Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@sagold/json-pointer
Advanced tools
json pointer - failsafe data retrieval from js and json objects
@sagold/json-pointer is a lightweight library for handling JSON Pointers as defined in RFC 6901. It allows you to easily get, set, and delete values within a JSON document using a string syntax.
Get Value
This feature allows you to retrieve a value from a JSON document using a JSON Pointer string.
const jsonPointer = require('@sagold/json-pointer');
const document = { foo: { bar: 'baz' } };
const value = jsonPointer.get(document, '/foo/bar');
console.log(value); // Output: 'baz'
Set Value
This feature allows you to set a value in a JSON document at the location specified by a JSON Pointer string.
const jsonPointer = require('@sagold/json-pointer');
const document = { foo: { bar: 'baz' } };
jsonPointer.set(document, '/foo/bar', 'new value');
console.log(document); // Output: { foo: { bar: 'new value' } }
Delete Value
This feature allows you to delete a value from a JSON document at the location specified by a JSON Pointer string.
const jsonPointer = require('@sagold/json-pointer');
const document = { foo: { bar: 'baz' } };
jsonPointer.remove(document, '/foo/bar');
console.log(document); // Output: { foo: {} }
The 'jsonpointer' package provides similar functionality for manipulating JSON documents using JSON Pointers. It supports get, set, and delete operations. Compared to @sagold/json-pointer, it has a more established user base and is widely used in the community.
The 'json-ptr' package is another alternative for working with JSON Pointers. It offers additional features like resolving pointers against a base document and handling URI fragments. It is more feature-rich compared to @sagold/json-pointer.
The 'json-pointer' package is a straightforward implementation of JSON Pointer. It provides basic get and set operations. It is simpler and has fewer dependencies compared to @sagold/json-pointer.
json-pointer implementation following RFC 6901 to work with serializable paths into javascript data structures.
api | usage examples | fragment identifier | breaking changes
install
yarn add @sagold/json-pointer
usage
import { get, set, remove } from '@sagold/json-pointer';
const data = {};
get(data, '/path/to/nested/item'); // undefined
set(data, '/path/to/nested/item', 123); // { path: { to: { nested: { item: 123 }}}
remove(data, '/path/to/nested/item'); // { path: { to: { nested: { }}}
As the error handling is not further specified, this implementation will return undefined
for any invalid
pointer/missing data, making it very convenient to work with uncertain data.
method | description |
---|---|
get(data, pointer) -> value | returns the value at given pointer |
set(data, pointer, value) -> data | sets the value at the given path |
remove(data, pointer) -> data | removes a property from data |
join(...pointers) -> pointer | joins multiple pointers to a single one |
split(pointer) -> [array] | returns a json-pointer as an array |
splitLast(pointer) -> [pointer, property] | returns parent-pointer and last property |
The methods
get
,set
,remove
andjoin
also accept a list of properties as pointer. Using join with a list of properties, its signature changes tojoin(properties:string[], isURI=false) -> string
get(data:object|array, pointer:string|array, defaultValue:any) -> value:any
returns nested values
import pointer from '@sagold/json-pointer';
const data = {
parent: {
child: {
title: 'title of child'
}
}
}
const titleOfChild = pointer.get(data, '/parent/child/title'); // output: 'title of child'
console.log(pointer.get(data, '/parent/missing/path')); // output: undefined
and may optionally return a default value with
import pointer from '@sagold/json-pointer';
const value = pointer.get({}, "/invalid/value", 42);
console.log(value); // output: 42
get
also accepts a list of properties as pointer (e.g. split-result)
const titleOfChild = pointer.get(data, ['parent', 'child', 'title']); // output: 'title of child'
console.log(pointer.get(data, ['parent', 'missing', 'path'])); // output: undefined
set(data:object|array, pointer:string|array, value:any) -> data:object|array
changes a nested value
import pointer from '@sagold/json-pointer';
var data = {
parent: {
children: [
{
title: 'title of child'
}
]
}
};
pointer.set(data, '/parent/children/1', { title: 'second child' });
console.log(data.parent.children.length); // output: 2
and may be used to build data
import pointer from '@sagold/json-pointer';
const data = pointer.set({}, '/list/[]/value', 42);
console.log(data); // output: { list: [ { value: 42 } ] }
set
