Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Rack::Parser is a rack middleware that allows your application to do decode/parse incoming post data into param hashes for your applications to use. You can provide a custom Parser for things like JSON, XML, MSGPACK using your library of choice.
install it via rubygems:
gem install rack-parser
or put it in your Gemfile:
# Gemfile
gem 'rack-parser', :require => 'rack/parser'
In a Sinatra or Padrino application, it would probably be something like:
# app.rb
use Rack::Parser, :parsers => { 'application/json' => proc { |data| JSON.parse data },
'application/xml' => proc { |data| XML.parse data },
%r{msgpack} => proc { |data| Msgpack.parse data }
}
By default, Rack::Parser uses JSON
decode/parse your JSON Data. This can be overwritten if you choose not to use
them. You can do it like so:
use Rack::Parser, :parsers => {
'application/json' => proc { |body| MyCustomJsonEngine.do_it body },
'application/xml' => proc { |body| MyCustomXmlEngine.decode body },
'application/roll' => proc { |body| 'never gonna give you up' }
}
Rack::Parser comes with a default error handling response that is sent
if an error is to occur. If a logger
is present, it will try to warn
with the content type and error message.
You can additionally customize the error handling response as well to whatever it is you like:
use Rack::Parser, :handlers => {
'application/json' => proc { |e, type| [400, { 'Content-Type' => type }, ["broke"]] }
}
The error handler expects to pass both the error
and content_type
so
that you can use them within your responses. In addition, you can
override the default response as well.
If no content_type error handling response is present, it will return 400
Do note, the error handler rescues exceptions that are descents of StandardError
. See
http://www.mikeperham.com/2012/03/03/the-perils-of-rescue-exception/
With version 0.4.0
, you can specify regex matches for the content
types that you want the parsers
and handlers
to match.
NOTE: you need to explicitly pass a Regexp
for it to regex match.
parser = proc { |data| JSON.parse data }
handler = proc { |e, type| [400, {}, 'boop'] }
use Rack::Parser, :parsers => { %r{json} => parser },
:handlers => { %r{heyyyy} => handler }
This project came to being because of:
multi_xml
version dependency for XML/YAML exploitCopyright © 2011,2012,2013 Arthur Chiu. See MIT-LICENSE for details.
FAQs
Unknown package
We found that rack-parser demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.