
Security News
Follow-up and Clarification on Recent Malicious Ruby Gems Campaign
A clarification on our recent research investigating 60 malicious Ruby gems.
Mongoid::UPK generates more unique _id
by using UUID.
UPK stands for "unique primary key" or "uuid primary key".
gem install mongoid_upk
Gemfile
gem "mongoid_upk"
Basic
class MyModel
include Mongoid::Document
include Mongoid::UPK
end
or:
class MyModel
include Mongoid::Document
include Mongoid::UPK
uuid_pk # you can leave this out, because it's the default generator
end
Will use UUID
(uuid gem by assaf), :compact
mode per default.
Pretty UUID
class MyModel
include Mongoid::Document
include Mongoid::UPK
pretty_uuid_pk
end
Almost same as above but with hyphens in it.
(Example: c1b457b0-3214-012f-316d-10e6baa29f2c
)
Mixed ID
class MyModel
include Mongoid::Document
include Mongoid::UPK
bson_uuid_pk
end
Very long _id
with both BSON::ObjectId and UUID.
(Example: 4f2e55a2ee911332c4000001-95faf560320f012f315510e6baa29f2c
)
Own pk generator
class MyModel
include Mongoid::Document
include Mongoid::UPK
unique_pk do
# code goes here
# result must be a string
# example:
Digest::MD5.hexdigest(Time.now.to_f.to_s)
end
end
Example is self-describing.
While writing very fast to MongoDB it is possible to take a BSON::ObjectId twice. This will lead to big troubles because you never know which document will be returned.
This gem utilizes the key
method and overwrites the automatically given default id with the choosen generator on save.
So the real id can be read first after a successful save (I don't want to hack deeper here, because saves are more important than getting a unique id on instance initialization).
UUID is in most cases more reliable, especially if the app instances are set up correctly (and/or running on different machines).
Read more about the UUID gem and how to set up your project (e.g. using unicorn or other threaded webservers).
MIT/X11
2012 — Christoph 'asaaki' Grabo
FAQs
Unknown package
We found that mongoid_upk demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.
Security News
ESLint now supports parallel linting with a new --concurrency flag, delivering major speed gains and closing a 10-year-old feature request.
Research
/Security News
A malicious Go module posing as an SSH brute forcer exfiltrates stolen credentials to a Telegram bot controlled by a Russian-speaking threat actor.