also accepts a list of properties as pointer (e.g. split-result)
import pointer from '@sagold/json-pointer';
const data = pointer.set({}, ['list', '[]', 'value'], 42);
console.log(data); // output: { list: [ { value: 42 } ] }
remove(data:object|array, pointer:string|array) -> data:object|array
deletes a nested property or item
import pointer from '@sagold/json-pointer';
const data = pointer.remove({ parent: { arrayOrObject: [ 0, 1 ] }}, '/parent/arrayOrObject/1');
console.log(data.parent.arrayOrObject); // output: [0]
remove
also accepts a list of properties as pointer (e.g. split-result)
import pointer from '@sagold/json-pointer';
const data = pointer.remove({ parent: { arrayOrObject: [ 0, 1 ] }}, ['parent', 'arrayOrObject', '1']);
console.log(data.parent.arrayOrObject); // output: [0]
split(pointer:string) -> properties:array
returns a json-pointer as a list of (escaped) properties
import pointer from '@sagold/json-pointer';
const list = pointer.split('/parent/arrayOrObject/1');
console.log(list); // output: ['parent', 'arrayOrObject', '1']
In order to resolve a list of properties, you can directly pass the list to get
, set
or remove
import pointer from '@sagold/json-pointer';
const data = { a: { b: true } };
const list = pointer.split('/a/b');
console.log(pointer.get(data, list)); // output: true
splitLast(pointer:string) -> [pointer, property]
separates json-pointers last property and returns both values as [parent-pointer, property]
import pointer from '@sagold/json-pointer';
const [parent, property] = pointer.splitLast('/parent/arrayOrObject/1');
console.log(parent); // output: '/parent/arrayOrObject'
console.log(property); // output: '1'
join(...pointers:string[]) -> pointer:string
joins all arguments to a valid json pointer
import pointer from '@sagold/json-pointer';
const key = 'my key';
console.log(pointer.join('root', key, '/to/target')); // output: '/root/my key/to/target'
and joins relative pointers as expected
import pointer from '@sagold/json-pointer';
console.log(pointer.join('/path/to/value', '../object')); // output: '/path/to/object'
in order to join an array received from split, you can use join(properties:string[], isURI=false) -> string
to
retrieve a valid pointer
import pointer from '@sagold/json-pointer';
const list = pointer.split('/my/path/to/child');
list.pop();
console.log(pointer.join(list)); // output: '/my/path/to'
To join an array of pointers, you must use it with join(...pointers)
or all pointers will be treated as properties:
import pointer from '@sagold/json-pointer';
const path = pointer.join(...['/path/to/value', '../object']);
console.log(path); // output: '/path/to/object'
// passing the array directly, will treat each entry as a property, which will be escaped and resolves to:
pointer.join(['/path/to/value', '../object']); // output: '/~1path~1to~1value/..~1object'
All methods support a leading uri fragment identifier (#), which will ensure that property-values are uri decoded
when resolving the path within data. This also ensures that any pointer is returned uri encoded with a leading #
. e.g.
import pointer from '@sagold/json-pointer';
// get
const value = pointer.get({ 'my value': true }, '#/my%20value');
console.log(value); // output: true
// join
const pointer = pointer.join('#/my value/to%20parent', '../to~1child');
console.log(pointer); // output: '#/my%20value/to~1child'
// join an array of properties
const uriPointer = pointer.join(['my value', 'to~1child'], isURI = true);
console.log(uriPointer); // output: '#/my%20value/to~1child'
Additionally join(...pointers, isURI)
may be used to enforce the pointer type, which is helpful in sanitizing inputs
const uriPointer = pointer.join('my pointer', 'to', 'property', isURI = true);
console.log(uriPointer); // output: '#/my%20pointer/to/property'
const uriSimple = pointer.join('/my pointer/to/property', isURI = true);
console.log(uriSimple); // output: '#/my%20pointer/to/property'
const pointer = pointer.join('#/my pointer', 'to', 'property', isURI = false);
console.log(pointer); // output: '/my pointer/to/property'
v6
, selection of empty properties is supported:
"a" » "" » "b"
join
no longer removes double slashes when joining join("/a/", "/b")
» "/a//b"v5
, package has been renamed to json-pointer
and published under @sagold/json-pointer
v4
, pointer.delete
has been renamed to remove
FAQs
json pointer - failsafe data retrieval from js and json objects
The npm package @sagold/json-pointer receives a total of 117,116 weekly downloads. As such, @sagold/json-pointer popularity was classified as popular.
We found that @sagold/json-pointer demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.