Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Classing rake tasks with options. Creating re-usable tasks, options and samples thereof.
Rake commander is a way to declare rake tasks with re-usable classes. It enhances the command line syntax, as tasks can come with their own options, inherit them, re-use declared options sets, modify/re-open or even remove them.
Although the OptionParser
ruby native class is used for parsing the options, the declaration of options, additionally to the ones of OptionParser
comes with some opinionated improvements and amendments:
required
deep_dup
)default
value.
Add this line to your application's Gemfile:
gem 'rake-commander', require: %w[rake-commander]
And then execute:
$ bundle
Or install it yourself as:
$ gem install rake-commander
See {file:CHANGELOG.md} for a list of changes.
See the examples
.
rake -T examples
Go through the basic example.
rake examples:basic -- -h
rake examples:basic -- -z -e prod
--
is used to tell to rake-commander where the options section starts.At the same time the double dash delimiter seems to make rake ignore anything that comes afterwards. Without loading rake commander, you could try:
$ rake --trace rspec
** Invoke spec (first_time)
** Execute spec
rspec logging and results
And then re-try with
$ rake rspec -- --trace
rspec logging and results
--trace
option is being natively ignored by rake
due to the preceding double dash (--
).RakeCommander::Custom::Base < RakeCommander
include Rake::DSL
end
include Rake::DSL
for backwards compatibilityRakeCommander::Custom::MyTask < RakeCommander::Custom::Base
desc "it does some stuff"
task :do_stuff
option :s, '--do-stuff [SOMETHING]', default: 'nothing'
def task(*_args)
puts "Doing #{options[:s]}" if options[:s]
end
end
It supports most of options syntax of the native OptionParser
but for a couple of exceptions perhaps:
-nNAME
).name=NAME
, n=NAME
)An argument of an option should be explicitly declared in the name
part:
option :n, '--name NAME'
Although it is planned to extend the syntax, the current version shares the options through all tasks (declared as RakeCommander
classes) that are invoked in the same command line.
rake [rake-options] task1 task2 -- [shared-task-options]
The double dash --
delimiter allows to modify the ARGV
parsing behaviour of rake
, giving room for opinionated enhanced syntax. Anything that comes before the double dash is fed to standard rake
, and anything after --
are parsed as option tasks via rake commander
.
<rake part> -- [tasks options part]
rake
full supportWork has been done with the aim of providing a full patch on rake
, provided that the main invocation command remains as rake
.
Rake
There is only one patch onto Rake::Application#top_level
method, collect_command_line_tasks
is recalled with the arguments cut (so it does not interpret task option arguments as tasks).
For further details please see RakeCommander::Patcher
.
To install this gem onto your local machine, run bundle exec rake install
. To release a new version, update the version number in version.rb
, and then run bundle exec rake release
, which will create a git tag for the version, push git commits and tags, and push the .gem
file to rubygems.org.
For more info on available Rake
tasks: rake -T
(or bin/raked -T
)
FAQs
Unknown package
We found that rake-commander demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.