Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Add this line to your application's Gemfile:
gem 'zuora_apiD'
Then execute bundle install
in your terminal
In order to make API calls a Zuora Login object must be created
zuora_client = ZuoraAPI::Login.new(username: "username", password: "password", url: "url")
Name | Type | Description | Example |
---|---|---|---|
username | Attribute | Username to the Zuora environment | zuora_client.username = "username" |
password | Attribute | password to the Zuora environment | zuora_client.password = "Password" |
url | Attribute | Endpoint to the Zuora tenant | zuora_client.url = "www.zuora.com" |
wsdl_number | Attribute | WSDL number of the zuora login | wsdl = zuora_client.wsdl_number |
status | Attribute | Status of the login | zuora_client.status |
current_session | Attribute | Current session for the login | zuora_client.current_session |
environment | Attribute | environment of the login | zuora_client.environment |
errors | Attribute | Any errors that the login has based on the login call | zuora_client.errors |
current_error | Attribute | Current error from the new_session call | zuora_client.current_error |
user_info | Attribute | Information related to the login | zuora_client.user_info |
tenant_id | Attribute | Tenant ID the login is associated to | zuora_client.tenant_id |
tenant_name | Attribute | Tenant Name of tenant the login is associated to | zuora_client.tenant_name |
entity_id | Attribute | Current entity the login session is associated to | zuora_client.entity_id |
rest_call | Method | Executes a REST call | zuora_client.rest_call() |
soap_call | Method | Executes a SOAP call | output_xml, input_xml = zuora_client.soap_call() do |xml, args| xml['ns1'].query do xml['ns1'].queryString "select id, name from account" end end |
query | Method | Executes a query call | zuora_client.query("select id, name from account") |
getDataSourceExport | Method | Pulls a data source export with the given query and returns the file location | zuora_client.getDataSourceExport("select id, name from account") |
describe_call | Method | Performs the describe call against the Zuora tenant for all objects or a specific object | response = zuora_client.describe_call("Account") |
createJournalRun | Method | Creates a Journal Run | zuora_client.createJournalRun(call) |
checkJRStatus | Method | Checks the status of a journal run | zuora_client.checkJRStatus(journal_run_id) |
update_environment | Method | Sets the login's environment based on the url | zuora_client.update_environment |
aqua_endpoint | Method | Returns the AQuA endpoint for the login based off the environment | zuora_client.aqua_endpoint |
rest_endpoint | Method | Returns the REST endpoint for the login based off the environment | zuora_client.rest_endpoint |
fileURL | Method | Returns the URL for files | zuora_client.fileURL |
dateFormat | Method | Returns the data format syntax based on the wsdl_number | zuora_client.dateFormat |
new_session | Method | Create a new session | zuora_client.new_session |
get_session | Method | Returns the current session | zuora_client.get_session |
zuora_client.rest_call(method: :get, body: {}, url: zuora_client.rest_endpoint("catalog/products?pageSize=4"))
Returns both output and input XML
zuora_client.soap_call(ns1: 'ns1', ns2: 'ns2', batch_size: nil, single_transaction: false)
Example Call
output_xml, input_xml = zuora_client.soap_call() do |xml, args|
xml['ns1'].query do
xml['ns1'].queryString "select id, name from account"
end
end
zuora_client.query("select id from account")
Returns the file location of the data source export after downloading from Zuora
zuora_client.getDataSourceExport("select id from account")
Name | Description | Default | Example |
---|---|---|---|
query | The query to execute | N/A | zuora_client.getDataSourceExport("select id from account") |
zip | Indicates if the data source export should be a zip | true | zuora_client.getDataSourceExport("select id from account", zip: false) |
extract | Indicates if the data source export should be extracted if it is a zip | true | zuora_client.getDataSourceExport("select id from account", extract: false) |
encrypted | Indicates if the data source export should be encrypted | false | zuora_client.getDataSourceExport("select id from account", encrypted: true) |
This returns all available objects from the describe call as a hash. This response can be accessed by using response["Account"] to retrieve all related data about that object.
response = zuora_client.describe_call("Account")
This returns all information and fields related to that object model as a hash.
response = zuora_client.describe_call()
zuora_client.createJournalRun(call)
In order to make API calls a Zuora Login object must be created by running:
insightsapi = InsightsAPI::Login.new(api_token: "api token", url: "Nw1.api.insights.zuora.com/api/")
Note that the login will default to the insights production url.
Date format: "YYYY-MM-DDT00:00:00Z"
insightsapi.upload_into_insights(dataSourceName, recordType, batchDate, filePath)
dataSourceName: What system the data is coming from. recordType: The type of records ie: "EVENTS, ATTRIBUTES, and METRICS" batachDate: The date the data applies to.
insightsapi.describe(type: "ACCOUNT/USER", object: "ATTRIBUTES/EVENTS/SEGMENTS/METRICS")
Returns json payload describing attributes, events, metrics for each Account or User.
insightsapi.data_export_insights(objecttype, segmentuuid, startDate: nil, endDate: nil, tries: 30)
insightsapi.data_export_insights_file(objecttype, segmentuuid, startDate: nil, endDate: nil, tries: 30)
Both do the same thing except one returns a url(data_export_insights) to download the file yourself and the other returns an actual Ruby temporary file(data_export_insights_file).
objectype: "ACCOUNT/USER"
segmentuuid: A single or array of string or int of a segment uuid(s) that you get from the describe call. The csv holds a column with a bool that represents if that User or Account belongs to that segment.
FAQs
Unknown package
We found that zuora_apiD demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.