
Security News
Follow-up and Clarification on Recent Malicious Ruby Gems Campaign
A clarification on our recent research investigating 60 malicious Ruby gems.
Very experimental GraphQL parser. It's mostly reusing the lexer from GraphQL-Ruby, but the parser is a hand-written recursive descent parser.
I want to target this at server side applications, so the parser eliminates some nice stuff for humans (namely line / column information, and it throws away comments).
Right now this code:
You can get an AST like this:
ast = TinyGQL.parse "{ cool }"
The AST is iterable, so you can use the each method:
ast = TinyGQL.parse "{ cool }"
ast.each do |node|
p node.class
end
Nodes have predicate methods, so if you want to find particular nodes just use a predicate:
ast = TinyGQL.parse "{ cool }"
p ast.find_all(&:field?).map(&:name) # => ["cool"]
If you need a more advanced way to iterate nodes, you can use a visitor:
class Viz
include TinyGQL::Visitors::Visitor
def handle_field obj
p obj.name # => cool
super
end
end
ast = TinyGQL.parse "{ cool }"
ast.accept(Viz.new)
If you would like a functional way to collect data from the tree, use the Fold
module:
module Fold
extend TinyGQL::Visitors::Fold
def self.handle_field obj, seed
super(obj, seed + [obj.name])
end
end
ast = TinyGQL.parse "{ neat { cool } }"
p ast.fold(Fold, []) # => ["neat", "cool"]
Nodes store their position in the source GraphQL document.
If you'd like to extract the line number of the node, you'll need to keep a reference to the document and pass it to the line
method on the node:
doc = <<-eod
mutation {
likeStory(sturyID: 12345) {
story {
likeCount
}
}
}
eod
parser = TinyGQL::Parser.new doc
ast = parser.parse
ast.find_all(&:field?).each { |node|
p node.name => node.line(doc)
}
I've licensed this code as Apache 2.0, but the lexer is from GraphQL-Ruby and is under the MIT license.
FAQs
Unknown package
We found that tinygql demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.
Security News
ESLint now supports parallel linting with a new --concurrency flag, delivering major speed gains and closing a 10-year-old feature request.
Research
/Security News
A malicious Go module posing as an SSH brute forcer exfiltrates stolen credentials to a Telegram bot controlled by a Russian-speaking threat actor.