Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
= SearchableRecord
SearchableRecord is a small Ruby on Rails plugin that makes the parsing of query parameters from URLs easy for resources, allowing the requester to control the items (records) shown in the resource's representation.
The implementation is a helper module (a mixin) for ActiveRecord models. It is used by including SearchableRecord module in a model.
The mixin provides a class method, SearchableRecord#find_queried, to the class that includes it. The method is a front-end to ActiveRecord::Base#find: it parses query parameters against the given rules and calls find accordingly, returning the results of find.
The plugin is compatible with both Ruby 1.8 and 1.9.
== A usage example
The following example, although a bit contrived, allows the client to
First, we need resource items. Let us presume the application allows its clients to query Item type of resources:
class Item < ActiveRecord::Base include SearchableRecord end
By including SearchableRecord module to Item, the method find_queried becomes available. The method can be called, for example, in ItemController to parse the client's query parameters:
Item.find_queried(:all, query_params, rules, options)
In the beginning of this example, we stated requirements what the clients are allowed to query. These requirements are expressed as the following rules:
rules = { :limit => nil, # key as a flag; the value for the key is not used :offset => nil, # key as a flag :sort => { "name" => "items.name", "created" => "items.created_at" }, :rsort => nil, # rsort is allowed according to rules in :sort (key as a flag) :since => "items.created_at", # cast parameter value as the default type :until => "items.created_at", # cast parameter value as the default type :patterns => { :type => "items.type", # match the pattern with the default operator and converter :name => { :column => "items.name", :converter => lambda { |val| "%#{val.gsub('_', '.')}%" } } } # match the pattern with the default operator }
These rules are fed to find_queried as the third argument.
In addition, the application may to require options to be passed to find:
options = { :include => [ :owners ], :conditions => "items.flag = 'f'" }
These can be supplied to find_queried as the fourth argument.
The second argument to find_queried is the query parameters ItemController receives. For example, the client uses the URL http://example-site.org/items?limit=5&offset=4&rsort=name&since=2008-02-28&name=foo_bar to fetch a representation of the application's resource containing the items. The action results to the following parameters:
query_params = params
With these query parameters and arguments, find_queried calls find with the following arguments:
Item.find(:all, :include => [ :owners ], :order => "items.name desc", :offset => 4, :limit => 5, :conditions => [ "(items.flag = 'f') and (items.created_at <= cast(:until as datetime)) and (items.name like :name)", { :until => "2008-02-28", :name => "%foo.bar%" } ])
This particular search results to at most 5 items that are
See find_queried method in SearchableRecord::ClassMethods for details.
== Installation
The plugin is available as a RubyGem from RubyForge[http://rubyforge.org/]. In order to install the gem for a Rails application, edit the environment.rb file of the application to contain the following line:
config.gem "searchable_record"
(This requires Rails version 2.1 or above.)
Then install the gem:
$ rake gems:install $ rake gems:unpack
Use git to get the source code for modifications and hacks:
$ git clone git://github.com/tuomas/searchable_record.git
== Contacting
Please send feedback by email to Tuomas Kareinen < tkareine (at) gmail (dot) com >.
== Legal notes
Copyright (c) 2008-2009 Tuomas Kareinen. See MIT-LICENSE.txt in this directory.
FAQs
Unknown package
We found that searchable_record demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.