
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Rack::Parser is a rack middleware that allows your application to do decode/parse incoming post data into param hashes for your applications to use. You can provide a custom Parser for things like JSON, XML, MSGPACK using your library of choice.
install it via rubygems:
gem install rack-parser
or put it in your Gemfile:
# Gemfile
gem 'rack-parser', :require => 'rack/parser'
In a Sinatra or Padrino application, it would probably be something like:
# app.rb
use Rack::Parser, :parsers => { 'application/json' => proc { |data| JSON.parse data },
'application/xml' => proc { |data| XML.parse data },
%r{msgpack} => proc { |data| Msgpack.parse data }
}
By default, Rack::Parser uses JSON
decode/parse your JSON Data. This can be overwritten if you choose not to use
them. You can do it like so:
use Rack::Parser, :parsers => {
'application/json' => proc { |body| MyCustomJsonEngine.do_it body },
'application/xml' => proc { |body| MyCustomXmlEngine.decode body },
'application/roll' => proc { |body| 'never gonna give you up' }
}
Rack::Parser comes with a default error handling response that is sent
if an error is to occur. If a logger
is present, it will try to warn
with the content type and error message.
You can additionally customize the error handling response as well to whatever it is you like:
use Rack::Parser, :handlers => {
'application/json' => proc { |e, type| [400, { 'Content-Type' => type }, ["broke"]] }
}
The error handler expects to pass both the error
and content_type
so
that you can use them within your responses. In addition, you can
override the default response as well.
If no content_type error handling response is present, it will return 400
Do note, the error handler rescues exceptions that are descents of StandardError
. See
http://www.mikeperham.com/2012/03/03/the-perils-of-rescue-exception/
With version 0.4.0
, you can specify regex matches for the content
types that you want the parsers
and handlers
to match.
NOTE: you need to explicitly pass a Regexp
for it to regex match.
parser = proc { |data| JSON.parse data }
handler = proc { |e, type| [400, {}, 'boop'] }
use Rack::Parser, :parsers => { %r{json} => parser },
:handlers => { %r{heyyyy} => handler }
This project came to being because of:
multi_xml
version dependency for XML/YAML exploitCopyright © 2011,2012,2013 Arthur Chiu. See MIT-LICENSE for details.
FAQs
Unknown package
We found that rack-parser demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.