
Security News
Follow-up and Clarification on Recent Malicious Ruby Gems Campaign
A clarification on our recent research investigating 60 malicious Ruby gems.
The dev tools available to web developers in modern browsers are great. Many of us can't remember what life was like before "Inspect Element". But what we see in the compiled output sent to our browser is often the wrong level of detail - what about visualizing the higher level components of your UI? Controllers, view templates, partials, JS templates, etc.
Xray is the missing link between the browser and your app code. Press command+shift+x (Mac) or ctrl+shift+x to reveal an overlay of the files that rendered your UI, and click anything to open the file in your editor.
Xray is intended for Rails 3.1+ and Ruby 1.9+.
So far, Xray can reveal:
Xray depends on jQuery.
This gem should only be present during development. Add it to your Gemfile:
group :development do
gem 'xray-rails'
end
Then bundle and delete your cached assets:
$ bundle && rm -rf tmp/cache/assets
Restart your app, visit it in your browser, and press command+shift+x (Mac) or ctrl+shift+x to reveal the overlay.
config.assets.debug
By default, Xray will insert itself into your views automatically. To do this, config.assets.debug = true
(Rails' default) must be set in development.rb.
Otherwise, you can insert Xray's scripts yourself, for example like so in application.js:
//= require jquery
//= require xray
By default, Xray will check a few environment variables to determine
which editor to open files in: $GEM_EDITOR
, $VISUAL
, then
$EDITOR
before falling back to /usr/local/bin/subl
.
You can configure your editor of choice either by setting one of these
variables, or in Xray's UI, or in an ~/.xrayconfig
YAML file:
:editor: '/usr/local/bin/mate'
For something more complex, use the $file
placeholder.
:editor: "/usr/local/bin/tmux new-window 'vim $file'"
xray.js
, xray.css
, and the Xray bar into all successful HTML response bodies.xray.js
examines the inserted filepath info to build the overlay.Xray augments HTML templates by wrapping their contents with HTML comments. For some environments such as Angular.js, this can cause Angular templates to stop working because Angular expects only one root node in the template HTML. You can pass in the option xray: false
to any partial render statements to ensure Xray does not augment that partial. Example:
render partial: 'my_partial', locals: { xray: false }
Note that this disables Xray's HTML comment wrappers for my_partial
, but not any sub-partials rendered within that template, if any. You must pass xray: false
to each render
call where you want Xray disabled.
Currently there is no way to disable Xray entirely for a given request. If this feature is important to you, please leave a comment on issue #75. PRs are appreciated!
If you have an idea, open an issue and let's talk about it, or fork away and send a pull request.
A laundry list of things to take on:
Worth noting is that I have plans to solidify xray.js into an API and specification that could be used to aid development in any framework - not just Rails and the asset pipeline.
FAQs
Unknown package
We found that xray-rails demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.
Security News
ESLint now supports parallel linting with a new --concurrency flag, delivering major speed gains and closing a 10-year-old feature request.
Research
/Security News
A malicious Go module posing as an SSH brute forcer exfiltrates stolen credentials to a Telegram bot controlled by a Russian-speaking threat actor.