
Security News
Nx npm Packages Compromised in Supply Chain Attack Weaponizing AI CLI Tools
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.
URL is a simple URL parser and construction tool for Ruby. It doesn't follow any RFC, instead, it behaves as you expect.
This gem was born out of frustration with the URL handling in Ruby's standard library and other gems. I wanted to be able to parse a URL, modify it and then get the modified URL back as a string. I also wanted to be able to join paths and query strings to URLs without having to worry about trailing slashes and question marks.
gem "qasa-url"
# Initialize a new URL object by parsing a URL string:
url = URL.parse("http://www.example.com:404/path")
url.to_s # => "http://www.example.com:404/path"
# Modify a URL:
url.scheme = "https"
url.port = nil
url.join("/to")
url.join("/nowhere")
url.to_s # => "https://www.example.com/path/to/nowhere"
# Add a query string:
url.merge(foo: "bar")
url.to_s # => "https://www.example.com/path/to/nowhere?foo=bar"
# Initialize a URL object with just a domain name:
url = URL["example.com"]
url.join("/path", "to", "nowhere")
# Note: If you don't provide a protocol, it'll default to "https":
url.to_s # => "https://example.com/path/to/nowhere"
If you're looking for something that parses URLs in Ruby and Ruby on Rails and closely conforms to RFC 3986, RFC 3987, and RFC 6570 (level 4), check out addressable. If you need to do domain name validation check out public_suffix.
The risk should be considered low. The gem is very small, simple and well-tested. The only risk is that it doesn't follow any RFCs. This means that it might not behave as you expect. However, it's very unlikely that you'll run into any problems. The gem is maintained by Qasa, we're a small team of dedicated Ruby developers.
Bug reports and pull requests are always welcome!
See LICENSE.
FAQs
Unknown package
We found that qasa-url demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.
Security News
CISA’s 2025 draft SBOM guidance adds new fields like hashes, licenses, and tool metadata to make software inventories more actionable.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.