Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
AppVeyor | Jenkins | Github actions | Codecov | Gem |
---|---|---|---|---|
See bzip2 library.
Operating systems: GNU/Linux, FreeBSD, OSX.
Dependencies: bzip2 1.0.0+ version.
Popular OS | Dependencies |
---|---|
Ubuntu | libbz2-dev |
CentOS | bzip2-devel |
ArchLinux | bzip2 |
OSX | bzip2 |
gem install ruby-bzs
You can build it from source.
rake gem
gem install pkg/ruby-bzs-*.gem
You can also use overlay for gentoo.
On M1 Macs, Homebrew installs to /opt/homebrew, so you'll need to specify its include and lib paths when building the native extension for bzip2.
brew install bzip2
gem install ruby-bzs -- --with-opt-include=/opt/homebrew/include --with-opt-lib=/opt/homebrew/lib
You can also configure Bundler to use those options when installing:
bundle config set build.ruby-bzs "--with-opt-include=/opt/homebrew/include --with-opt-lib=/opt/homebrew/lib"
There are simple APIs: String
and File
. Also you can use generic streaming API: Stream::Writer
and Stream::Reader
.
require "bzs"
data = BZS::String.compress "sample string"
puts BZS::String.decompress(data)
BZS::File.compress "file.txt", "file.txt.bz2"
BZS::File.decompress "file.txt.bz2", "file.txt"
BZS::Stream::Writer.open("file.txt.bz2") { |writer| writer << "sample string" }
puts BZS::Stream::Reader.open("file.txt.bz2") { |reader| reader.read }
writer = BZS::Stream::Writer.new output_socket
begin
bytes_written = writer.write_nonblock "sample string"
# handle "bytes_written"
rescue IO::WaitWritable
# handle wait
ensure
writer.close
end
reader = BZS::Stream::Reader.new input_socket
begin
puts reader.read_nonblock(512)
rescue IO::WaitReadable
# handle wait
rescue ::EOFError
# handle eof
ensure
reader.close
end
You can create and read tar.bz2
archives with minitar.
require "bzs"
require "minitar"
BZS::Stream::Writer.open "file.tar.bz2" do |writer|
Minitar::Writer.open writer do |tar|
tar.add_file_simple "file", :data => "sample string"
end
end
BZS::Stream::Reader.open "file.tar.bz2" do |reader|
Minitar::Reader.open reader do |tar|
tar.each_entry do |entry|
puts entry.name
puts entry.read
end
end
end
All functionality (including streaming) can be used inside multiple threads with parallel. This code will provide heavy load for your CPU.
require "bzs"
require "parallel"
Parallel.each large_datas do |large_data|
BZS::String.compress large_data
end
Please review rdoc generated docs.
Option | Values | Default | Description |
---|---|---|---|
source_buffer_length | 0 - inf | 0 (auto) | internal buffer length for source data |
destination_buffer_length | 0 - inf | 0 (auto) | internal buffer length for description data |
gvl | true/false | false | enables global VM lock where possible |
block_size | 1 - 9 | 9 | block size to be used for compression |
work_factor | 0 - 250 | 0 | controls threshold for switching from standard to fallback algorithm |
small | true/false | true | enables alternative decompression algorithm with less memory |
quiet | true/false | false | disables bzip2 library logging |
There are internal buffers for compressed and decompressed data.
For example you want to use 1 KB as source_buffer_length
for compressor - please use 256 B as destination_buffer_length
.
You want to use 256 B as source_buffer_length
for decompressor - please use 1 KB as destination_buffer_length
.
gvl
is disabled by default, this mode allows running multiple compressors/decompressors in different threads simultaneously.
Please consider enabling gvl
if you don't want to launch processors in separate threads.
If gvl
is enabled ruby won't waste time on acquiring/releasing VM lock.
You can also read bzs docs for more info about options.
Possible compressor options:
:source_buffer_length
:destination_buffer_length
:gvl
:block_size
:work_factor
:quiet
Possible decompressor options:
:source_buffer_length
:destination_buffer_length
:gvl
:small
:quiet
Example:
require "bzs"
data = BZS::String.compress "sample string", :block_size => 1
puts BZS::String.decompress(data, :block_size => 1)
String maintains destination buffer only, so it accepts destination_buffer_length
option only.
