Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Avoid N + 1 queries without having to worry about it at all! It is also useful when you do not have control over which associations are going to be used by the view, like when you provide users customizable views with Liquid.
You can use gem install smart_preloads
to install it manually or use Bundler:
gem 'smart_preloads'
You have to call smart_preloads
at the end of your association. This will
generate a smart list of items that will load associations if and when
they are needed.
@authors = Author.all.smart_preloads
@authors.each do |author|
puts author.name
end
#=> SELECT "authors".* FROM "authors"
@authors.each do |author|
author.books.each do |book|
puts "#{author.name} authored #{book.name}"
end
end
#=> SELECT "books".* FROM "books" WHERE "books"."author_id" IN (1, 2)
Note that when books
is called for the first record, that association will be
loaded for all records at once. This works for nested associations too:
@authors.each do |author|
author.books.each do |book|
puts "#{author.name} authored #{book.name} (#{book.category.name})"
end
end
#=> SELECT "categories".* FROM "categories" WHERE "categories"."id" IN (1, 2)
In order for it to work, smart_preloads
has a custom list class
(SmartPreloads::List
) and a custom item class for each item in a list
(SmartPreloads::Item
).
The List class allows detecting when the collection is really used (iterated) so only then the associations will be detected and mokey patched in place. This is needed so whenever a call to an association is made it will be loaded, even from calls from within the object itself.
The Item class monkey patches all association methods in the objects loaded
to intercept the calls. The monkey patch is in place, not global. Only
the objects in the smart_preloads
collection will be monkey patched.
Note that when you call Author.all.smart_preloads.first
you will not
have an instance of Author
. Instead, you will have an instance of
SmartPreloads::Item
that delegates calls to the original Author
object.
Copyright (c) 2017 Diego Aguir Selzlein. See LICENSE.txt for further details.
FAQs
Unknown package
We found that smart_preloads demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.