Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This extension aims to create a component to import data from other popular e-commerce solutions to Solidus.
Add solidus_importer to your Gemfile:
gem 'solidus_importer'
Bundle your dependencies and run the installation generator:
bundle
bundle exec rails g solidus_importer:install
The imports can be fully managed from the backend UI, following progress (image processing can take a few seconds for each image).
Sample code to import some products:
SolidusImporter.import! 'some_path/sample_products.csv', type: :products
The accepted format is the Shopify CSV for which is also relatively easy to find exporters for every major platform (e.g. shopify_transporter).
There are three supported CSV types:
The importing is managed by a list of processors for each CSV type, the default processors are:
customers: {
importer: SolidusImporter::BaseImporter,
processors: [
SolidusImporter::Processors::Address,
SolidusImporter::Processors::Customer,
SolidusImporter::Processors::Log
]
},
orders: {
importer: SolidusImporter::BaseImporter,
processors: [
SolidusImporter::Processors::Order,
SolidusImporter::Processors::Log
]
},
products: {
importer: SolidusImporter::BaseImporter,
processors: [
SolidusImporter::Processors::Product,
SolidusImporter::Processors::Variant,
SolidusImporter::Processors::OptionTypes,
SolidusImporter::Processors::OptionValues,
SolidusImporter::Processors::ProductImages,
SolidusImporter::Processors::VariantImages,
SolidusImporter::Processors::Log
]
}
Each processor is a callable that will accept a context Hash. It will perform its function within the #call(context)
method and will return an equally valid context Hash. The returned context can be augmented with additional data.
Example:
CUSTOM_LOGGER = Logger.new(Rails.root.join('log/importer.log'))
CustomLoggerProcessor = ->(context) {
context.merge(logger: CUSTOM_LOGGER)
}
# Replace the original Log processor with CustomLoggerProcessor
SolidusImporter::Config.solidus_importer[:customers][:processors].map! do |processor|
if processor == 'SolidusImporter::Processors::Log'
'CustomLoggerProcessor'
else
processor
end
end
Each list of processors can be configured to add, remove, or replace any of the default processors.
To define your own processors (in this example for products), add to the spree initializer:
SolidusImporter::Config[:solidus_importer] = {
products: {
importer: SolidusImporter::Importers::Products,
processors: [
SolidusImporter::Processors::Product,
SolidusImporter::Processors::Variant,
SolidusImporter::Processors::Log
]
}
}
The importer
class is responsible of the whole import process of a single
source file. The processors
classes are responsible of the import of a single
row of the source file; every processor has a call
method (with an input
context
) which makes a specific action and updates the context if needed.
First bundle your dependencies, then run bin/rake
. bin/rake
will default to building the dummy
app if it does not exist, then it will run specs. The dummy app can be regenerated by using
bin/rake extension:test_app
.
bin/setup
bin/rake
To run Rubocop static code analysis run
bundle exec rubocop
When testing your application's integration with this extension you may use its factories. Simply add this require statement to your spec_helper:
require 'solidus_importer/factories'
To run this extension in a sandboxed Solidus application, you can run bin/sandbox
. The path for
the sandbox app is ./sandbox
and bin/rails
will forward any Rails commands to
sandbox/bin/rails
.
Here's an example:
$ bin/rails server
=> Booting Puma
=> Rails 6.0.2.1 application starting in development
* Listening on tcp://127.0.0.1:3000
Use Ctrl-C to stop
Your new extension version can be released using gem-release
like this:
bundle exec gem bump -v VERSION --tag --push --remote upstream && gem release
Copyright (c) 2020 Nebulab SRLs, released under the New BSD License
FAQs
Unknown package
We found that solidus_importer demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.