
Security News
Follow-up and Clarification on Recent Malicious Ruby Gems Campaign
A clarification on our recent research investigating 60 malicious Ruby gems.
The purpose of this gem is to make the oauth gem play nice with Google's custom 2 legged OAuth (2LO), used specifically for Google Apps APIs accessed from Google Apps Marketplace applications.
For more info on the 2 legged OAuth see these :
This gem has been tested with the following libraries so far and seems to be working ok :
Add on your Gemfile :
gem 'two-legged-oauth'
On the console :
gem install two-legged-oauth
On your code :
require 'two-legged-oauth'
# Create a normal consumer instance
oauth_consumer = OAuth::Consumer.new("key", "secret")
# Initialize a TwoLeggedAccessToken specifying the xoauth_requestor_id
access_token = OAuth::TwoLeggedAccessToken.new(oauth_consumer, "user@domain.com")
# Pass that access token to Google Data libraries (or your custom scripts)
gs = GoogleSpreadsheet.login_with_oauth(access_token)
This thing works by rewriting the requested URL on-the-fly and appends the xoauth_requestor_id param appropriately. This may be dangerous at times so be aware that some well hidden bugs may come up...
Report any issues on the github's issue tracker or send a pull request if you have nailed the bug.
Tested contributions are always welcome! Here's what you should do:
two-legged-oauth is copyright 2011 by Fraudpointer, released under the MIT License (see LICENSE for details).
FAQs
Unknown package
We found that two-legged-oauth demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.
Security News
ESLint now supports parallel linting with a new --concurrency flag, delivering major speed gains and closing a 10-year-old feature request.
Research
/Security News
A malicious Go module posing as an SSH brute forcer exfiltrates stolen credentials to a Telegram bot controlled by a Russian-speaking threat actor.