
Security News
Follow-up and Clarification on Recent Malicious Ruby Gems Campaign
A clarification on our recent research investigating 60 malicious Ruby gems.
Signaling is a Ruby library that provides a simple API to work with remote objects exposed through HTTP services.
Main goals for this project are:
Add this line to your application's Gemfile:
gem 'signaling'
And then execute:
$ bundle
Or install it yourself as:
$ gem install signaling
Define a namespace and remote API:
# app/models/example_com.rb
module ExampleCom
Api = Signaling::Api.new(url: "http://example.com/api")
def self.use_relative_model_naming?
true
end
end
The use_relative_model_naming?
tells ActiveModel::Naming
to build the
names of classes without the namespace.
read more
Define a model:
# app/models/example_com/item_list.rb
class ExampleCom::ItemList < Signaling::Base
use_api ExampleCom::Api
attribute :name, String
end
Attribute definition is implemented by virtus.
To change the key used to send the attribute to the remote server use the
:param_name
option.
attribute :name, String, param_name: :title
This will send the attribute to the server as :title
. this will not
parse it as :title
from the remote response.
Virtus provides an API for typed arrays, these can contain other Signaling models.
# app/models/example_com/item.rb
module ExampleCom
class Item < Signaling::Base
attribtue :name, String
end
end
# app/models/example_com/item_list.rb
module ExampleCom
class ItemList < Signaling::Base
use_api ExampleCom::Api
attribute :name
attribute :items, Array[ExampleCom::Item]
end
end
Tip!™ Use this in combination with :param_name
when using rails's
accepts_nested_attributes_for
.
module ExampleCom
class ItemList < Signaling::Base
use_api ExampleCom::Api
attribute :items, Array[ExampleCom::Item], param_name: :items_attributes
end
end
Signaling::Api.new
accepts the following options:
:url
- The base URL for the remote API:logger
- A Logger
-compatible object to use for loggingIt also accepts a block that yields with the faraday connection to allow adding custom middleware.
Api = Signaling::Api.new(url: api_base_url) do |faraday|
faraday.use SomeCustomFaradayMiddleware
end
Signaling handles errors returned from the remote service in the errors
json
field. It uses ActiveModel::Errors
for this so all the rails tricks should
work here.
> list = ExampleCom::ItemList.new(name: 'My list')
> list.save
If the remote service will respond with HTTP status code 422 (Unprocessable Entity) and the following json body:
{
"name": "My list",
"errors": {
"items": ["can not be empty"]
}
}
Then signaling will load these errors to the ItemList
models
> list.errors.full_messages
=> ["Items can not be empty"]
Here's a typical rails controller for a Signaling model
This file serves as a reference implementation for a controller and as a guide to make sure Signaling follows it's main goal.
To change the URL of a specific action:
module ExampleCom
class ItemList < Signaling::Base
use_api ExampleCom::Api
define_action :index, method: :get, path: 'accounts/:account_id/item_lists.json'
end
end
Then you can use:
> lists = ExampleCom::ItemList.all(account_id: '123')
# GET /accounts/123/item_lists.json
signaling allows sending parameters to remote service:
> ItemList.all(account_id: '123')
# GET /item_lists.json?account_id=123
git checkout -b my-new-feature
)git commit -am 'Add some feature'
)git push origin my-new-feature
)FAQs
Unknown package
We found that signaling demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.
Security News
ESLint now supports parallel linting with a new --concurrency flag, delivering major speed gains and closing a 10-year-old feature request.
Research
/Security News
A malicious Go module posing as an SSH brute forcer exfiltrates stolen credentials to a Telegram bot controlled by a Russian-speaking threat actor.