Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
require 'uuid-ncname'
require 'uuidtools'
uu = UUIDTools::UUID.random_create
# => #<UUID:0x3fff0e597ef8 UUID:df521e0a-9d57-4f04-9a95-fc2888decc5a>
nc64 = UUID::NCName.to_ncname uu
# => "E31IeCp1X8EqV_CiI3sxaJ"
nc32 = UUID::NCName.to_ncname_32 uu
# => "E35jb4cu5k7yevfp4fcen5tc2j"
orig = UUID::NCName.from_ncname nc64
# => "df521e0a-9d57-4f04-9a95-fc2888decc5a"
orig == UUID::NCName.from_ncname nc32 # => true
orig == uu.to_s # => true
# then you can turn it back into an object or whatever
uu == UUIDTools::UUID.parse(orig) # => true
The purpose of this module is to devise an alternative representation of the UUID which conforms to the constraints of various other identifiers such as NCName, and create an isomorphic mapping between them.
The UUID is a generic identifier which is large enough to be globally unique. This makes it useful as a canonical name for data objects in distributed systems, especially those that cross administrative jurisdictions, such as the World-Wide Web. The representation, however, of the UUID, precludes it from being used in many places where it would be useful to do so.
In particular, there are grammars for many types of identifiers which
must not begin with a digit. Others are case-insensitive, or
prohibited from containing hyphens (present in both the standard
notation and Base64URL), or indeed anything outside of
^[A-Za-z_][0-9A-Za-z_]*$
.
The hexadecimal notation of the UUID has a 5/8 chance of beginning
with a digit, Base64 has a 5/32 chance, and Base32 has a 3/16
chance. As such, the identifier must be modified in such a way as to
guarantee beginning with an alphabetic letter (or underscore _
, but
some grammars even prohibit that, so we omit it as well).
While it is conceivable to simply add a padding character, there are a few considerations which make it more appealing to derive the initial character from the content of the UUID itself:
UUIDs are large (128-bit) identifiers as it is, and it is undesirable to add meaningless syntax to them if we can avoid doing so.
128 bits is an inconvenient number for aligning to both Base32 (130) and Base64 (132), though 120 divides cleanly into 5, 6 and 8.
The 13th quartet, or higher four bits of the
time_hi_and_version_field
of the UUID is constant, as it indicates
the UUID's version. If we encode this value using the scheme common
to both Base64 and Base32, we get values between A
and P
, with
the valid subset between B
and F
.
Therefore: extract the UUID's version quartet, shift all subsequent data 4 bits to the left, zero-pad to the octet, encode with either base64url or base32, truncate, and finally prepend the encoded version character. Voilà, one token-safe UUID.
The ID
production appears to have been constricted, inadvertently or
otherwise, from Name in both
the XML 1.0 and 1.1 specifications,
to NCName
by XML Schema Part 2. This
removes the colon character :
from the grammar. The net effect is
that
<foo id="urn:uuid:b07caf81-baae-449d-8a2e-48c0f5fa5538"/>
while being a well-formed ID and valid under DTD validation, is not valid per XML Schema Part 2 or anything that uses it (e.g. Relax NG).
Blank node identifiers in RDF are intended for serialization, to act as a handle so that multiple RDF statements can refer to the same blank node. The RDF abstract syntax specifies that the validity constraints of blank node identifiers be delegated to the concrete syntax specifications. The RDF/XML syntax specification lists the blank node identifier as NCName. However, according to the Turtle spec, this is a valid blank node identifier:
_:42df00ec-30a2-431f-be9e-e3a612b325db
despite
an older version
listing a production equivalent to the more conservative
NCName. NTriples syntax is
even more constrained,
given as ^[A-Za-z][0-9A-Za-z]*$
.
There are only two hard things in computer science: cache invalidation and naming things [and off-by-one errors].
-- Phil Karlton [extension of unknown origin]
Suppose you wanted to create a literate programming system (I do). One of your (my) stipulations is that the symbols get defined in the prose, rather than the code. However, you (I) still want to be able to validate the code's syntax, and potentially even run the code, without having to commit to naming anything. You are (I am) also interested in creating a global map of classes, datatypes and code fragments, which can be operated on and tested in isolation, ported to other languages, or transplanted into the more conventional packages of programs, libraries and frameworks. The Base32 UUID NCName representation should be adequate for placeholder symbols in just about any programming language, save for those which do not permit identifiers as long as 26 characters (which are extremely scarce).
After careful consideration, I have decided to change the UUID-NCName
format in a minor yet incompatible way. In particular, I have moved
the nybble containing
the variant
to
the very end of the identifier, whereas it previously was mixed into
the middle somewhere.
This can be considered an application
of Postel's Law, based
on the assumption that these identifiers will be generated through
other methods, and potentially naïvely. Like the version
field, the
variant
field has a limited acceptable range of values. If, for
example, one were to attempt to generate a conforming identifier by
simply generating a random Base32 or Base64 string, it will be
difficult to ensure that the variant
field will indeed conform when
the identifier is converted to a standard UUID. By moving the
variant
field out to the end of the identifier, everything between
the version
and variant
bookends can be generated randomly without
any further consideration, like so:
B64_ALPHA = ('A'..'Z').to_a + ('a'..'z').to_a + ('0'..'9').to_a + %w(- _)
def make_cheapo_b64_uuid_ncname
vals = (1..20).map { rand 64 } # generate the content
vals.push(rand(4) + 8) # last digit is special
'E' + vals.map { |v| B64_ALPHA[v] }.join('') # 'E' for UUID v4
end
# voilà:
cheap = make_cheapo_b64_uuid_ncname
# => "EXSVv8ezPbSKWoKOkBNWKL"
# now try changing it to a standard UUID:
UUID::NCName.from_ncname cheap, version: 1
# => "5d256ff1-eccf-46d2-b296-a0a3a404d58a"
Furthermore, since the default behaviour is to align the bits of the
last byte to the size of the encoding symbol, and since the variant
bits are masked, a compliant RFC4122 UUID will always end with I
,
J
, K
, or L
, in both Base32 (case-insensitive) and Base64
variants.
Since I have already released this gem prior to this format change, I
have added a :version
parameter to both to_ncname
and
from_ncname
. This parameter, which controls the compact UUID spec
behaviour, defaults to 1
, as of the module version 0.2.4.
Unless you have to support identifiers generated from version 0.1.3 or older, you should be running these methods with
version: 1
.
Generated and deposited in the usual place.
You know how to do this:
$ gem install uuid-ncname
Or, download it off rubygems.org.
Bug reports and pull requests are welcome at the GitHub repository.
©2018 Dorian Taylor
This software is provided under the Apache License, 2.0.
FAQs
Unknown package
We found that uuid-ncname demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.