Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
NetHttp2 is an HTTP/2 client for Ruby.
Just install the gem:
$ gem install net-http2
Or add it to your Gemfile:
gem 'net-http2'
NetHttp2 can perform sync and async calls. Sync calls are very similar to the HTTP/1 calls, while async calls take advantage of the streaming properties of HTTP/2.
To perform a sync call:
require 'net-http2'
# create a client
client = NetHttp2::Client.new("http://nghttp2.org")
# send request
response = client.call(:get, '/')
# read the response
response.ok? # => true
response.status # => '200'
response.headers # => {":status"=>"200"}
response.body # => "A body"
# close the connection
client.close
To perform an async call:
require 'net-http2'
# create a client
client = NetHttp2::Client.new("http://nghttp2.org")
# prepare request
request = client.prepare_request(:get, '/')
request.on(:headers) { |headers| p headers }
request.on(:body_chunk) { |chunk| p chunk }
request.on(:close) { puts "request completed!" }
# send
client.call_async(request)
# Wait for all outgoing stream to be closed
client.join(timeout: 5)
# close the connection
client.close
NetHttp2::Client
NetHttp2::Client
Returns a new client. url
is a string
such as http://nghttp2.org
.
The current options are:
:connect_timeout
, specifies the max connect timeout in seconds (defaults to 60).:ssl_context
, in case the url has an https scheme and you want your SSL client to use a custom context.:proxy_addr
, :proxy_port
, :proxy_user
, :proxy_pass
, specify Proxy connection parameters.To create a new client:
NetHttp2::Client.new("http://nghttp2.org")
To create a new client with a custom SSL context:
certificate = File.read("cert.pem")
ctx = OpenSSL::SSL::SSLContext.new
ctx.key = OpenSSL::PKey::RSA.new(certificate, "cert_password")
ctx.cert = OpenSSL::X509::Certificate.new(certificate)
NetHttp2::Client.new("https://nghttp2.org", ssl_context: ctx)
Allows to set a callback for the client. The only available event is :error
, which allows to set a callback when an error is raised at socket level, hence in the underlying socket thread.
client.on(:error) { |exception| puts "Exception has been raised: #{exception}" }
It is RECOMMENDED to set the
:error
callback: if none is defined, the underlying socket thread may raise an error in the main thread at unexpected execution times.
URI
Returns the URI of the endpoint.
These behave similarly to HTTP/1 calls.
NetHttp2::Response
or nil
Sends a request. Returns nil
in case a timeout occurs.
method
is a symbol that specifies the :method
header (:get
, :post
, :put
, :patch
, :delete
, :options
). The body, headers and query-string params of the request can be specified in the options, together with the timeout.
response_1 = client.call(:get, '/path1')
response_2 = client.call(:get, '/path2', headers: { 'x-custom' => 'custom' })
response_3 = client.call(:post, '/path3', body: "the request body", timeout: 1)
response_3 = client.call(:post, '/path4', params: { page: 4 })
The real benefit of HTTP/2 is being able to receive body and header streams. Instead of buffering the whole response, you might want to react immediately upon receiving those streams. This is what non-blocking calls are for.
NetHttp2::Request
Prepares an async request. Arguments are the same as the call
method, with the difference that the :timeout
option will be ignored. In an async call, you will need to write your own logic for timeouts.
request = client.prepare_request(:get, '/path', headers: { 'x-custom-header' => 'custom' })
Calls the server with the async request.
Wait for all outstanding requests to be completed, optionally with a timeout for this condition to be met. Raises NetHttp2::AsyncRequestTimeout if the timeout is reached.
NetHttp2::Request
symbol
The request's method.
URI
The request's URI.
string
The request's path.
hash
The query string params in hash format, for example {one: 1, two: 2}
. These will be encoded and appended to path
.
string
The request's body.
integer
The request's timeout.
Allows to set a callback for the request. Available events are:
:headers
: triggered when headers are received (called once).:body_chunk
: triggered when body chunks are received (may be called multiple times).:close
: triggered when the request has been completed (called once).Even if NetHttp2 is thread-safe, the async callbacks will be executed in a different thread, so ensure that your code in the callbacks is thread-safe.
request.on(:headers) { |headers| p headers }
request.on(:body_chunk) { |chunk| p chunk }
request.on(:close) { puts "request completed!" }
NetHttp2::Response
boolean
Returns if the request was successful.
hash
Returns a Hash containing the Headers of the response.
string
Returns the status code.
string
Returns the RAW body of the response.
NetHttp2 is thread-safe. However, some caution is imperative:
:error
callback on the Client (recommended).So you want to contribute? That's great! Please follow the guidelines below. It will make it easier to get merged in.
Before implementing a new feature, please submit a ticket to discuss what you intend to do. Your feature might already be in the works, or an alternative implementation might have already been discussed.
Do not commit to master in your fork. Provide a clean branch without merge commits. Every pull request should have its own topic branch. In this way, every additional adjustments to the original pull request might be done easily, and squashed with git rebase -i
. The updated branch will be visible in the same pull request, so there will be no need to open new pull requests when there are changes to be applied.
Ensure to include proper testing. To run tests you simply have to be in the project's root directory and run:
$ rake
FAQs
Unknown package
We found that net-http2 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.