Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
OpenUriAndWrite is an easy to use wrapper for Net::Dav, making it as easy to write to WebDAV enabled webservers as local files.
It is possible to open an http/https URL and write to it as though it were a local file:
open("http://www.ruby-lang.org/open_uri_and_write.html","w") {|f|
f.puts "<h1>OpenUriAndWrite</h1>"
}
With method chaining it gets more compact:
open("http://www.ruby-lang.org/open_uri_and_write.html","w").puts "<h1>OpenUriAndWrite</h1>"
Files can be deleted as local files:
File.delete("http://www.ruby-lang.org/open_uri_and_write.html")
Directories are created the same way as local files:
Dir.mkdir("http://www.ruby-lang.org/open_uri_and_write")
By default the scripts prompts the user for username and password. The username and hostname are stored in the file ~/.open-uri-and-write-usernames, so the next time only the password has to be typed in. On OSX the password is stored encrypted in the keychain.
Credentials can also supplied as environment variables or options.
Default behaviour if no username or password is set:
$ ruby webdav_test.rb
Username for www.example.com: scott
Password for 'scott@www.example.com: *****
Username and hostname stored in /Users/thomasf/.open-uri-and-write-usernames
$ ruby webdav_test.rb
Password for 'scott@www.example.com: *****
Supplying credentials with the DAVUSER and DAVPASS environment variables:
$ export DAVUSER=scott
$ export DAVPASS=tiger
$ ruby webdav_test.rb
Setting username and password in ruby:
ENV['DAVUSER'] = 'scott'
ENV['DAVPASS'] = 'tiger'
Another option is to supply username and password as arguments to open:
file = open('https://www.example.com/', 'w', :username => 'scott', :password => 'tiger')
On OS X passwords typed in by the user will be stored encrypted in the Keychain and reused later.
$ export DAVUSER=scott
$ ruby webdav_test.rb
Password for 'scott@www.example.com': *****
Password for 'scott@www.example.com' stored on OS X KeyChain.
The next time this script is executed, it will not prompt for username and password.
In difference to files and directories on local filesystems, files and directories on WebDAV servers can have many custom properties. Properties can be read with til propfindare set as a xml snippet with proppatch() and accessed with propfind().
file = File.open('http://www.ruby-lang.org/open_uri_and_write.html','w')
file.proppatch('<D:Author>Thomas Flemming</D:Author>')
properties_as_xml = Dir.propfind("http://www.ruby-lang.org")
If no filemode is specified when using open on url, standard 'open-uri' will be used.
puts open("http://www.ruby-lang.org").read() # Use 'open-uri'
open('http://www.ruby-lang.org/my_page.html','w').puts("<h1>HTML</h1>") # Use 'open-uri-and-write'
To not interfer with the 'open-uri' standard library, the 'open-uri-and-write' gem is only active in file modes 'w','a','w+','a+' and 'r+'.
r Read-only mode. The file pointer is placed at the beginning of the file. This is the default mode.
r+ Read-write mode. The file pointer will be at the beginning of the file.
w Write-only mode. Overwrites the file if the file exists. If the file does not exist, creates a new file for writing.
w+ Read-write mode. Overwrites the existing file if the file exists. If the file does not exist, creates a new file for reading and writing.
a Write-only mode. The file pointer is at the end of the file if the file exists. That is, the file is in the append mode. If the file does not exist, it creates a new file for writing.
a+ Read and write mode. The file pointer is at the end of the file if the file exists. The file opens in the append mode. If the file does not exist, it creates a new file for reading and writing.
$ gem install open-uri-and-write
For OSX users this will store password on the keychain.
$ gem install keychain_services
Note that if you have stored a misspelled password on the OSX Keychain, then you will have to delete it manually with Keychain Access application.
To run all tests:
$ rake spec
The tests will start a webserver with webdav at startup, and close it down before finishing.
This is work in progress. You can write files and crate directories, but there's still work to do on reading directories and at the time one filemodes "r", "w" and "a" is supported.
More protocols like FTP, SCP and Amazon S3 would be useful.
Thomas Flemming
FAQs
Unknown package
We found that open-uri-and-write demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.