
Security News
Follow-up and Clarification on Recent Malicious Ruby Gems Campaign
A clarification on our recent research investigating 60 malicious Ruby gems.
Consider pair of typical Rails models like this:
rails g model Author lastname:string firstnames:string
rails g model Book title:string isbn:string author:belongs_to
class Author < ApplicationRecord
has_many :books
def sortable_name
"#{lastname}, #{firstnames}"
end
end
class Book < ApplicationRecord
belongs_to :author
def label
[author.sortable_name, title, isbn].join("\n")
end
end
The various Ruby intellisense tools are ok at knowing that there are Book
and Author
constants, and some (including Solargraph) are aware that objects like Book.new
have a .label
method. But what about those "magical" dynamic methods that ActiveRecord creates like .title
, or .author
?
Since these attributes are only created at runtime, a simple static analysis of the Book
class alone can't identify them. Your editor has no idea that these attributes exist, but they're amongst the most common things that you will work with in any Rails app.
That's where this plugin for Solargraph comes in: it understands db/schema.rb and any comments from the annotate_models gem for models, and also supplies key annotations and Rails-specific context on top of what Solargraph pulls via YARD and RBS. As a result, you have access to database attributes:
... and ActiveRecord finders:
... and associations:
... and routes file syntax:
and more!
solargraph
and solargraph-rails
If you add them to your Gemfile, you'll have to tell your IDE plugin to use bundler to load the right version of solargraph.
Use gem_rbs_collection to install RBS types for Rails:
rbs collection init
rbs collection install
solargraph-rails
to your .solargraph.yml
(if you don't have a .solargraph.yml
in your project root, you can run solargraph config
to add one)
plugins:
- solargraph-rails
In the project root, run yard gems
.
Bug reports and pull requests are welcome on GitHub at https://github.com/iftheshoefritz/solargraph_rails.
create fork and clone the repo
install gem deps bundle install
install dummy rails app deps:
cd spec/rails7 && bundle install && rbs collection init && rbs collection install && cd ../../
cd spec/rails8 && bundle install && rbs collection init && rbs collection install && cd ../../
now tests should pass locally and you can try different changes
submit PR
See DEVELOPMENT.md for more information
The gem is available as open source under the terms of the MIT License.
FAQs
Unknown package
We found that solargraph-rails demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.
Security News
ESLint now supports parallel linting with a new --concurrency flag, delivering major speed gains and closing a 10-year-old feature request.
Research
/Security News
A malicious Go module posing as an SSH brute forcer exfiltrates stolen credentials to a Telegram bot controlled by a Russian-speaking threat actor.