
Security News
Follow-up and Clarification on Recent Malicious Ruby Gems Campaign
A clarification on our recent research investigating 60 malicious Ruby gems.
Queuel is a 'kewl', lite wrapper around Queue interfaces. Currently it implements:
Each of these should reliably implement:
push
pop
receive
Along with some further conveniences.
Add this line to your application's Gemfile as well as the proper Gem for your queuing:
gem 'iron_mq' # if using IronMQ
gem 'aws-sdk' # if using Amazon SQS
gem 'aws-sdk-v1' # if using Amazon SQS but you are already using AWS and need to continue using v2
# IronMQ recommends `gem "typhoeus"` as well for some speed benefits
gem 'queuel'
And then execute:
$ bundle
You will then want to configure:
Queuel.configure do
# Optional, but a queue must be selected before running put/pop/receive
default_queue :venues
# requirement depends on your Queue
credentials token: 'asdufasdf8a7sd8fa7sdf', project_id: 'project_id'
# currently [:iron_mq, :sqs, :null] available
engine :iron_mq
# For Queuel.recevier {} you can configure more than one thread to
# handle incoming messages
receiver_threads 3 # default: 1
# Logging: Default is MonoLogger, because its a non-blocking log-extension
# To the standard lib Logger. Any Log4r solution should work.
logger Logger # default: MonoLogger.new(STDOUT)
log_level MonoLogger::DEBUG # default: MonoLogger::ERROR # => 3
# Incoming messages can be automatically encoded/decoded
decode_by_default false # default: true
decoder ->(body) { MultiJson.load body } # default: Queuel::Serialization::Json::Decoder
encode_by_default false # default: true
encoder ->(body) { body.to_s } # default: Queuel::Serialization::Json::Encoder
end
# Using default Queue from config
Queuel.pop
Queuel.push "My message to you"
Queuel.receive do |message|
puts "I received #{message.body}" # NOTE the message interface may change, this is currently not wrapped by the gem
end
# With the non-default queue
Queuel.with("officials").pop
Queuel.with("officials").push "My message to you"
Queuel.with("officials").receive do |message|
puts "I received #{message.body}" # NOTE the message interface may change, this is currently not wrapped by the gem
end
# Break on nil
Queuel.receive break_if_nil: true do |message|
puts "I received #{message.body}" # NOTE the message interface may change, this is currently not wrapped by the gem
end
Currently the SQS engine is the only engine with the s3 fallback support and takes the following keys:
s3_access_key_id
s3_secret_access_key
s3_bucket_name
max_bytesize
(optional)With these in place, messages over the max_bytesize
(defaults to 64kb) will
be sent to the designated bucket. Without this in place, messages over SQS's
limit be dropped from the queue.
message.id # => ID of the message
message.raw_body # => Raw Message body
message.body # => Message body (parsed, if configured to do so)
message.delete # => Delete the message
Queuel uses MultiJson to provide some auto-message decoding/encoding features. With MultiJson you may install your own engine (like Oj).
Because of the parsing given, you will default to encoding and decoding JSON:
Queuel.push username: "jon"
Queuel.pop # => { username: "jon" }
You can configure your decoder/encoder on the fly:
Queuel.push { username: "jon" }, encoder: ->(body) { }
Queuel.pop decoder: ->(raw) { }
Queuel.receive decoder: ->(raw) { }
You can turn of encoding/decoding at calltime with:
Queuel.push { username: "jon" }, encode: false
Queuel.pop decode: false
Queuel.receive decode: false
git checkout -b my-new-feature
)git commit -am 'Add some feature'
)git push origin my-new-feature
)FAQs
Unknown package
We found that queuel demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.
Security News
ESLint now supports parallel linting with a new --concurrency flag, delivering major speed gains and closing a 10-year-old feature request.
Research
/Security News
A malicious Go module posing as an SSH brute forcer exfiltrates stolen credentials to a Telegram bot controlled by a Russian-speaking threat actor.