Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
= Smurf
Smurf is a Rails plugin that does Javascript and CSS minification the way you would expect. See, with Rails 2.x
we got this cool new :cache
option on javascript_include_tag
and stylesheet_link_tag
, but no option for minifying the cached file(s).
Smurf ends that. Smurf - if installed and when caching is enabled for the environment - will nab the concatenated file content from Rails just before it saves it and minifies the content using either Google Closure Compiler, JSmin or a custom CSS compressor.
Some cool things about Smurf, which also allude to the reasons I wrote it:
Smurf will work with most versions of Rails 2.3.x
and above; including Rails 3.0.x
.
=== JSmin
The Javascript is minified with the Google Closure Compiler. If the Closure Compiler fails, we fall back to JSMin (using Ryan Grove's Ruby port).
=== Smurf CSS Compressor
The following are the rules I applied, gathered from various perusals around the Internets
/* ... */
- this could be a problem (esp. for CSS hacks);
, :
, and ,
characters== Installation
You install Smurf as a gem:
sudo gem install ps-smurf
Because this latest version is intended to work with Rails 3 and above, you'll need to update your Gemfile ad add:
gem 'ps-smurf'
Then, wherever you define javascript_include_tag
or stylesheet_link_tag
, make sure to add the standard :cache => true
or :cache => 'some_bundle'
options.
Also make sure to at least have this setting in your production.rb:
config.perform_caching = true
bcarpenter reminded all of us that Rails will generate real files if you set config.action_controller.perform_caching
to true
. If you happen to do this while developing your fantastic Rails app you may also accidentally commit them to your development repository. This is not what you want as it can send you and your awesome developer friends down the wrong rabbit hole ... and then when you figure out the problem you may be understandably and misguidedly pissed at Smurf :)
bcarpenter didn't seem too mad since he reached out to me (whew!) and suggested I add a little comment about making sure to ignore the generated cache files/directories in your SCM of choice. If you happen to be using git, be sure to do something to the effect of the following in your .gitignore
file:
public/*/cache/*
== Testing
Simple:
rake
If you want to play around with different versions, you'll need to update the Gemfile version of rails. While Smurf itself should work as is with Rails 3 and Rails 2.3.x, the test setup is different enough between 3 and 2.3.x that I can't make guarantees. If you need a previous version, look for the appropriate tag in the source code.
== Copyright
Copyright (c) 2007-2012 Justin Knowlden, Lance Ivy, Scott White, Daniel Schierbeck, Nicolas Viennot, Paul Schreiber and Uwe L. Korn. See LICENSE.txt for further details.
FAQs
Unknown package
We found that ps-smurf demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.