
Security News
New Website “Is It Really FOSS?” Tracks Transparency in Open Source Distribution Models
A new site reviews software projects to reveal if they’re truly FOSS, making complex licensing and distribution models easy to understand.
nt-fingerprint is a Ruby gem for converting queries into fingerprints.
require 'nt/fingerprint'
class Sample
include Nt::Fingerprint
end
puts Sample.new.fingerprint("SELECT a, b, 'c' FROM t WEHERE a = 1 AND b IN (1, 2, 3)")
# => select a, b, ? from t wehere a = ? and b in(?+)
nt-fingerprint exposes a single method fingerprint
. What the method does is just calling a function query.Fingerprint
of percona/go-mysql via FFI. Thus, the behavior of fingerprint
completely follows that of query.Fingerprint
. We quote the description of query.Fingerprint
from the documentation of go-mysql.
func Fingerprint(q string) string
Fingerprint returns the canonical form of q. The primary transformations are:
- Replace values with ? - Collapse whitespace - Remove comments - Lowercase everything
Additional trasnformations are performed which change the syntax of the original query without affecting its performance characteristics. For example, "ORDER BY col ASC" is the same as "ORDER BY col", so "ASC" in the fingerprint is removed.
A typical use case of nt-fingerprint is query logging. Using nt-fingerprint, one can exclude sensitive information from queries. This makes it possible to log production queries while maintaining security.
For example, one can capture arbitrary ActiveRecord queries by combining Arproxy and nt-fingerprint.
class QueryLogger < Arproxy::Base
include Nt::Fingerprint
def execute(sql, name=nil)
Rails.logger.info(fingerprint(sql))
super(sql, name)
end
end
Arproxy.configure do |config|
config.use QueryLogger
end
FAQs
Unknown package
We found that nt-fingerprint demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A new site reviews software projects to reveal if they’re truly FOSS, making complex licensing and distribution models easy to understand.
Security News
Astral unveils pyx, a Python-native package registry in beta, designed to speed installs, enhance security, and integrate deeply with uv.
Security News
The Latio podcast explores how static and runtime reachability help teams prioritize exploitable vulnerabilities and streamline AppSec workflows.