Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/kinbiko/jsonassert
It's difficult to confirm that a JSON payload, e.g. a HTTP request or response body, does indeed look the way you want using the built-in Go testing package.
jsonassert
is an easy-to-use Go test assertion library for verifying that two representations of JSON are semantically equal.
Create a new *jsonassert.Asserter
in your test and use this to make assertions against your JSON payloads:
func TestWhatever(t *testing.T) {
ja := jsonassert.New(t)
// find some sort of payload
name := "River Tam"
age := 16
ja.Assertf(payload, `
{
"name": "%s",
"age": %d,
"averageTestScore": "%s",
"skills": [
{ "name": "martial arts", "level": 99 },
{ "name": "intelligence", "level": 100 },
{ "name": "mental fortitude", "level": 4 }
]
}`, name, age, "99%")
}
You may pass in fmt.Sprintf
arguments after the expected JSON structure.
This feature may be useful for the case when you already have variables in your test with the expected data or when your expected JSON contains a %
character which could be misinterpreted as a format directive.
ja.Assertf()
supports assertions against strings only.
Some properties of a JSON payload may be difficult to know in advance. E.g. timestamps, UUIDs, or other randomly assigned values.
For these types of values, place the string "<<PRESENCE>>"
as the expected value, and jsonassert
will only verify that this key exists (i.e. the actual JSON has the expected key, and its value is not null
), but this does not check its value.
For example:
func TestWhatever(t *testing.T) {
ja := jsonassert.New(t)
ja.Assertf(`
{
"time": "2019-01-28T21:19:42",
"uuid": "94ae1a31-63b2-4a55-a478-47764b60c56b"
}`, `
{
"time": "<<PRESENCE>>",
"uuid": "<<PRESENCE>>"
}`)
}
The above will pass your test, but:
func TestWhatever(t *testing.T) {
ja := jsonassert.New(t)
ja.Assertf(`
{
"date": "2019-01-28T21:19:42",
"uuid": null
}`, `
{
"time": "<<PRESENCE>>",
"uuid": "<<PRESENCE>>"
}`)
}
The above will fail your tests because the time
key was not present in the actual JSON, and the uuid
was null
.
If your JSON payload contains an array with elements whose ordering is not deterministic, then you can use the "<<UNORDERED>>"
directive as the first element of the array in question:
func TestUnorderedArray(t *testing.T) {
ja := jsonassert.New(t)
payload := `["bar", "foo", "baz"]`
ja.Assertf(payload, `["foo", "bar", "baz"]`) // Order matters, will fail your test.
ja.Assertf(payload, `["<<UNORDERED>>", "foo", "bar", "baz"]`) // Order agnostic, will pass your test.
}
You can find the GoDocs for this package here.
Contributions are welcome. Please read the contribution guidelines and discuss feature requests in an issue before opening a PR.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.