Python typosquatting is about more than typos

Re:Python typosquatting is about more than typos by TheDong on Friday October 02, 2020 @04:05PM (#24666533)

Sure, the go way:

    import (
     "fmt"
     "github.com/dimuska139/go-email-normalizer"
    )
    
    func main() {
     fmt.Println(emailnormalizer.NewNormalizer().Normalize("[email protected]"))
    }

Wait, how did I know to do "emailnormalizer.NewNormalizer()"? Well, that's the package name of the package at that url.

The package name is only the same as the last part of the URL in go by convention, and importing a package can put an arbitrary package identifier into your package scope.

[ Parent | on HN ]

Re:Python typosquatting is about more than typos by LukeShu on Friday October 02, 2020 @04:09PM (#24666560)

FWIW, `goimports` would say "OK, technically that's valid, but I'm going to complain unless you explicitly import it as 'emailnormalizer'".

    import (
            "fmt"

            emailnormalizer "github.com/dimuska139/go-email-normalizer"
    )

[ Parent | on HN ]

Re:Python typosquatting is about more than typos by earthboundkid on Friday October 02, 2020 @11:30PM (#24669285)

See https://github.com/golang/go/issues/29036 which is still open.

[ Parent | on HN ]

Re:Python typosquatting is about more than typos by watt on Saturday October 03, 2020 @04:58AM (#24670625)

and what happened to the "go-" prefix? is it silently dropped?

[ Parent | on HN ]

Re:Python typosquatting is about more than typos by sheenobu on Saturday October 03, 2020 @07:03AM (#24671173)

No. The go files just have "package emailnormalizer" within the go files, so that is the name that you use to reference it, even if the import url is different.

[ Parent | on HN ]