::compress(source, options = {})
::decompress(source, options = {})
source
is a source string.
File maintains both source and destination buffers, it accepts both source_buffer_length
and destination_buffer_length
options.
::compress(source, destination, options = {})
::decompress(source, destination, options = {})
source
and destination
are file pathes.
Its behaviour is similar to builtin Zlib::GzipWriter
.
Writer maintains destination buffer only, so it accepts destination_buffer_length
option only.
::open(file_path, options = {}, :external_encoding => nil, :transcode_options => {}, &block)
Open file path and create stream writer associated with opened file.
Data will be transcoded to :external_encoding
using :transcode_options
before compressing.
It may be tricky to use both :pledged_size
and :transcode_options
. You have to provide size of transcoded input.
::new(destination_io, options = {}, :external_encoding => nil, :transcode_options => {})
Create stream writer associated with destination io.
Data will be transcoded to :external_encoding
using :transcode_options
before compressing.
It may be tricky to use both :pledged_size
and :transcode_options
. You have to provide size of transcoded input.
#set_encoding(external_encoding, nil, transcode_options)
Set another encodings, nil
is just for compatibility with IO
.
#io
#to_io
#stat
#external_encoding
#transcode_options
#pos
#tell
See IO
docs.
#write(*objects)
#flush
#rewind
#close
#closed?
See Zlib::GzipWriter
docs.
#write_nonblock(object, *options)
#flush_nonblock(*options)
#rewind_nonblock(*options)
#close_nonblock(*options)
Special asynchronous methods missing in Zlib::GzipWriter
.
rewind
wants to close
, close
wants to write
something and flush
, flush
want to write
something.
So it is possible to have asynchronous variants for these synchronous methods.
Behaviour is the same as IO#write_nonblock
method.
#<<(object)
#print(*objects)
#printf(*args)
#putc(object, :encoding => 'ASCII-8BIT')
#puts(*objects)
Typical helpers, see Zlib::GzipWriter
docs.
Its behaviour is similar to builtin Zlib::GzipReader
.
Reader maintains both source and destination buffers, it accepts both source_buffer_length
and destination_buffer_length
options.
::open(file_path, options = {}, :external_encoding => nil, :internal_encoding => nil, :transcode_options => {}, &block)
Open file path and create stream reader associated with opened file.
Data will be force encoded to :external_encoding
and transcoded to :internal_encoding
using :transcode_options
after decompressing.
::new(source_io, options = {}, :external_encoding => nil, :internal_encoding => nil, :transcode_options => {})
Create stream reader associated with source io.
Data will be force encoded to :external_encoding
and transcoded to :internal_encoding
using :transcode_options
after decompressing.
#set_encoding(external_encoding, internal_encoding, transcode_options)
Set another encodings.
#io
#to_io
#stat
#external_encoding
#internal_encoding
#transcode_options
#pos
#tell
See IO
docs.
#read(bytes_to_read = nil, out_buffer = nil)
#eof?
#rewind
#close
#closed?
See Zlib::GzipReader
docs.
#readpartial(bytes_to_read = nil, out_buffer = nil)
#read_nonblock(bytes_to_read, out_buffer = nil, *options)
See IO
docs.
#getbyte
#each_byte(&block)
#readbyte
#ungetbyte(byte)
#getc
#readchar
#each_char(&block)
#ungetc(char)
#lineno
#lineno=
#gets(separator = $OUTPUT_RECORD_SEPARATOR, limit = nil)
#readline
#readlines
#each(&block)
#each_line(&block)
#ungetline(line)
Typical helpers, see Zlib::GzipReader
docs.
:gvl
option is disabled by default, you can use bindings effectively in multiple threads.
Please be careful: bindings are not thread safe.
You should lock all shared data between threads.
For example: you should not use same compressor/decompressor inside multiple threads. Please verify that you are using each processor inside single thread at the same time.
Please visit scripts/test-images. See universal test script scripts/ci_test.sh for CI.
FAQs
Unknown package
We found that ruby-bzs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.