Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
@hapi/subtext
Advanced tools
@hapi/subtext is a module for parsing request payloads in Hapi.js applications. It supports various content types including JSON, form data, and multipart data. It is designed to handle large payloads efficiently and provides a simple API for extracting and processing request data.
Parsing JSON Payloads
This code demonstrates how to use @hapi/subtext to parse JSON payloads from incoming HTTP requests. The `Subtext.parse` method is used to extract and parse the payload, which is then sent back in the response.
const Subtext = require('@hapi/subtext');
const Http = require('http');
const server = Http.createServer(async (req, res) => {
const { payload } = await Subtext.parse(req, null, { parse: true, output: 'data' });
res.end(`Received JSON: ${JSON.stringify(payload)}`);
});
server.listen(3000, () => {
console.log('Server running at http://localhost:3000/');
});
Parsing Form Data
This example shows how to parse form data using @hapi/subtext. The `Subtext.parse` method is used similarly to the JSON example, but it can handle form-encoded data as well.
const Subtext = require('@hapi/subtext');
const Http = require('http');
const server = Http.createServer(async (req, res) => {
const { payload } = await Subtext.parse(req, null, { parse: true, output: 'data' });
res.end(`Received Form Data: ${JSON.stringify(payload)}`);
});
server.listen(3000, () => {
console.log('Server running at http://localhost:3000/');
});
Handling Multipart Data
This code demonstrates how to handle multipart data using @hapi/subtext. The `Subtext.parse` method is configured to output a stream, which is suitable for handling large multipart payloads.
const Subtext = require('@hapi/subtext');
const Http = require('http');
const server = Http.createServer(async (req, res) => {
const { payload } = await Subtext.parse(req, null, { parse: true, output: 'stream' });
res.end('Received Multipart Data');
});
server.listen(3000, () => {
console.log('Server running at http://localhost:3000/');
});
body-parser is a popular middleware for parsing incoming request bodies in a middleware before your handlers, available under the `req.body` property. It supports JSON, raw buffer, text, and URL-encoded form data. Compared to @hapi/subtext, body-parser is more commonly used in Express.js applications and has a simpler API.
multer is a middleware for handling multipart/form-data, which is primarily used for uploading files. It is built on busboy and is highly configurable. While @hapi/subtext can handle multipart data, multer is specifically designed for file uploads and offers more features and flexibility in that area.
formidable is a Node.js module for parsing form data, especially file uploads. It is a low-level library that provides fine-grained control over file uploads and form parsing. Compared to @hapi/subtext, formidable offers more detailed control over the file upload process and is often used in applications that require custom handling of file uploads.
subtext is part of the hapi ecosystem and was designed to work seamlessly with the hapi web framework and its other components (but works great on its own or with other frameworks). If you are using a different web framework and find this module useful, check out hapi – they work even better together.
FAQs
HTTP payload parsing
We found that @hapi/subtext demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.