)
[
"VimL",
1
]
[
"CoffeeScript",
1
]
[
"Perl",
1
]
You can transform JSONs into String and output as raw text using -r
option.
$ jr 'unwrap.group_by(&:language).map{|k, v| [k, v.size] }.sort_by{|k, v| -v }.map{|l, s| "#{s}\t#{l}" }' -r repos.json
28 Ruby
22 PHP
17 Go
12 JavaScript
11
3 CSS
2 Shell
2 C
1 VimL
1 CoffeeScript
1 Perl
It's helpful to know jr's basic mechanism.
Shortly, jr is implemented like below.
json_enumerator.instance_eval { your_jr_filter_runs_here }
# And print its result
git checkout -b my-new-feature
)git commit -am 'Add some feature'
)git push origin my-new-feature
)FAQs
Unknown package
We found that jr-cli demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.
Security News
ESLint now supports parallel linting with a new --concurrency flag, delivering major speed gains and closing a 10-year-old feature request.
Research
/Security News
A malicious Go module posing as an SSH brute forcer exfiltrates stolen credentials to a Telegram bot controlled by a Russian-speaking threat actor.