Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
= MC-Settings — An Application Settings Manager :toc: :toclevels: 4 :sectnums:
== Description
This Ruby gem provides a an easy way to manage application configuration across multiple environments, such as development, QA, staging, production, etc. It should be compatible with Capistrano deployments.
=== Background
Applications typically rely on configuration settings, such as host names, URLs, usernames and many more. Some values change between deployment environemnts, some do not.
The library assumes that application configuration is represented by a Hash of arbitrary depth, and provides a convenient and a compact syntax to access the settings through a singleton instance inside Setting class.
Configuration is stored in one or more YAML files with the top-level Hash, having the keys as names of individual settings.
=== Example
For example, consider the following sample application configuration file:
Setting Gem provides Setting.load(..)
method to load configuration from files in a way that allows some configuration files to override previously loaded values, and then offers a simple method API to access the values, for example Setting.tax(:california)
or Setting.tax
.
Supporting default values in 2nd, 3rd, .. - level hashes is one of the advantages of using this gem.
By loading configuration from YAML files, Setting gem is inherently compatible with Capistrano deployment methodology, where a certain set of files may become "activated" by simply sym-linking them into the appropriate settings folder.
Note: using example above, "1st level" hash is the one with keys tax
, states
and math_pi
.
The 2nd-level hash is, for example, the tax definition one, with keys default
and california
.
== Usage
Once configuration is initialized using Setting#load
or Setting#reload
methods (see below), they can be used in code in the following way:
Setting.key_name
is optimized to return default value if available instead of a Hash.Setting.key_name(:sub_key_name)
returns a value from the 2nd level hash.Setting.key_name(:sub_key_name, :sub_sub_key_name)
returns value from the 3rd level hash if available.The algorithm is recursive, so only the maximum method stack depth will limit the number of nested hash values you can access this way.
Setting[:key_name]
, Setting[:key_name][:sub_key_name]
, etc also supported.
This method, however, does not support default values (see below).NOTE: Method notation is recommended over square bracket accessing single values.
However, square bracket notation may be useful when you want to fetch the entire 2nd-level hash that includes the default value.
For example, given the above YAML file, you can access the settings in your code as follows:
Method-calling notation allows passing an array of keys to fetch a value from a nested hash. This method also supports returning a default value, stored against the "default" key.
Square bracket syntax returns the actual nested hash, without any regard for the default value:
== Loading Settings
The gem should be initialized in your environment.rb (if using Rails), or in any other application initialization block. Setting.load()
method is provided for loading settings, and it can be called only once in application life cycle, or it will throw an exception.
If you need to reload settings, use the reload()
method with similar arguments.
Consider an example:
The argument is an options hash that configures which YAML files to load, in what order, and from where.
*.yml
files that live under the :path/local folder.Below is list of YAML files loaded in order specified in the above example, assuming that "development" is the Rails environment, and "local" folder exists with 3 additional YAML files in it:
config/settings/default.yml config/settings/environments/development.yml config/settings/local/authorize-net.yml config/settings/local/paypal.yml config/settings/local/other.yml
Each YML file defines a ruby Hash. During file loading, the hashes are merged, so that values loaded in early files may be overwritten by values in subsequent files. This is deliberate and by design: it allows you to create small "override" files for each environment, or even each machine you want to deploy to. Exactly how you split your application settings in files is up to you.
=== Nested Hashes and Default Values
MC Setting gem provides a convenient way to access nested values, including full support for the default values within nested hashes (as of 0.1.1).
Consider the following nested hash example:
default.yml
Setting.load(:files => ['default.yml'], :path => ...)
Setting.services(:inventory)
Setting.services(:inventory, :url)
staging.yml
We are changing URLs for services in staging.yml, so they work in the staging environment. Service URLs have been updated to use localhost:
Setting.load(:files => ['default.yml', 'staging.yml'], :path => ...)
Setting.services(:inventory)
Setting.services(:inventory, :url)
== Capistrano Recommendations
Assume the directory structure of your Rails application is as follows:
config/settings/default.yml config/settings/environments/development.yml config/settings/environments/staging.yml config/settings/environments/production.yml config/settings/local config/settings/systems/reporting.yml config/settings/systems/admin.yml
Note that the "local" directory is empty, and that the "systems" directory contains several YAML files which provide alternative configuration for a reporting server and the admin server, both of which run in the "production" rails environment.
When deploying to the main production site, neither YAML files inside "systems" folder are activated or used.
But upon deployment to the admin server, Capistrano could symlink "admin.yml" from config/settings/local
folder, so the Setting gem would load these values. So for each Capistrano role, you can define which files need to be symlinked into local, thus creating a flexible configuration scheme which can be easily managed by Capistrano.
== Copyright
Copyright 2010-2020 © ModCloth Inc & Contributors.
Authors: 2010-2020 Edwin Cruz, Colin Shield & Konstantin Gredeskoul
== License
This software is distributed under the xref:LICENSE.txt[MIT License].
FAQs
Unknown package
We found that mc-settings demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.