Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
When validating XML using a XSD, we get error messages that are not very friendly, for example:
Element '{http://www.portalfiscal.inf.br/nfe}infNFe': The attribute 'Id' is required but missing.
What this gem does, is that it processes those errors and enable us to use the I18n gem to internationalize them. That way the client/customer can ask/see the error messages in any way they want.
Add this line to your application's Gemfile:
gem 'xml_errors_parser'
And then execute:
$ bundle
Or install it yourself as:
$ gem install xml_errors_parser
Imagine that in your application you are using nokogiri to validate the XML:
schema = Nokogiri::XML::Schema(xsd_string).xsd
errors = schema.validate(some_xml) # this will return the original errors
Now we can parse them like this:
pretty_errors = XmlErrorsParser::Parser.new(errors).errors
pretty_errors
will be an array of errors that can be sent to the flash or to any html page to be presented.
Not all errors are covered (there are many many possible errors). But the gem makes it pretty easy to add more cases. Please contribute if you do some :) If the Gem receives an error that it does not known, it will output a message with the error code and the original error message. We can use this information to add new errors.
To add more errors we do this:
Edit the /spec/xml_errors_parser/errors_regex_spec.rb and add a new test. Use the code of the error on the description. Then expect to find the tokens that the error provides. For example, the element name.
To make the test pass, edit the file lib/xml_errors_parser/errors_regex.rb
so that the error code matches a
regular expression. Use regular expressions that return tokens, using the ?<token_name>
. Try this until the test passes.
Create a new test here: spec/xml_errors_parser/error_message_builder_spec.rb
. These test makes sure that if the
tokens exist, the right message will be created. Just follow one of the examples.
To make the test pass just add the new error message in: /config/locales/en.yml
In the end always run bundle exec fudge build
to validate the build before doing a pull request. This will check
specs, code coverage, documentation and code style.
en:
xsd_errors:
'unkown': '[%{error_code}] %{error_msg}.'
'1840': 'The Element "%{element}" has the Value "%{value}" but it is not one from the Set: "%{set}".'
'1845': 'The Element "%{element}" has no matching global declaration available for the validation root.'
'1868': 'The Attribute "%{attribute}" of the Element "%{element}" is mandatory.'
git checkout -b my-new-feature
)bundle exec fudge build
to see if the build passesgit commit -am 'Add some feature'
)git push origin my-new-feature
)FAQs
Unknown package
We found that xml_errors_parser demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.