
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@developpement/xml2js
Advanced tools
See the test/test.js for exhaustive samples.
const xml_build = require('@developpement/xml2js').build;
//const xml_build = require('./lib/xml2js').build;
await xml_build({ ... }, '<some><xml/></some>');
type, path, end, empty and _d_... for debugging).string, array, object, int, float, boolean, callback, raw (default string).
Add an extra ? to make it nullable (if not found, return null).
Add an extra [] to make it an array of this type.text, attr@name (default text).true, false (default false). Raise an error if false and the array empty.build({
type: "string",
path: "//item",
end: "attr@id"
}, xml)
// It might be written
build("//a/b|attr@id", xml)
build({
type: "string?",
path: "//a/maybesomething",
end: "attr@id"
}, xml) // => "...id..." or null
build({
type: "string",
path: "//item",
end: "text"
}, xml) // => "... text ..."
build({
type: "array",
path: "//items/item",
end: {
type: "string",
end: "attr@id"
}
}, xml) // => ['...']
You can also refuse empty array with empty: false.
build({
type: "array",
empty: false,
path: "//items/not-item",
end: {
type: "string",
end: "attr@id"
}
}, xml) // => Error thrown !
build({
type: "object",
path: "//item",
end: {
b: {
type: "string",
end: "text"
}
}
}, xml) // => {b: "..."}
build({
type: "object",
end: {
int: {
type: "int",
path: "//int",
end: "text"
},
float: {
type: "float",
path: "//float",
end: "text"
},
bool: {
type: "boolean",
path: "//bool",
end: "text"
}
}
}, xml) // => {int: 1, float: 1.1, bool: true}
build({
type: "object",
end: {
or: {
type: "or",
end: [{
type: "string",
end: "text",
path: "/a/notdefined"
},
{
type: "string",
end: "text",
path: "/a/defined"
}
]
}
}
}, xml)
Note: you can use the key empty: false on array to refuse empty ones.
This type of leaf allows you to build a complex/custom value.
function callback(json, context) {
return context.text() + " => custom stuff"
}
build({
type: "callback",
path: "/a/defined",
end: callback
}, xml) // => "... => custom stuff"
It fully allows async functions.
In the callback, there are 2 parameters:
Most of the time, we only use the context to get the context.text() or context.attr("AttributeName").value() and then change this value.
Sample:
<Price Decimals="2" Value="1250" />
function callback(json, context) {
const divider = 10**Number(context.attr("Decimals").value()); // (2 = 100)
const value = Number(context.attr("Value")) / divider;
return value;
}
build({
type: "callback",
path: "/Price",
end: callback
}, xml) // => 12.50
This type of leaf allows you to build a complex/custom value.
build({
type: "raw",
path: "/a/raw",
}, xml) // => <raw>...</raw>
There is syntactic sugar for arrays: string[] will be treated as an array of strings.
build({
type: "object[]",
path: "X",
end: {
str: {
type: "string",
path: "X/Y",
end: "text"
}
}
}, xml)
build((json, context) => context.get('stuff').text() + context.get('things').text(), xml)
// => [{str:"..."}, {str:"..."}]
Note that it is not possible to make a multi dimensional array with this shortcut.
Each of the three values type, path and end have default values. Here they are:
{
type: "string",
path: "",
end: "text"
}
If a string is provided instead of an object, it will be understood as the path of the element. That means that {a: 'X'} is equivalent to the following:
{
a: {
type: "string",
path: "X",
end: "text"
}
}
A side effect of those default values is that the type [] means string[].
build({
type: "object",
path: "root"
end: {
uuid: { type: "string", path: "uuid", end: "text" },
data: {
type: "array",
path: "dataList/data",
end: {
type: "object",
end: {
time: { type: "int", end: "attr@timestamp" },
duration: { type: "float", end: "attr@duration" },
output: { type: "string", end: "text", path: "stdout" },
success: { type: "boolean", end: "attr@success" },
orTest: {
type: "or",
end: [
{type: "string", end: "text", path: "maybeDefined1"},
{type: "string", end: "text", path: "maybeDefined2"},
{type: "string", end: "text", path: "maybeDefined3"}
]
}
}
}
}
}
}, xmlDocument)
If you use namespace, you have to send them as 3rd argument to build().
build({...}, { 'namespace': 'http://url.to/namespace/declaration' });
If you search to parse a xml with a xmlns=... declaration, you may need to write a weird XPath insead of the usual way:
xml2js.build('//elemName', xml)
replaced by
xml2js.build("//*[local-name()='elemName']", xml)
FAQs
Create a JSON by injecting data from a XML file
We found that @developpement/xml2js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.