
Research
/Security News
60 Malicious Ruby Gems Used in Targeted Credential Theft Campaign
A RubyGems malware campaign used 60 malicious packages posing as automation tools to steal credentials from social media and marketing tool users.
@codefeathers/runtype
Advanced tools
Runtime type assertions that return.
runtype
was created to serve as the runtime type assertion library for @codefeathers/poly
. And as such, it makes a best effort to always return boolean, rather than silently pass and loudly throw. As a bonus, every[1] predicate is also a TypeScript type-guard.
Any throwing behaviour definitely qualifies as a bug. The absense of a type-guard, or the misbehaviour of one also qualifies as a serious bug. Make issues or PRs regarding them.
Installation:
npm i runtype
Usage:
import r from "@codefeathers/runtype";
const { string, number, Struct } = r;
const numbers = r.Array(number);
if (string(x)) {
// x is a string
}
if (Struct({ a: string, b: numbers })(x)) {
// x is { a: string, b: number[] }
}
runtype
follows the data-last style. Higher order predicates always return a function that takes the input element. This makes it easier to create composed functions ahead of time while not waiting for data. Example:
import r from "@codefeathers/runtype";
// Array is a Higher Order Predicate (it takes a predicate as input):
const numbers = r.Array(r.number);
// which is infinitely cleaner than:
const numbers = x => r.Array(x, x => r.number(x));
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.
You can write your own custom predicates.
To be compatible with runtype
, you MUST follow the one of the following signatures:
// Simple Predicate:
const SimplePredicate = (x: any): x is Type = {
/* runtime validation for x that returns true/false */
};
// Higher Order Predicate:
const HOPredicate = (ctx: any) => (x: any): x is Type = {
/* runtime validation for x that returns true/false */
};
Higher Order Predicates MAY accept one or more Simple Predicates and MUST return a Simple Predicate. A Simple Predicate MUST always guard a type.
This library has taken care to meticulously type anything at all possible, but TypeScript (as of writing, v3.8.x) has limitations. We address these with adhoc solutions and TypeScript's escape hatches. While contributing to this repository, you should only resort to this as the last stand, if nothing else works. If a type is not guardable, also consider whether it is essential to runtype
.
Known limitations:
const notString = r.not(r.string);
// Must have been NOT string, but the absense of negated types leaves us at `any`
const p = r.product([r.string, r.number, r.bool]);
// This correctly guards the tuple [string, number, boolean]
// However, because TypeScript has no support for variadic kinds,
// We've limited the number of members for the product type as 1 to 15
In the past, with some effort and sleepless nights, we've overcome seemingly serious limitations like the variadic r.or
and r.and
types. In the future, it may be possible to type both r.not
and r.product
correctly.
Thanks to @TRGWII for helping focus my ideas and trick TypeScript into doing the right things late at night at the cost of our sanities.
FAQs
Runtime type assertions that return
The npm package @codefeathers/runtype receives a total of 0 weekly downloads. As such, @codefeathers/runtype popularity was classified as not popular.
We found that @codefeathers/runtype demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A RubyGems malware campaign used 60 malicious packages posing as automation tools to steal credentials from social media and marketing tool users.
Security News
The CNA Scorecard ranks CVE issuers by data completeness, revealing major gaps in patch info and software identifiers across thousands of vulnerabilities.
Research
/Security News
Two npm packages masquerading as WhatsApp developer libraries include a kill switch that deletes all files if the phone number isn’t whitelisted.