Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
racksh (Rack::Shell) is a console for Rack based ruby web applications.
It's like script/console in Rails or merb -i in Merb, but for any app built on Rack. You can use it to load application environment for Rails, Merb, Sinatra, Camping, Ramaze or your own framework provided there is config.ru file in app's root directory.
It's purpose is to allow developer to introspect his application and/or make some initial setup. You can for example run DataMapper.auto_migrate! or make a request to /users/666 and check response details. It's mainly aimed at apps that don't have console-like component (ie. app built with Sinatra) but all frameworks can benefit from interactive Rack stack and request introspection.
It loads whole application environment like Rack web server, but instead of running the app it starts irb session. Additionally it exposes $rack variable which allows you to make simulated HTTP requests to your app.
gem install racksh
To start racksh session run following inside rack application directory (containing config.ru file):
% racksh
Rack::Shell v1.0.1 started in development environment.
>>
Specifying location of config.ru:
% CONFIG_RU=~/projects/foobar/config.ru racksh
Executing ruby code inside application environment and printing results:
% racksh Order.all
% racksh "Order.first :created_at => Date.today"
Specifying Rack environment (default is development):
% RACK_ENV=production racksh
Rack::Shell v1.0.1 started in production environment.
>>
% racksh
Rack::Shell v1.0.1 started in development environment.
>> $rack.get "/"
=> #<Rack::MockResponse:0xb68fa7bc @body="<html>...", @headers={"Content-Type"=>"text/html", "Content-Length"=>"1812"}, @status=200, ...
$rack variable contains following methods (thanks to rack-test gem):
# make GET request
$rack.get uri, params, env
# make POST request
$rack.post uri, params, env
# make PUT request
$rack.put uri, params, env
# make DELETE request
$rack.delete uri, params, env
# make HEAD request
$rack.head uri, params, env
# make custom request
$rack.request uri, params, env
# set HTTP header
$rack.header name, value
# set credentials for Basic Authorization
$rack.basic_authorize username, password
# set credentials for Digest Authorization
$rack.digest_authorize username, password
# follow redirect from previous request
$rack.follow_redirect!
# last request object
$rack.last_request
# last response object
$rack.last_response
# access your Rack app
$rack.app
# name of environment
$rack.env
Check test.rb from brynary's rack-test for implementation of above methods.
Examples:
$rack.get "/", {}, { 'REMOTE_ADDR' => '123.45.67.89' }
$rack.header "User-Agent", "Firefox"
$rack.post "/users", :user => { :name => "Jola", :email => "jola@misi.ak" }
Rack::Shell supports configuration file .rackshrc which is loaded from two places during startup: user's home dir and application directory (in this order). You can put any ruby code in it, but it's purpose is to setup your session, ie. setting headers which will be used for all $rack.get/post/... requests.
For example to set user agent to Firefox and re-migrate db if loaded environment is test put following in .rackshrc:
$rack.header "User-Agent", "Firefox"
DataMapper.auto_migrate! if $rack.env == "test"
You can also make requests:
$rack.put "/signin", :login => "jola", :password => "misiacz"
This will ensure you are always logged in when you start racksh.
If you've made some changes to your app and you want to reload it type:
reload!
It will reload (actually restart) whole Rack application in new process.
If you already opened irb and you want racksh functionality just run following:
require 'racksh/irb'
It will initialize racksh and load rack app. From now on you can use $rack.
Please report bugs and/or feature requests on the github issue tracker for the project located here.
FAQs
Unknown package
We found that racksh demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.