@hapi/bourne

What is @hapi/bourne?

@hapi/bourne is a JSON parser that is designed to be secure by preventing prototype pollution attacks. It is a part of the hapi ecosystem and focuses on safely parsing JSON strings.

What are @hapi/bourne's main functionalities?

Safe JSON Parsing

This feature allows you to safely parse JSON strings into JavaScript objects, ensuring that the parsed object does not contain any prototype pollution.

const Bourne = require('@hapi/bourne');
const jsonString = '{"key":"value"}';
const parsedObject = Bourne.parse(jsonString);
console.log(parsedObject); // { key: 'value' }

Handling Malicious JSON

This feature demonstrates how @hapi/bourne handles potentially malicious JSON strings that attempt to pollute the prototype. The parser ensures that such attempts are neutralized.

const Bourne = require('@hapi/bourne');
const maliciousJsonString = '{"__proto__":{"polluted":"yes"}}';
const parsedObject = Bourne.parse(maliciousJsonString);
console.log(parsedObject.polluted); // undefined

Other packages similar to @hapi/bourne

json5

JSON5 is a JSON parser that allows for more human-friendly JSON. It supports comments, trailing commas, and more. Unlike @hapi/bourne, JSON5 focuses on extending the JSON syntax rather than security.

secure-json-parse

secure-json-parse is another package that focuses on safely parsing JSON strings to prevent prototype pollution attacks. It is similar to @hapi/bourne in its security focus but offers additional features like revivers and custom error handling.

fast-json-parse

fast-json-parse is a high-performance JSON parser that aims to be faster than the native JSON.parse method. While it does not focus on security like @hapi/bourne, it is useful for performance-critical applications.

README

@hapi/bourne

JSON.parse() drop-in replacement with prototype poisoning protection.

bourne is part of the hapi ecosystem and was designed to work seamlessly with the hapi web framework and its other components (but works great on its own or with other frameworks). If you are using a different web framework and find this module useful, check out hapi – they work even better together.

Visit the hapi.dev Developer Portal for tutorials, documentation, and support

Useful resources

• Documentation and API
• Version status (builds, dependencies, node versions, licenses, eol)
• Changelog
• Project policies
• Free and commercial support options