Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@funboxteam/crafter
Advanced tools
JavaScript replacement of Drafter library for parsing API Blueprint documentation format
Crafter is an API Blueprint parser written in pure JavaScript. It is a replacement for Drafter library with some handy features added.
Drafter is written in C++, so the code is pretty complicated and obscure while containing a lot of bugs and legacy. It is hard to understand how some of its parts work. And if bug fixes are welcomed by maintainers, adding a new feature could become an obstacle.
Our company has a tiny percent of C++ projects, so almost none of the developers can maintain Drafter.
That is why we decided to create own JavaScript replacement which eliminates all previously described limitations, is easy to maintain, and allows us to add all needed features.
Compared to Drafter, this library can offer some important features:
Additional information about how the library works is placed in the docs directory.
Global install:
npm install -g @funboxteam/crafter
Local install:
npm install --save @funboxteam/crafter
Parse a file:
const crafter = require('@funboxteam/crafter');
const apibFile = 'doc.apib';
const ast = (await crafter.parseFile(apibFile))[0].toRefract();
Or provide a string variable containing APIB documentation:
const crafter = require('@funboxteam/crafter');
const source = '# My API\n\n## List users [GET /users]\n\n+ Response 200';
const ast = (await crafter.parse(source))[0].toRefract();
To parse a file named doc.apib
run the next command:
crafter [options] doc.apib
-f, --format <format>
— set output format of the parse result. Available formats: json
, yaml
. Default is yaml
.-s, --sourcemap
— export source maps in the parse result.-d, --debug
— enable debugging mode, which disables catching some of the exceptions.-l, --langserver
— enable tolerant mode, which is used in language server.-h, --help
— output usage information.npm test
To run @funboxteam/crafter as a Docker container execute the next command in the directory with documentation:
docker run \
--rm \
-v $(pwd):/app \
funbox/crafter -f json doc-file.apib
The default working directory of the image is set to /app
, therefore it is easier to mount
a host directory into the /app
. Then just a filename as a parameter will do.
To run a container in Windows, add a slash (/
) before pwd
.
The command will look like this:
docker run \
--rm \
-v /$(pwd):/app/doc \
funbox/crafter -f json doc/doc-file.apib
There is a chance that the mounted directory is empty. In this case, check that your hard drive is marked as shared.
This setting can be found in the settings of Docker Desktop for Windows, Shared Drives section.
If the disk is not shared, mark it as shared
, apply changes, and restart Docker Desktop.
We use JSON API widely in the company, so each day our developers face such issues as describing and approving API documentation, tracking changes, distributing documentation among partners, and so on. That is why we felt a strong need for convenient tools to work with documentation.
Historically, the battle was between API Blueprint and Swagger.
We chose API Blueprint for two reasons. Firstly, the source code of documentation that is described using API Blueprint is more readable to humans.
Secondly, at the time of research conducted, Swagger lacked several important features, as One Of
support.
Awesome logo for the project was made by Igor Garybaldi.
6.0.2 (29.06.2023)
Replaced the package that prints the result as YAML.
FAQs
JavaScript replacement of Drafter library for parsing API Blueprint documentation format
The npm package @funboxteam/crafter receives a total of 261 weekly downloads. As such, @funboxteam/crafter popularity was classified as not popular.
We found that @funboxteam/crafter demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.